Compare commits

...

2 Commits

Author SHA1 Message Date
Chris F Ravenscroft 1c497d76ba ci: release 2.5.1 (#472)
* ci: release 2.5.1

* chore: set version to v2.5.1
2026-07-18 15:20:33 -07:00
Chris F Ravenscroft cf0eb7f43f Pr 470 (#473)
* fix: reject disabled users on all backends in Bind

A user with disabled = true could still bind on the config backend, since
configHandler.FindUser and LDAPOpsHelper.Bind never checked Disabled while the
SQL backends drop such users at lookup. Enforce it in Bind so every backend
behaves the same.

* fix: use configHandler.Bind rather than helper.Bind in test harness

---------

Co-authored-by: kanywst <niwatakuma@icloud.com>
2026-07-18 14:59:42 -07:00
4 changed files with 26 additions and 5 deletions
+1 -1
View File
@@ -1,3 +1,3 @@
{
"v2": "2.5.0"
"v2": "2.5.1"
}
+8
View File
@@ -1,5 +1,13 @@
# Changelog
## [2.5.1](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.1) (2026-07-18)
### Bug Fixes
* reject disabled users on all backends in Bind ([#470](https://github.com/glauth/glauth/issues/470)) ([fb65713](https://github.com/glauth/glauth/commit/fb65713fbdfd626cb033675fb42724a5fb3d06ff))
* team atlanta arbitrary password ([#471](https://github.com/glauth/glauth/issues/471)) ([cb121cd](https://github.com/glauth/glauth/commit/cb121cdc2c9b831abdf7831835ec30ead2536a7a))
## [2.5.0](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.0) (2026-04-19)
+1 -1
View File
@@ -2,4 +2,4 @@ package version
// Version is the tag of the latest release, it gets changed by the ci
// process when a release is happening
const Version = "v2.5.0" // x-release-please-version
const Version = "v2.5.1" // x-release-please-version
+16 -3
View File
@@ -1,7 +1,6 @@
package handler
import (
"context"
"encoding/hex"
"net"
"testing"
@@ -14,9 +13,22 @@ import (
"github.com/glauth/ldap"
)
type disabledBindTestMonitor struct{}
func (disabledBindTestMonitor) SetResponseTimeMetric(map[string]string, float64) error {
return nil
}
func (disabledBindTestMonitor) SetLDAPMetric(map[string]string, float64) error {
return nil
}
func TestConfigBackendDisabledUserCannotBind(t *testing.T) {
pw := "correct horse"
raw, _ := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.MinCost)
raw, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.MinCost)
if err != nil {
t.Fatal(err)
}
hexHash := hex.EncodeToString(raw)
cfg := &config.Config{}
@@ -37,13 +49,14 @@ func TestConfigBackendDisabledUserCannotBind(t *testing.T) {
log: &logger,
cfg: cfg,
ldohelper: helper,
monitor: disabledBindTestMonitor{},
tracer: tracer,
}
_, server := net.Pipe()
defer server.Close()
bind := func(dn, pass string) ldap.LDAPResultCode {
code, _ := helper.Bind(context.Background(), h, dn, pass, server)
code, _ := h.Bind(dn, pass, server)
return code
}