Skip to content

[Port to dtq-dev] Issue dspace-customers#903: harden LDAP auth (email fallback, groupmap guard, logging) #1408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
milanmajchrak merged 3 commits into from
Aug 14, 2026
Merged

[Port to dtq-dev] Issue dspace-customers#903: harden LDAP auth (email fallback, groupmap guard, logging) #1408

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b9e35e3
fix(ldap): harden LDAPAuthentication (email fallback, groupmap guard,…
jr-rk Aug 11, 2026
640f46b
fix(ldap): address review — DN log level + comment wording
jr-rk Aug 12, 2026
d5caebd
fix(ldap): reject groupmap entries with a blank search or group part
jr-rk Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 26 additions & 4 deletions dspace-api/src/main/java/org/dspace/authenticate/LDAPAuthentication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,7 +322,7 @@ public int authenticate(Context context,
log.info(LogHelper.getHeader(context,
"type=ldap-login", "type=ldap_but_already_email"));
context.turnOffAuthorisationSystem();
setEpersonAttributes(context, eperson, ldap, Optional.of(netid));
setEpersonAttributes(context, eperson, ldap, Optional.of(netid), email);
ePersonService.update(context, eperson);
context.dispatchEvents();
context.restoreAuthSystemState();
Expand All @@ -339,7 +339,7 @@ public int authenticate(Context context,
try {
context.turnOffAuthorisationSystem();
eperson = ePersonService.create(context);
setEpersonAttributes(context, eperson, ldap, Optional.of(netid));
setEpersonAttributes(context, eperson, ldap, Optional.of(netid), email);
eperson.setCanLogIn(true);
authenticationService.initEPerson(context, request, eperson);
ePersonService.update(context, eperson);
Expand Down Expand Up @@ -382,9 +382,22 @@ public int authenticate(Context context,
*/
private void setEpersonAttributes(Context context, EPerson eperson, SpeakerToLDAP ldap, Optional<String> netid)
throws SQLException {
setEpersonAttributes(context, eperson, ldap, netid, null);
}

/**
* Update eperson's attributes, falling back to the supplied login e-mail when LDAP has none.
*/
private void setEpersonAttributes(Context context, EPerson eperson, SpeakerToLDAP ldap,
Optional<String> netid, String email) throws SQLException {

// Set the e-mail: prefer the LDAP-provided address, otherwise fall back to the
// login e-mail when one was supplied. If neither is available, the existing
// e-mail is left unchanged.
if (StringUtils.isNotEmpty(ldap.ldapEmail)) {
eperson.setEmail(ldap.ldapEmail);
} else if (StringUtils.isNotEmpty(email)) {
eperson.setEmail(email);
}
if (StringUtils.isNotEmpty(ldap.ldapGivenName)) {
eperson.setFirstName(context, ldap.ldapGivenName);
Expand Down Expand Up @@ -734,7 +747,7 @@ public String getName() {
*/
private void assignGroups(String dn, ArrayList<String> group, Context context) {
if (StringUtils.isNotBlank(dn)) {
System.out.println("dn:" + dn);
log.debug(LogHelper.getHeader(context, "assignGroups", "dn=" + dn));
int groupmapIndex = 1;
String groupMap = configurationService.getProperty("authentication-ldap.login.groupmap." + groupmapIndex);
boolean cmp;
Expand All @@ -743,7 +756,16 @@ private void assignGroups(String dn, ArrayList<String> group, Context context) {
// groupmap contains the mapping of LDAP groups to DSpace groups
// outer loop with the DSpace groups
while (groupMap != null) {
String t[] = groupMap.split(":");
String t[] = groupMap.split(":", 2);
if (t.length < 2 || StringUtils.isBlank(t[0]) || StringUtils.isBlank(t[1])) {
log.error(LogHelper.getHeader(context, "assignGroups",
"malformed groupmap entry at index " + groupmapIndex + ": " + groupMap +
" - expected '<ldapSearchFragment>:<dspaceGroupName>' with both parts non-empty"));
groupMap = configurationService.getProperty(
"authentication-ldap.login.groupmap." + ++groupmapIndex);
continue;
}

String ldapSearchString = t[0];
String dspaceGroupName = t[1];

Expand Down
Loading