Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ldap auth] Handle closed control connection #2606

Closed
arielshaqed opened this issue Oct 26, 2021 · 0 comments · Fixed by #2613
Closed

[ldap auth] Handle closed control connection #2606

arielshaqed opened this issue Oct 26, 2021 · 0 comments · Fixed by #2613
Assignees
@arielshaqed
Labels
area/auth IAM, authorization, authentication, audit, AAA, and integrations with all those bug Something isn't working pr/high-priority Pull requests that should be reviewed first

Comments

@arielshaqed
Copy link
Contributor

Our LDAP library does not keep the control connection alive. So if it closes (e.g. 1-hour timeout overnight) LDAP authentication is lost.

Re-open control connection as needed.
@arielshaqed arielshaqed self-assigned this Oct 26, 2021
@arielshaqed arielshaqed added area/auth IAM, authorization, authentication, audit, AAA, and integrations with all those bug Something isn't working pr/high-priority Pull requests that should be reviewed first labels Oct 26, 2021
arielshaqed added a commit that referenced this issue Oct 26, 2021
@arielshaqed
Re-open control connection after it closes, and add timeouts
0f5d145 
Add much shorter LDAP timeouts to the control connection so users do not
need to wait for minutes to fail to login.

The control connection may close at any time, because TCP.  When it does
re-open it on the *next* connection attempt.  (The first attempted login
after being disconnected may fail.  I consider this a feature because it
will rarely happen, the user will try again to login, and if the attempt
just made is what caused the server to fail then we should give the user
some feedback.)

Fixes #2606.
@arielshaqed arielshaqed mentioned this issue Oct 26, 2021
Merged
arielshaqed added a commit that referenced this issue Oct 27, 2021
@arielshaqed
Re-open control connection after it closes, and add timeouts (#2613)
62ebf77 
* Re-open control connection after it closes, and add timeouts

Add much shorter LDAP timeouts to the control connection so users do not
need to wait for minutes to fail to login.

The control connection may close at any time, because TCP.  When it does
re-open it on the *next* connection attempt.  (The first attempted login
after being disconnected may fail.  I consider this a feature because it
will rarely happen, the user will try again to login, and if the attempt
just made is what caused the server to fail then we should give the user
some feedback.)

Fixes #2606.

* Name LDAP timeouts

Not on configuration because of impossibility to set default values on
optional subobjects when using viper.  Defer on this until a real user
requirement for this shows up.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@arielshaqed arielshaqed

Labels
area/auth IAM, authorization, authentication, audit, AAA, and integrations with all those bug Something isn't working pr/high-priority Pull requests that should be reviewed first
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Re-open control connection after it closes, and add timeouts treeverse/lakeFS
1 participant
@arielshaqed