Bug 53517 – S4C: Creating users that are named like containers should be prevented

Bug 53517 - S4C: Creating users that are named like containers should be prevented


Summary:	S4C: Creating users that are named like containers should be prevented

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	S4 Connector
Version:	UCS 5.0
Hardware:	Other Windows NT

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:	Samba maintainers

URL:
Keywords:

Depends on:	53102 53725
Blocks:
	Show dependency tree / graph

Reported:	2021-06-25 22:00 CEST by Florian Best
Modified:	2022-09-16 13:49 CEST (History)
CC List:	6 users (show)

See Also:
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:	Yes
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:	2021050621000473, 2022091621000294
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Florian Best

2021-06-25 22:00:58 CEST

We should investigate if we want to prevent this situation explicitly in the S4-Connector.

+++ This bug was initially created as a clone of Bug #53102 +++

root@srv-ucsm01:~# univention-app info
UCS: 4.4-7 errata873
Installed: letsencrypt=1.2.2-8 pkgdb=11.0 prometheus-node-exporter=1.1 samba4=4.10 ucsschool=4.4 v8
Upgradable: letsencrypt ucsschool

Scenario: A member of "Domain Admins" created a user named "lehrer" in the container "cn=users,ou=schule11,dc=schule-musterstadt,dc=de".

Observed behaviour: UCS created the user object just fine in OpenLDAP:
 uid=lehrer,cn=users,ou=schule11,dc=schule-musterstadt,dc=de

However, there is also a container at the same level of the LDAP tree called:
 cn=lehrer,cn=users,ou=schule11,dc=schule-musterstadt,dc=de

Things start to get messy, when Samba AD and the S4-Connector are involved. In AD, user object DNs don't start with "uid=" but with "cn=". So, the user object in AD would be:
 CN=lehrer,CN=users,OU=schule11,DC=schule-musterstadt,DC=de
And now we have the same DN for the user object and the container object.

At first, this will create a S4-Connector-Reject, because the S4-Connector can't add user attributes like objectSid to a container object.

However, when we delete the user "lehrer", the S4-Connector will delete "CN=lehrer,CN=users,OU=schule11,DC=schule-musterstadt,DC=de", which is the container, with all its subordinate objects(!), e.g. all teacher accounts of that school.


To prevent this, I think it should not be possible to create users with the same name as existing containers (at least on the same level of the LDAP tree).