Skip to content

Commit f239d9c

Browse files
molotkov-andmolotkov-and
committed
Return special error messages for write to log from ldap auth provider
1 parent f158e48 commit f239d9c

File tree

3 files changed

+66
-54
lines changed

3 files changed

+66
-54
lines changed

‎ydb/core/security/ldap_auth_provider/ldap_auth_provider.cpp‎

Lines changed: 45 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -179,9 +179,10 @@ class TLdapAuthProvider : public NActors::TActorBootstrapped<TLdapAuthProvider>
179179
LDAP_LOG_D("start TLS");
180180
result = NKikimrLdap::StartTLS(*ld);
181181
if (!NKikimrLdap::IsSuccess(result)) {
182-
LDAP_LOG_D("Could not start TLS. " << NKikimrLdap::ErrorToString(result));
182+
TStringBuilder logErrorMessage;
183+
logErrorMessage << "Could not start TLS. " << NKikimrLdap::ErrorToString(result);
183184
TEvLdapAuthProvider::TError error {
184-
.Message = ERROR_MESSAGE, .Retryable = NKikimrLdap::IsRetryableError(result)
185+
.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = NKikimrLdap::IsRetryableError(result)
185186
};
186187
// The Unbind operation is not the antithesis of the Bind operation as the name implies.
187188
// Close the LDAP connection, free the resources contained in the LDAP structure
@@ -193,10 +194,11 @@ class TLdapAuthProvider : public NActors::TActorBootstrapped<TLdapAuthProvider>
193194
LDAP_LOG_D("bind: bindDn: " << Settings.GetBindDn());
194195
result = NKikimrLdap::Bind(*ld, Settings.GetBindDn(), Settings.GetBindPassword());
195196
if (!NKikimrLdap::IsSuccess(result)) {
196-
LDAP_LOG_D("Could not perform initial LDAP bind for dn " << Settings.GetBindDn() << " on server " + UrisCreator.GetUris() << ". "
197-
<< NKikimrLdap::ErrorToString(result));
197+
TStringBuilder logErrorMessage;
198+
logErrorMessage << "Could not perform initial LDAP bind for dn " << Settings.GetBindDn() << " on server " + UrisCreator.GetUris() << ". "
199+
<< NKikimrLdap::ErrorToString(result);
198200
TEvLdapAuthProvider::TError error {
199-
.Message = ERROR_MESSAGE, .Retryable = NKikimrLdap::IsRetryableError(result)
201+
.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = NKikimrLdap::IsRetryableError(result)
200202
};
201203
// The Unbind operation is not the antithesis of the Bind operation as the name implies.
202204
// Close the LDAP connection, free the resources contained in the LDAP structure
@@ -216,37 +218,41 @@ class TLdapAuthProvider : public NActors::TActorBootstrapped<TLdapAuthProvider>
216218
const TString& caCertificateFile = Settings.GetUseTls().GetCaCertFile();
217219
result = NKikimrLdap::SetOption(*ld, NKikimrLdap::EOption::TLS_CACERTFILE, caCertificateFile.c_str());
218220
if (!NKikimrLdap::IsSuccess(result)) {
219-
LDAP_LOG_D("Could not set LDAP ca certificate file \"" << caCertificateFile + "\": " << NKikimrLdap::ErrorToString(result));
221+
TStringBuilder logErrorMessage;
222+
logErrorMessage << "Could not set LDAP ca file \"" << caCertificateFile + "\": " << NKikimrLdap::ErrorToString(result);
220223
NKikimrLdap::Unbind(*ld);
221224
return {{NKikimrLdap::ErrorToStatus(result),
222-
{.Message = ERROR_MESSAGE, .Retryable = NKikimrLdap::IsRetryableError(result)}}};
225+
{.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = NKikimrLdap::IsRetryableError(result)}}};
223226
}
224227
}
225228

226229
LDAP_LOG_D("init: scheme: " << Settings.GetScheme() << ", uris: " << UrisCreator.GetUris() << ", port: " << UrisCreator.GetConfiguredPort());
227230
result = NKikimrLdap::Init(ld, Settings.GetScheme(), UrisCreator.GetUris(), UrisCreator.GetConfiguredPort());
228231
if (!NKikimrLdap::IsSuccess(result)) {
229-
LDAP_LOG_D("Could not initialize LDAP connection for uris: " << UrisCreator.GetUris() << ". " << NKikimrLdap::LdapError(*ld));
232+
TStringBuilder logErrorMessage;
233+
logErrorMessage << "Could not initialize LDAP connection for uris: " << UrisCreator.GetUris() << ". " << NKikimrLdap::LdapError(*ld);
230234
return {{TEvLdapAuthProvider::EStatus::UNAVAILABLE,
231-
{.Message = ERROR_MESSAGE, .Retryable = false}}};
235+
{.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = false}}};
232236
}
233237

234238
result = NKikimrLdap::SetProtocolVersion(*ld);
235239
if (!NKikimrLdap::IsSuccess(result)) {
236240
NKikimrLdap::Unbind(*ld);
237-
LDAP_LOG_D("Could not set LDAP protocol version: " << NKikimrLdap::ErrorToString(result));
241+
TStringBuilder logErrorMessage;
242+
logErrorMessage << "Could not set LDAP protocol version: " << NKikimrLdap::ErrorToString(result);
238243
return {{NKikimrLdap::ErrorToStatus(result),
239-
{.Message = ERROR_MESSAGE, .Retryable = NKikimrLdap::IsRetryableError(result)}}};
244+
{.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = NKikimrLdap::IsRetryableError(result)}}};
240245
}
241246

242247
if (Settings.GetScheme() == NKikimrLdap::LDAPS_SCHEME || Settings.GetUseTls().GetEnable()) {
243248
int requireCert = NKikimrLdap::ConvertRequireCert(Settings.GetUseTls().GetCertRequire());
244249
result = NKikimrLdap::SetOption(*ld, NKikimrLdap::EOption::TLS_REQUIRE_CERT, &requireCert);
245250
if (!NKikimrLdap::IsSuccess(result)) {
246251
NKikimrLdap::Unbind(*ld);
247-
LDAP_LOG_D("Could not set require certificate option: " << NKikimrLdap::ErrorToString(result));
252+
TStringBuilder logErrorMessage;
253+
logErrorMessage << "Could not set require certificate option: " << NKikimrLdap::ErrorToString(result);
248254
return {{NKikimrLdap::ErrorToStatus(result),
249-
{.Message = ERROR_MESSAGE, .Retryable = NKikimrLdap::IsRetryableError(result)}}};
255+
{.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = NKikimrLdap::IsRetryableError(result)}}};
250256
}
251257
}
252258

@@ -256,23 +262,27 @@ class TLdapAuthProvider : public NActors::TActorBootstrapped<TLdapAuthProvider>
256262
TAuthenticateUserResponse AuthenticateUser(const TAuthenticateUserRequest& request) {
257263
char* dn = NKikimrLdap::GetDn(*request.Ld, request.Entry);
258264
if (dn == nullptr) {
259-
LDAP_LOG_D("Could not get dn for the first entry matching " << FilterCreator.GetFilter(request.Login) << " on server " << UrisCreator.GetUris() << ". "
260-
<< NKikimrLdap::LdapError(*request.Ld));
265+
TStringBuilder logErrorMessage;
266+
logErrorMessage << "Could not get dn for the first entry matching " << FilterCreator.GetFilter(request.Login)
267+
<< " on server " << UrisCreator.GetUris() << ". " << NKikimrLdap::LdapError(*request.Ld);
261268
return {{TEvLdapAuthProvider::EStatus::UNAUTHORIZED,
262-
{.Message = ERROR_MESSAGE, .Retryable = false}}};
269+
{.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = false}}};
263270
}
264271
if (request.Password.empty()) {
265-
LDAP_LOG_D("LDAP login failed for user " << TString(dn) << ". Empty password");
272+
TStringBuilder logErrorMessage;
273+
logErrorMessage << "LDAP login failed for user " << TString(dn) << ". Empty password";
266274
NKikimrLdap::MemFree(dn);
267-
return {{.Status = TEvLdapAuthProvider::EStatus::UNAUTHORIZED, .Error = {.Message = TString(ERROR_MESSAGE) + ". Empty password", .Retryable = false}}};
275+
return {{.Status = TEvLdapAuthProvider::EStatus::UNAUTHORIZED, .Error = {.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = false}}};
268276
}
269277
TEvLdapAuthProvider::TError error;
270278
LDAP_LOG_D("bind: bindDn: " << dn);
271279
int result = NKikimrLdap::Bind(*request.Ld, dn, request.Password);
272280
if (!NKikimrLdap::IsSuccess(result)) {
273-
LDAP_LOG_D("LDAP login failed for user " << TString(dn) << " on server " << UrisCreator.GetUris() << ". "
274-
<< NKikimrLdap::ErrorToString((result)));
281+
TStringBuilder logErrorMessage;
282+
logErrorMessage << "LDAP login failed for user " << TString(dn) << " on server " << UrisCreator.GetUris() << ". "
283+
<< NKikimrLdap::ErrorToString((result));
275284
error.Message = ERROR_MESSAGE;
285+
error.LogMessage = logErrorMessage;
276286
error.Retryable = NKikimrLdap::IsRetryableError(result);
277287
}
278288
NKikimrLdap::MemFree(dn);
@@ -296,22 +306,24 @@ class TLdapAuthProvider : public NActors::TActorBootstrapped<TLdapAuthProvider>
296306
&searchMessage);
297307
TSearchUserResponse response;
298308
if (!NKikimrLdap::IsSuccess(result)) {
299-
LDAP_LOG_D("Could not search for filter " << searchFilter << " on server " << UrisCreator.GetUris() << ". "
300-
<< NKikimrLdap::ErrorToString(result));
309+
TStringBuilder logErrorMessage;
310+
logErrorMessage << "Could not perform search for filter " << searchFilter << " on server " << UrisCreator.GetUris() << ". "
311+
<< NKikimrLdap::ErrorToString(result);
301312
response.Status = NKikimrLdap::ErrorToStatus(result);
302-
response.Error = {.Message = ERROR_MESSAGE, .Retryable = NKikimrLdap::IsRetryableError(result)};
313+
response.Error = {.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = NKikimrLdap::IsRetryableError(result)};
303314
return response;
304315
}
305316
const int countEntries = NKikimrLdap::CountEntries(request.Ld, searchMessage);
306317
if (countEntries != 1) {
318+
TStringBuilder logErrorMessage;
307319
if (countEntries == 0) {
308-
LDAP_LOG_D("LDAP user " << request.User << " does not exist. "
309-
"LDAP search for filter " << searchFilter << " on server " << UrisCreator.GetUris() << " return no entries");
320+
logErrorMessage << "LDAP user " << request.User << " does not exist. "
321+
"LDAP search for filter " << searchFilter << " on server " << UrisCreator.GetUris() << " return no entries";
310322
} else {
311-
LDAP_LOG_D("LDAP user " << request.User << " is not unique. "
312-
"LDAP search for filter " << searchFilter << " on server " << UrisCreator.GetUris() << " return " << countEntries << " entries");
323+
logErrorMessage << "LDAP user " << request.User << " is not unique. "
324+
"LDAP search for filter " << searchFilter << " on server " << UrisCreator.GetUris() << " return " << countEntries << " entries";
313325
}
314-
response.Error = {.Message = ERROR_MESSAGE, .Retryable = false};
326+
response.Error = {.Message = ERROR_MESSAGE, .LogMessage = logErrorMessage, .Retryable = false};
315327
response.Status = TEvLdapAuthProvider::EStatus::UNAUTHORIZED;
316328
NKikimrLdap::MsgFree(searchMessage);
317329
return response;
@@ -411,16 +423,16 @@ class TLdapAuthProvider : public NActors::TActorBootstrapped<TLdapAuthProvider>
411423

412424
TInitializeLdapConnectionResponse CheckRequiredSettingsParameters() const {
413425
if (Settings.GetHosts().empty() && Settings.GetHost().empty()) {
414-
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = "List of ldap server hosts is empty", .Retryable = false}};
426+
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = ERROR_MESSAGE, .LogMessage = "List of ldap server hosts is empty", .Retryable = false}};
415427
}
416428
if (Settings.GetBaseDn().empty()) {
417-
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = "Parameter BaseDn is empty", .Retryable = false}};
429+
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = ERROR_MESSAGE, .LogMessage = "Parameter BaseDn is empty", .Retryable = false}};
418430
}
419431
if (Settings.GetBindDn().empty()) {
420-
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = "Parameter BindDn is empty", .Retryable = false}};
432+
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = ERROR_MESSAGE, .LogMessage = "Parameter BindDn is empty", .Retryable = false}};
421433
}
422434
if (Settings.GetBindPassword().empty()) {
423-
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = "Parameter BindPassword is empty", .Retryable = false}};
435+
return {TEvLdapAuthProvider::EStatus::UNAVAILABLE, {.Message = ERROR_MESSAGE, .LogMessage = "Parameter BindPassword is empty", .Retryable = false}};
424436
}
425437
return {TEvLdapAuthProvider::EStatus::SUCCESS, {}};
426438
}
@@ -452,7 +464,7 @@ class TLdapAuthProvider : public NActors::TActorBootstrapped<TLdapAuthProvider>
452464
}
453465

454466
private:
455-
static constexpr const char* ERROR_MESSAGE = "User is unauthorized in LDAP server";
467+
static constexpr const char* ERROR_MESSAGE = "Could not login via LDAP";
456468

457469
const NKikimrProto::TLdapAuthentication Settings;
458470
const TSearchFilterCreator FilterCreator;

‎ydb/core/security/ldap_auth_provider/ldap_auth_provider_ut.cpp‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -929,7 +929,7 @@ void CheckRequiredLdapSettings(std::function<void(NKikimrProto::TLdapAuthenticat
929929
TAutoPtr<IEventHandle> handle = LdapAuthenticate(server, login, password);
930930
TEvTicketParser::TEvAuthorizeTicketResult* ticketParserResult = handle->Get<TEvTicketParser::TEvAuthorizeTicketResult>();
931931
UNIT_ASSERT_C(!ticketParserResult->Error.empty(), "Expected return error message");
932-
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "User is unauthorized in LDAP server");
932+
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "Could not login via LDAP");
933933
UNIT_ASSERT(ticketParserResult->Token == nullptr);
934934

935935
ldapServer.Stop();
@@ -948,7 +948,7 @@ void CheckRequiredLdapSettings(std::function<void(NKikimrProto::TLdapAuthenticat
948948
TAutoPtr<IEventHandle> handle = LdapAuthenticate(server, login, password);
949949
TEvTicketParser::TEvAuthorizeTicketResult* ticketParserResult = handle->Get<TEvTicketParser::TEvAuthorizeTicketResult>();
950950
UNIT_ASSERT_C(!ticketParserResult->Error.empty(), "Expected return error message");
951-
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "User is unauthorized in LDAP server");
951+
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "Could not login via LDAP");
952952
UNIT_ASSERT(ticketParserResult->Token == nullptr);
953953

954954
ldapServer.Stop();
@@ -983,7 +983,7 @@ void CheckRequiredLdapSettings(std::function<void(NKikimrProto::TLdapAuthenticat
983983
TAutoPtr<IEventHandle> handle = LdapAuthenticate(server, removedUserLogin, removedUserPassword);
984984
TEvTicketParser::TEvAuthorizeTicketResult* ticketParserResult = handle->Get<TEvTicketParser::TEvAuthorizeTicketResult>();
985985
UNIT_ASSERT_C(!ticketParserResult->Error.empty(), "Expected return error message");
986-
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "User is unauthorized in LDAP server");
986+
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "Could not login via LDAP");
987987

988988
ldapServer.Stop();
989989
}
@@ -1001,7 +1001,7 @@ void CheckRequiredLdapSettings(std::function<void(NKikimrProto::TLdapAuthenticat
10011001
TAutoPtr<IEventHandle> handle = LdapAuthenticate(server, login, password);
10021002
TEvTicketParser::TEvAuthorizeTicketResult* ticketParserResult = handle->Get<TEvTicketParser::TEvAuthorizeTicketResult>();
10031003
UNIT_ASSERT_C(!ticketParserResult->Error.empty(), "Expected return error message");
1004-
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "User is unauthorized in LDAP server");
1004+
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "Could not login via LDAP");
10051005

10061006
ldapServer.Stop();
10071007
}
@@ -1162,31 +1162,31 @@ void CheckRequiredLdapSettings(std::function<void(NKikimrProto::TLdapAuthenticat
11621162

11631163
UNIT_ASSERT_C(!ticketParserResult->Error.empty(), "Expected return error message");
11641164
UNIT_ASSERT(ticketParserResult->Token == nullptr);
1165-
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "User is unauthorized in LDAP server");
1165+
UNIT_ASSERT_STRINGS_EQUAL(ticketParserResult->Error.Message, "Could not login via LDAP");
11661166
UNIT_ASSERT_EQUAL(ticketParserResult->Error.Retryable, false);
11671167

11681168
ldapServer.Stop();
11691169
}
11701170

11711171
Y_UNIT_TEST_SUITE(LdapAuthProviderTest) {
11721172
Y_UNIT_TEST(LdapServerIsUnavailable) {
1173-
CheckRequiredLdapSettings(InitLdapSettingsWithUnavailableHost, "User is unauthorized in LDAP server", ESecurityConnectionType::START_TLS);
1173+
CheckRequiredLdapSettings(InitLdapSettingsWithUnavailableHost, "Could not login via LDAP", ESecurityConnectionType::START_TLS);
11741174
}
11751175

11761176
Y_UNIT_TEST(LdapRequestWithEmptyHost) {
1177-
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyHost, "List of ldap server hosts is empty");
1177+
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyHost, "Could not login via LDAP");
11781178
}
11791179

11801180
Y_UNIT_TEST(LdapRequestWithEmptyBaseDn) {
1181-
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyBaseDn, "Parameter BaseDn is empty");
1181+
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyBaseDn, "Could not login via LDAP");
11821182
}
11831183

11841184
Y_UNIT_TEST(LdapRequestWithEmptyBindDn) {
1185-
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyBindDn, "Parameter BindDn is empty");
1185+
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyBindDn, "Could not login via LDAP");
11861186
}
11871187

11881188
Y_UNIT_TEST(LdapRequestWithEmptyBindPassword) {
1189-
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyBindPassword, "Parameter BindPassword is empty");
1189+
CheckRequiredLdapSettings(InitLdapSettingsWithEmptyBindPassword, "Could not login via LDAP");
11901190
}
11911191
}
11921192

0 commit comments

Comments
 (0)