Issue with LDAP Login Using Usernames Containing a Dot (e.g., j.doe)

English:Fess
1

Hello,

I am facing an issue with LDAP integration on my Fess server. The configuration works perfectly for users whose sAMAccountName does not contain a dot (e.g., doe), but fails for users with a dot in their username (e.g., j.doe).

Environment

  • Fess version: [Insert your Fess version]
  • LDAP Server: Active Directory
  • LDAP URL: ldap://192.168.8.12:389
  • Base DN: OU=Users,OU=SUB,DC=test-domain,DC=de
  • User DN: %s@test-domain.com
  • Account Filter: (&(objectClass=user)(sAMAccountName=%s))
  • Group Filter: (objectClass=group)

Issue Description

  1. Users with sAMAccountName as doe can successfully log in and their permissions are retrieved:
action:LOGIN user:doe permissions:2Drucker Verteiler GAT|... time:2025-02-10T10:50:38.048882367Z
  1. However, users with sAMAccountName as j.doe cannot retrieve permissions and see no search results:
action:LOGIN user:j.doe permissions:1j.doe time:2025-02-10T10:51:10.406688595Z

It seems that the dot (.) in the username is causing the issue.

  1. Even after modifying the LDAP filters (e.g., allowing userPrincipalName or escaping the dot in sAMAccountName), the problem persists. The groups and permissions are not loaded for these users.

Expected Behavior

Users with a dot in their username (e.g., j.doe) should be able to log in and their group permissions should be correctly retrieved.

Actual Behavior

Users with a dot in their username can log in but their group permissions are not retrieved, resulting in no search results being shown.

Question

Is there a known issue with Fess handling usernames containing dots (.) when using LDAP? How can I ensure that users with such usernames can log in and have their permissions correctly loaded?

Thank you for your support!

2

We have tested it, but we were unable to reproduce the issue. Users with a dot in their username (e.g., j.doe) can log in and retrieve permissions correctly.

action:LOGIN    user:doe    permissions:1doe|2GroupA    ip:0:0:0:0:0:0:0:1    time:2025-02-19T10:46:48.281764800Z
action:LOGOUT    user:doe    permissions:1doe|2GroupA    ip:0:0:0:0:0:0:0:1    time:2025-02-19T10:46:54.389730300Z
action:LOGIN    user:j.doe    permissions:1j.doe|2GroupA    ip:0:0:0:0:0:0:0:1    time:2025-02-19T10:47:11.424043300Z
action:LOGOUT    user:j.doe    permissions:1j.doe|2GroupA    ip:0:0:0:0:0:0:0:1    time:2025-02-19T10:47:15.437104800Z
3

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.