LDAP LAMBDA

Hi,

We are just getting started with FusionAuth, currently investigating its suitability for our requirements, and cant seem to get the LDAP lambda to work. I know this is a new feature, which is why there is no documentation, but can someone please provide a reference lambda to use? Or a quick how-to?

Our basic use case is to have an app authenticate against FusionAuth which behind the scenes uses LDAP, so just looking to get this off the ground in its most simple configuration.

Thanks

Brad.

@robotdan This is as far as I got on Friday.

The problem is that the user.id requires a GUID as a string. If I use the sAMAccountName or userPrincipalName I get the following error:

Lambda invocation exception.

Id: 79e93d02-aeb6-47a4-9e41-1478ec79a4e5
Name: Active Directory

com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type `java.util.UUID` from String "bradley.kite@cybanetix.com": UUID has to be represented by standard 36-char representation
 at [Source: (String)"{"active":true,"data":{},"memberships":[],"passwordChangeRequired":false,"preferredLanguages":[],"registrations":[],"twoFactorEnabled":false,"verified":false,"email":"bradley.kite@cybanetix.com","firstName":"Bradley","lastName":"Kite","id":"bradley.kite@cybanetix.com"}"; line: 1, column: 241] (through reference chain: io.fusionauth.domain.User["id"])

I've tried using the actual objectGUID field from Active Directory, but this comes across in binary format, and needs to be translated to the string representation of a GUID. I've tried (with the code below) to convert the GUID from binary to string representation but no such luck as yet.

function reconcile(user, userAttributes) {
  
  console.debug("USER: " + JSON.stringify(user));
  
  console.debug("ATTR: " + JSON.stringify(userAttributes));
  
  user.email     = userAttributes.userPrincipalName;
  user.firstName = userAttributes.givenName;
  user.lastName  = userAttributes.sn;
  user.active    = true;
  user.id        = guidToString(userAttributes.objectGUID);
  
    // guidToString("\374\240\270\317\260\260\213\104\206\233\357\330\240\225\130\207");
  
}

function guidToString(x)
{
    var ret = "";
  
    for (i = 3; i >= 0; i--)
    {
        ret += ('00'+x.charCodeAt(i).toString(16)).substr(-2,2);
    }
    ret += "-";
    for (i = 5; i >= 4; i--)
    {
        ret += ('00'+x.charCodeAt(i).toString(16)).substr(-2,2);
    }
    ret += "-";
    for (i = 7; i >= 6; i--)
    {
        ret += ('00'+x.charCodeAt(i).toString(16)).substr(-2,2);
    }
    ret += "-";
    for (i = 8; i <= 9; i++)
    {
        ret += ('00'+x.charCodeAt(i).toString(16)).substr(-2,2);
    }
    ret += "-";
    for (i = 10; i < 16; i++)
    {
        ret += ('00'+x.charCodeAt(i).toString(16)).substr(-2,2);
    }
  
    return ret;
}

Any update on this guys? I cannot commit our solution to being based on FusionAuth if I'm not able to get this working.

Thanks in advance

--
Brad.

@robotdan

I'm very disappointed with this reply.

In order to evaluate Fusion Auth I had to buy a subscription in the first place (Fusion Reactor) just to get it up sand running in a lab environment (it's not even in production).

There's no documentation, and you can't even provide a reference lambda that works.

I'm happy to provide the engineering resources on our side to get this working but I'm hesitant to pay further for a product that is lacking in basic documentation when we are just in the evaluation phase. If it turns out there is some other critical component or feature that is bit suitable then it would be wasted resources.

Regards

Brad

Hi Dan,

I've noticed that the documentation has been updated, thats great, thanks.

https://fusionauth.io/docs/v1/tech/lambdas/ldap-connector-reconcile

Here it says that the UID must be a string. From Active Directory, the UID is in binary format. I've tried not assigning an ID but this doesnt work. I get this in the event log:

8/3/2020 11:49:05 pm BST
. WARNING DISCARDING USER because it was missing a unique id in the [user.id] property.

So unless I'm missing something, I'm still in the position where I need to somehow convert from binary to text format.

What LDAP directory (OpenLDAP, AD etc) are you guys testing against internally?

--
Brad.

The problem is that the array of bytes from AD is being interpreted as invalid UTF-16 data.

This can be seen because I've attempted to get the raw binary data from the objectGUID as follows:

for (i = 0; i < userAttributes.objectGUID.length; i++)
{
console.debug("GUID " + i + ": " + userAttributes.objectGUID.charCodeAt(i));
}

This ends up printing the following data:

GUID 0: 65533
GUID 1: 65533
GUID 2: 65533
GUID 3: 1008
GUID 4: 65533
GUID 5: 65533
GUID 6: 68
GUID 7: 65533
GUID 8: 65533
GUID 9: 65533
GUID 10: 1568
GUID 11: 65533
GUID 12: 88
GUID 13: 65533

Is it possible that I can go through the source code at all? I thought there was an open source version of FusionAuth but I couldnt find the code for it.

I imagine that such binary data needs to actually be an array of bytes. Something is trying to UTF-16 decode the data, and as per https://www.fileformat.info/info/unicode/char/0fffd/index.htm the actual binary data is being replaced with the UTF-16 value of 65533.

Given that the vast majority of the world (like it or not) use Active Directory, the LDAP feature is not going to be very valuable to your customers unless we can work through this.

We have over 150 Linux servers, all joined to an Active Directory domain running on the only two Windows servers we have in our estate. Not ideal, but thats the reality of the world we live in.

Hi Dan,

Thanks - I've created a ticket here:

https://github.com/FusionAuth/fusionauth-issues/issues/822

Regards

Brad.

In case anyone else would like to do the same, I have found a solution which I have detailed here:

https://github.com/FusionAuth/fusionauth-issues/issues/822#issuecomment-680172776