Skip to content

Superuser access reauthentication is broken for LDAP authenticated users #4

Open
Open
Superuser access reauthentication is broken for LDAP authenticated users#4

Description

@hostalp
hostalp
opened on Feb 9, 2023

Note: This issue was originally open in the Sentry repository getsentry/self-hosted#1955 but I was instructed to open it here instead.

Steps to Reproduce

  1. Configure LDAP (Active Directory) authentication with the help of https://github.com/PMExtra/sentry-auth-ldap (according to the description provided there).
  2. Login as LDAP authenticated user with Admin and Superuser special privileges assigned.
  3. Go to Admin > Settings and let the page open without any further activity for approx. 10 minutes.
  4. After approx. 10 minutes, perform any action that requires the Superuser authorization, such as open Admin > Users.
  5. The Superuser authorization has expired at this point and you will be requested to reauthenticate ("You are attempting to access a resource that requires superuser access, please re-authenticate as a superuser."). Perform the reauthentication.
  6. The reauthentication will always fail for LDAP users. You will be repeatedly asked to reauthenticate even though the entered password is correct.

Note: The reauthentication works correctly for local users.

Expected Result

The Superuser reauthentication should work for LDAP users.

Actual Result

WIth the LDAP module debug logging enabled all the time we can see that during the reauthentication attempt there's no LDAP activity logged at all - e.g. it looks like the whole reauthentication isn't performed via LDAP so it may fail somewhere in Sentry. However logs don't reveal much.

sentry-self-hosted-web-1 (with debug LDAP module logging enabled and working)

01:37:03 [INFO] sentry.superuser: superuser.session-expired (ip_address='10.10.12.1' user_id=3)
01:37:03 [INFO] sentry.access.api: api.access (method='GET' view='sentry.api.endpoints.user_index.UserIndexEndpoint' response=403 user_id='3' is_app='None' token_type='None' is_frontend_request='True' organization_id='None' auth_id='None' path='/api/0/users/' caller_ip='10.10.12.1' user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0' rate_limited='False' rate_limit_category='None' request_duration_seconds=0.0754690170288086 rate_limit_type='DNE' concurrent_limit='None' concurrent_requests='None' reset_time='None' group='None' limit='None' remaining='None')
01:37:03 [WARNING] django.request: Forbidden: /api/0/users/ (status_code=403 request=<WSGIRequest: GET '/api/0/users/?per_page=50&sortBy=date'>)
01:37:03 [INFO] sentry.access.api: api.access (method='GET' view='sentry.api.endpoints.authenticator_index.AuthenticatorIndexEndpoint' response=200 user_id='3' is_app='None' token_type='None' is_frontend_request='True' organization_id='None' auth_id='None' path='/api/0/authenticators/' caller_ip='10.10.12.1' user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0' rate_limited='False' rate_limit_category='None' request_duration_seconds=0.0164639949798584 rate_limit_type='DNE' concurrent_limit='None' concurrent_requests='None' reset_time='None' group='None' limit='None' remaining='None')
01:37:16 [INFO] sentry.access.api: api.access (method='PUT' view='sentry.api.endpoints.auth_index.AuthIndexEndpoint' response=403 user_id='3' is_app='None' token_type='None' is_frontend_request='True' organization_id='None' auth_id='None' path='/api/0/auth/' caller_ip='10.10.12.1' user_agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0' rate_limited='False' rate_limit_category='None' request_duration_seconds=0.01912689208984375 rate_limit_type='DNE' concurrent_limit='None' concurrent_requests='None' reset_time='None' group='None' limit='None' remaining='None')
01:37:16 [WARNING] django.request: Forbidden: /api/0/auth/ (status_code=403 request=<WSGIRequest: PUT '/api/0/auth/'>)

sentry-self-hosted-nginx-1

192.168.0.1 - - [04/Feb/2023:01:37:03 +0000] "GET /api/0/users/?per_page=50&sortBy=date HTTP/1.1" 403 106 "https://sentry.local.net/manage/users/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0" "10.10.12.1"
192.168.0.1 - - [04/Feb/2023:01:37:03 +0000] "GET /_static/dist/sentry/chunks/vendors-node_modules_core-js_modules_es_typed-array_at_js-node_modules_core-js_modules_es_typ-06a003.5636c0cbbfd554229dab.js HTTP/1.1" 200 3373 "https://sentry.local.net/manage/users/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0" "10.10.12.1"
192.168.0.1 - - [04/Feb/2023:01:37:03 +0000] "GET /_static/dist/sentry/chunks/app_components_modals_sudoModal_tsx.046324a25b268bcddd29.js HTTP/1.1" 200 5411 "https://sentry.local.net/manage/users/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0" "10.10.12.1"
192.168.0.1 - - [04/Feb/2023:01:37:03 +0000] "GET /_static/dist/sentry/chunks/vendors-node_modules_cbor-web_dist_cbor_js-node_modules_core-js_modules_web_dom-exception_stack_js.ce1fadf94d1d59de2a16.js HTTP/1.1" 200 34309 "https://sentry.local.net/manage/users/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0" "10.10.12.1"
192.168.0.1 - - [04/Feb/2023:01:37:03 +0000] "GET /api/0/authenticators/ HTTP/1.1" 200 2 "https://sentry.local.net/manage/users/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0" "10.10.12.1"
192.168.0.1 - - [04/Feb/2023:01:37:16 +0000] "PUT /api/0/auth/ HTTP/1.1" 403 28 "https://sentry.local.net/manage/users/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0" "10.10.12.1"

Sentry 23.1.1
sentry-auth-ldap 21.9.6

Activity

  1. PMExtra commented on Mar 16, 2023

    @PMExtra
    PMExtra
    on Mar 16, 2023
    Owner

    For enabling logging of ldap, we may have to change the Sentry source files, I've described it in README:

    # Make sure LOGGING.disable_existing_loggers is set to False (in sentry/conf/server.py)

    The file is usually at /usr/local/lib/python3.8/site-packages/sentry/conf/server.py.

  2. hostalp commented on Mar 16, 2023

    @hostalp
    hostalp
    on Mar 16, 2023
    Author

    I have the following in self-hosted-23.3.0/sentry/sentry.conf.py

    # Optional logging for diagnostics.
# Make sure LOGGING.disable_existing_loggers is set to False (in sentry/conf/server.py)
LOGGING['disable_existing_loggers'] = False
import logging
logger = logging.getLogger('django_auth_ldap')
logger.setLevel(logging.DEBUG)

    This appears to work, however there isn't much in the log anyway. Only those events shown above.

  3. PMExtra commented on Mar 17, 2023

    @PMExtra
    PMExtra
    on Mar 17, 2023
    Owner

    I think LOGGING['disable_existing_loggers'] = False won't work with sentry.conf.py.
    Because sentry/conf/server.py is executed after sentry.conf.py.
    It will override disable_existing_loggers become True.

  4. hostalp commented on Mar 17, 2023

    @hostalp
    hostalp
    on Mar 17, 2023
    Author

    I think it works, because I can see events such as the following being logged during login:

    17:40:33 [DEBUG] django_auth_ldap: search_s('OU=XY,OU=Synced,OU=Users,OU=_Prod,DC=ad,DC=local,DC=net', 2, '(|(userPrincipalName=%(user)s)(sAMAccountName=%(user)s))') returned 1 objects: cn=name,ou=xy,ou=synced,ou=users,ou=_prod,dc=ad,dc=local,dc=net
17:40:33 [DEBUG] django_auth_ldap: search_s('OU=AB,OU=Synced,OU=Users,OU=_Prod,DC=ad,DC=local,DC=net', 2, '(|(userPrincipalName=%(user)s)(sAMAccountName=%(user)s))') returned 0 objects:
17:40:33 [DEBUG] django_auth_ldap: Populating Django user name

    Is there supposed to be more than that?

    With that configuration and logging, there's nothing being logged from django_auth_ldap during the reauthentication. If the logging really works it could mean that the reauthentication processing doesn't even reach the django_auth_ldap module, or that it doesn't get far enough in order to log something.

    By the way I'm not sure how to set LOGGING.disable_existing_loggers via the server.py file, because I install Sentry from the https://github.com/getsentry/self-hosted sources an there's no such file in there. During the installation process it downloads all the required contents and builds container images from them which are then used to run Sentry. I can then see the related setting (LOGGING.disable_existing_loggers: True) in the /usr/local/lib/python3.8/site-packages/sentry/conf/server.py file inside the running container where I can edit it (and delete its compiled form /usr/local/lib/python3.8/site-packages/sentry/conf/__pycache__/server.cpython-38.pyc), but would that be enough (given that the change is performed inside a running container e.g. on the already running Sentry instance)? It doesn't make any difference in the logged output.

  5. PMExtra commented on Mar 21, 2023

    @PMExtra
    PMExtra
    on Mar 21, 2023
    Owner

    getsentry/sentry#10380 @hostalp

  6. Agalin commented on May 28, 2024

    @Agalin
    Agalin
    on May 28, 2024

    You cannot reauthenticate because it's trying to compare password with the one in the database. Last time I checked code was structured in a way making customization impossible.

    There is a workaround that let's you keep access to admin sites: Setup 2 factor authentication. I don't remember if TOTP is enough but it for sure works with U2F. Instead of asking for a password it wants the token and validates it properly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions