Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LDAP login prompts are written to stdout #4901

Open
cjnosal opened this issue Apr 13, 2024 · 0 comments
Open

LDAP login prompts are written to stdout #4901

cjnosal opened this issue Apr 13, 2024 · 0 comments

Comments

@cjnosal
Copy link

cjnosal commented Apr 13, 2024

Expected behavior

Login prompts "Enter LDAP Username:" and "Enter Password:" should be written to stderr so they don't interfere with stdout redirection or formatting.

Actual behavior

Login prompts are written to stdout.
If redirecting the output to save credentials (or prevent credentials from being logged) the user can't see the prompts.
If using --json to allow programmatic consumption of the credentials the json file will be invalid.

Steps to reproduce the behavior

  1. configure minio with LDAP authentication and provion bind credentials for the minio system user
    cat > /etc/default/minio <<EOF
    MINIO_ROOT_USER=minio-root
    MINIO_ROOT_PASSWORD=${admincred}
    
    MINIO_VOLUMES="/mnt/data"
    MINIO_OPTS="--certs-dir /opt/minio/certs"
    MINIO_SERVER_URL="https://minio.${domain}:9000"
    
    MINIO_IDENTITY_LDAP_SERVER_ADDR="ldap.${domain}:636"
    MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN="ou=people,${suffix}"
    MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER="(&(objectClass=inetOrgPerson)(uid=%s))"
    MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER="(&(objectClass=groupOfNames)(member=%d))"
    MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN="ou=groups,${suffix}"
    MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY="off"
    MINIO_IDENTITY_LDAP_SERVER_INSECURE="off"
    MINIO_IDENTITY_LDAP_SERVER_STARTTLS="off"
    MINIO_IDENTITY_LDAP_SRV_RECORD_NAME=""
    MINIO_IDENTITY_LDAP_COMMENT=""
    MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN="uid=minio,ou=systems,${suffix}"
    MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD="${ldapcred}"
    
    EOF
    
  2. mc --json idp ldap accesskey create --login https://minio.${domain}:9000 > creds.json
  3. enter username and password without visible prompts
  4. cat creds.json shows
    Enter LDAP Username: Enter Password: 
    {"status":"success","accessKey":"xxx","secretKey":"xxx","expiration":"1970-01-01T00:00:00Z"}
    

mc --version

  • (paste output of mc --version)
mc version RELEASE.2024-03-30T15-29-52Z (commit-id=9f8147bf0e037730077a1b3baef25e53181099b0)
Runtime: go1.21.8 linux/amd64

System information

Ubuntu 22.04.4 LTS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant