fix: only retry urldecoded password when decoding changes it (LDAP badPwdCount double-increment) - #62474
Conversation
…dPwdCount double-increment) Fixes nextcloud#33657 Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
|
Hello there, We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process. Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6 Thank you for contributing to Nextcloud and we hope to hear from you soon! (If you believe you should not receive this message, you can add yourself to the blocklist.) |
1 participant
Summary
When a wrong password is entered for an LDAP or Active Directory user, the directory's failed-login counter is increased by two instead of one. Administrators who lock accounts after three failed attempts therefore find users locked out after only two mistakes, which causes avoidable lockouts and support load.
The cause is in the password check inside the user manager. After the first authentication attempt with the plain password fails, the method decodes the password and then tries every backend a second time. That second pass exists so that non-ASCII passwords sent over HTTP basic auth, which arrive percent-encoded, can still be verified. The problem is that the second pass ran unconditionally, even when the password contained nothing to decode, so an ordinary wrong password produced two identical authentication attempts and two directory binds for a single login.
This change performs the second attempt only when decoding actually changes the password. When decoding leaves the password unchanged, the method now returns right after the first attempt, so one wrong password results in exactly one directory bind and one counter increment. The compatibility path for genuinely percent-encoded passwords is preserved: when decoding does change the value, the second attempt still runs against the decoded password.
Two unit tests were added. The first checks that a wrong password with nothing to decode reaches the backend exactly once. The second checks that a percent-encoded password still triggers a second attempt with the decoded value and authenticates when the decoded form is accepted.
Fixes #33657
TODO
Nothing outstanding. The change is self-contained and covered by the added tests.
Checklist
3. to review, feature component)stable32)AI (if applicable)
AI was used for assistance.