AD_SearchObjects ignores AuthenticationFlags

[jsalmela]

Isn't that ldapQueryInfo object unnecessary? Just pass the ldapConnectionInfo parameter to LdapService

public static List<OutputSearchEntry> AD_SearchObjects([PropertyTab] LdapConnectionInfo ldapConnectionInfo, [PropertyTab] AD_SearchObjectProperties SearchParameters)
        {

            var ldapQueryInfo = new LdapConnectionInfo
            {
                LdapUri = ldapConnectionInfo.LdapUri + "/" + SearchParameters.Path,
                Username = ldapConnectionInfo.Username,
                Password = ldapConnectionInfo.Password
            };

            List<SearchResult> tmpObjectEntries;

            // Search objects.
            using (var ldap = new LdapService(ldapQueryInfo))
...

Would have fixe this by myself, but I can't run the tests because I don't know the needed environment variable values.

[KRuusuv]

@jsalmela , I'm guessing here, but possibly to highlight that it's not receiving the original set of parameters given in "ldapConnectionInfo", but a modified one. It should include the authentication flags in any case, so that's something that should be fixed. However, it seems that this hasn't been an issue in practice. If you are working with a system that does require those authentication flags, then it would probably best to create a branch, fix the code and then test the change in that environment. Before you do anything, though, let me double check a few things and get back to you regarding the best way to proceed.

[KRuusuv]

@jsalmela , ok, so what I said yesterday still stands: since the community tasks are not supported in the same way the official tasks are - they're community tasks, after all - the best way to get this fixed is to fix it yourself and test it in the environment you are using. You can then make a PR if the changes work. If you want more control, you can also fork the repo and give the task a new name, but then you'll have to implement any changes made to this repo yourself (assuming they're changes you want to have in your task). There's also the alternative of using the official LDAP task (https://tasks.frends.com/tasks/frends-tasks/Frends.LDAP.SearchObjects), but it supports only .NET 6, so you'll need to have a cross platform agent to use it.

[jsalmela]

Ok, thanks for the answers. We were able to take encryption in use by changing LDAP connections to use port 636 so we can live with this until we can migrate to that .NET 6 task. But anyway, this is pretty sneaky and nasty bug.

[KRuusuv]

@jsalmela , it's possible this hasn't been noticed because using LDAPS with simple bind is considered reasonably secure (at least by Microsoft) and it's likely that LDAPS was taken into use in many places after Microsoft's security advisories several years ago. Generally speaking LDAP connections using simple bind should not be allowed anymore, but that's the problem with this task and community task development in general: fixes and updates tend to be ad hoc for a certain environment's needs and finding issues partly relies on how that environment has been setup.

All that being said, it's still a bug and it's good to hear you found a workaround. I probably could find time to fix this issue during the summer myself (after all, the fix itself is quite trivial), but I also have the problem of not knowing where I could test the task afterwards. I'll ping you if I manage to figure something out.