Active Directory disabled users can successfully login

[TioShivers]

Hi there!

A few days ago I figured out that disabled active directory users can successfully login at sysPass.
And syspass.log says an "Error while searching the user on LDAP".

I did another tests with expired and restricted logon hours users as well and, as expected, it's not possible to login with that users.

sysPass Version
3.1 (312.20030701)

To Reproduce
Steps to reproduce the behavior:

1. Import an active directory user in sysPass
2. Login with this user
3. Logout from sysPass
4. Disable this user in active directory and wait a few seconds
5. Login again at sysPass

Expected behavior
Disabled AD/LDAP users should not be able to login.

Event log
syspass.EXCEPTION: logger {"message":"Error while searching the user on LDAP
#0 /var/www/html/syspass/lib/SP/Providers/Auth/Ldap/LdapAuth.php(156): SP\Providers\Auth\Ldap\LdapActions->getAttributes(String)
#1 /var/www/html/syspass/lib/SP/Providers/Auth/Ldap/LdapAuth.php(121): SP\Providers\Auth\Ldap\LdapAuth->getAttributes(String)
#2 /var/www/html/syspass/lib/SP/Providers/Auth/AuthProvider.php(119): SP\Providers\Auth\Ldap\LdapAuth->authenticate(Object(SP\DataModel\UserLoginData))
#3 /var/www/html/syspass/lib/SP/Providers/Auth/AuthProvider.php(97): SP\Providers\Auth\AuthProvider->authLdap()
#4 /var/www/html/syspass/lib/SP/Services/Auth/LoginService.php(154): SP\Providers\Auth\AuthProvider->doAuth(Object(SP\DataModel\UserLoginData))
#5 /var/www/html/syspass/app/modules/web/Controllers/LoginController.php(65): SP\Services\Auth\LoginService->doLogin()
#6 [internal function]: SP\Modules\Web\Controllers\LoginController->loginAction()
#7 /var/www/html/syspass/lib/SP/Bootstrap.php(240): call_user_func_array(Array,Array)
#8 [internal function]: SP\Bootstrap->SP{closure}(Object(Klein\Request),Object(Klein\Response),Object(Klein\ServiceProvider),Object(Klein\App),Object(Klein\Klein),Object(Klein\DataCollection\RouteCollection),Array)
#9 /var/www/html/syspass/vendor/klein/klein/src/Klein/Klein.php(886): call_user_func(Object(Closure),Object(Klein\Request),Object(Klein\Response),Object(Klein\ServiceProvider),Object(Klein\App),Object(Klein\Klein),Object(Klein\DataCollection\RouteCollection),Array)
#10 /var/www/html/syspass/vendor/klein/klein/src/Klein/Klein.php(588): Klein\Klein->handleRouteCallback(Object(Klein\Route),Object(Klein\DataCollection\RouteCollection),Array)
#11 /var/www/html/syspass/lib/SP/Bootstrap.php(464): Klein\Klein->dispatch(Object(Klein\Request))
#12 /var/www/html/syspass/lib/Base.php(75): SP\Bootstrap->run(Object(DI\Container))
#13 /var/www/html/syspass/index.php(28): require(String)","caller":"N/A"}

Platform:

• OS: Debian
• OS Version: 9.9
• Chrome

By the way, I'd like to contribute with the project. I've translated all messages.po to pt_BR.
Please inform how can I send you this file, if you are interested in

Regards.

[t0l0]

Great application! Thanks a lot.

I confirm this behaviour.
Stacktrace exactly as above.

User has been cached locally once his account was still active.
Now, days after the account has been disabled in the AD, the user is still able to log in with his last password.

Expected behaviour:
Deny the login request, as the AD is reachable.

sysPass Version:
3.1 (312.20030701)

Docker image:
syspass/syspass:3.1.2-php7.3

[nuxsmin]

Hello,

please, let me check it out, LDAP should return a 533 error code.

Regards

[nuxsmin]

Hello,

it seems that your server is not using an standard result code for locked or non-existent accounts, since it should reply with an 'INVALID_CREDENTIALS (49)' code: https://ldap.com/ldap-result-code-reference-core-ldapv3-result-codes/#rc-invalidCredentials

Could you please tell me which result code is returning your server?

Regards

[t0l0]

Hi,

I did some debugging yesterday.

I have connected sysPass to MS AD on a Domain Controller.

It seems that the UserAccountControl filter bit 2 (part of the FILTER_USER_OBJECT in LdapMsAds) is hiding the locked users from being included in the search results. Then sysPass falls back to local account apparently. Introduced here
cd4d4f8#diff-d38408f2bad0b771a872115120b3cb22001b5b19881db52fde6aa6fa577bb974R40

If I remove the UserAccountControl filter everything works. The user is found in LDAP correctly and AD can return 533 error, resulting in a correctly denied login.

I have seen various issues about UserAccountControl filter but it seems it's still included unchanged?

Merry Christmas

[nuxsmin]

Hi,

these are good news. I'll checkout he UserAccountControl filter to be only flagged to 0x0020 property, so disabled accounts won't be skipped.

Many thanks for the feedback!

Merry Christmas ;)