LDAP Admin Checks Only Done on Login #1307

New issue

Open

opened 2026-01-22 06:13:10 +00:00 by Clubs · 0 comments

Clubs commented

2026-01-22 06:13:10 +00:00

Admin checks with LDAP users appear to be inconsistent at present. Specifically, there is a check in /src/api/client/session.rs on lines 149-153 which appear to be universally applied even when the configuration file mentions that manually assigning admin permissions would be required. This check is done and enforced even if it appears it should not be, and it is also only done on log-in. This means that manually granting a user admin permissions on continuwuity will always be temporary and revoked the next time that user logs into a new device, instead of preventing them from being elevated to admin initially, or keeping their adminship if the configuration file allows for manual assignment. Specifically:

"bind_dn" comes with the disclaimer that using it will make automatic granting of admin rights through LDAP non-functional
"admin_filter" comes with the disclaimer that leaving it blank will mean admin state must be manually configured

In both cases, the end result is the server stripping all existing continuwuity admins of admin power when they log in, requiring the server console or "admin execute" commands to undo the check.

Admin checks with LDAP users appear to be inconsistent at present. Specifically, there is a check in `/src/api/client/session.rs` on lines 149-153 which appear to be universally applied even when the configuration file mentions that manually assigning admin permissions would be required. This check is done and enforced even if it appears it should not be, and it is also only done on log-in. This means that manually granting a user admin permissions on continuwuity will always be temporary and revoked the next time that user logs into a new device, instead of preventing them from being elevated to admin initially, or keeping their adminship if the configuration file allows for manual assignment. Specifically: - "bind_dn" comes with the disclaimer that using it will make automatic granting of admin rights through LDAP non-functional - "admin_filter" comes with the disclaimer that leaving it blank will mean admin state must be manually configured In both cases, the end result is the server stripping all existing continuwuity admins of admin power when they log in, requiring the server console or "admin execute" commands to undo the check.