Problem with LDAP login

[piotrwlodarczyk]

Rocket.Chat Version: 0.55.0-rc.3
Running Instances: 1
DB Replicaset OpLog: Disabled
Node Version: v4.5.0

Hi,

I observe a problem with loggining to rocket using LDAP. Some background: in my company we have Active Directory and LDAP is used only as a proxy. I turned on LDAP login and turned off registration. It's because we need only AD users on our chat. Everything works fine until AD rules forced to change password. One of our employe saw, that after password has been changed in domain, rocket was still logged in and never was asking for new password. After log out works only old password. So we decided to turn off option "LDAP > Login Fallback". But then, when we retry to log in in console we can see:

�[34mI20170424-14:26:47.225(2) rocketchat_ldap rocketchat_ldap.js:912 �[34mLDAPHandler ➔ info User exists without "ldap: true"

and user cannot be log in. I think it's because when Login Fallback were turned on, rocket made local copy of user and after turning off Login Fallback unfortunelty try to create another one, rather than using existing.

For now, only way is to delete user created before Login Fallback was turned off.

Reproduction pattern.
WITH PROBLEM:

1. Turn on "Login Fallback"
2. Login with AD login
3. Turn of "Login Fallback"
4. cannot login. Problem: LDAPHandler ➔ info User exists without "ldap: true"

WITHOUT PROBLEM:

1. Turn off "Login Fallback"
2. Login with AD login
3. No PROBLEM 🙂

[piotrwlodarczyk]

Possible reason is that line:

https://github.com/RocketChat/Rocket.Chat/blob/master/packages/rocketchat-ldap/server/loginHandler.js#L112

User created by LDAP doesn't have ldap property

[PPPBerlin]

That issue is totally annoying. Please fix this

[localguru]

If "Login Fallback" is enabled in LDAP configuration, RC stores LDAP passwords locally. It's even worth: an user, which is removed from LDAP/AD, is able to login as long as LDAP_Login_Fallback is not set to "false", in other words: forever. see: #6144

[hollowimage]

I noticed that this issue also happens WITH "login fallback: OFF and ldap:ON" if in settings Accounts --> Registration --> "Manually Approve New Users" is set to "TRUE". Then new users created for manual approval do not have the proper flag set, even though the original profile was created with ldap.

[hollowimage]

Hey guys, any movement on this? Any idea if this is being worked on or when it could get fixed? The issue is very frustrating for those who want to run in a highly managed ldap mode, so that AD acts as the single source of truth here.

[piotrwlodarczyk]

Hi, just refresh topic. Any ideas when it can by fixed?

[mboogert]

We’re experiencing exactly the same. Any update here?

[mboogert]

Our fix was to disable the avatar sync option.