One user can't Authenticate; others can - Malformed Filter error

[geracastro]

Using "flask-ldap3-login 0.9.14". All users who are members of the specified AD group are logged into my application except for those that have "()" in their first name in AD.

This is my configuration:

LDAP_USER_RDN_ATTR = 'cn'
LDAP_USER_LOGIN_ATTR = 'sAMAccountName'
LDAP_BASE_DN = 'DC=mydomain,DC=com'
LDAP_REQUIRED_GROUP = 'ou=helpdesk,dc=mydomain,dc=com'
LDAP_USER_SEARCH_SCOPE = 'SUBTREE'

Here's what I see in the logs:

UNSUCCESSFUL LOGIN

DEBUG:root:Validating LDAPLoginForm against LDAP
DEBUG:flask_ldap3_login:Opening connection with bind user '[e-mail]'
DEBUG:flask_ldap3_login:Successfully bound to LDAP as '[e-mail]' for search_bind method
DEBUG:flask_ldap3_login:Performing an LDAP Search using filter '(&(objectclass=person)(sAMAccountName=ebadu))', base 'DC=mydomain,DC=com', and scope 'SUBTREE'
DEBUG:flask_ldap3_login:Opening connection with bind user 'CN=Badu\, Ericka (EB),OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Directly binding a connection to a server with user:'CN=Badu\, ericka (EB),OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Authentication was successful for user 'ebadu'
DEBUG:flask_ldap3_login:Searching for groups for specific user with filter '(&(objectclass=group)(uniqueMember=CN=Badu\, Ericka (EB),OU=HELPDESK,DC=mydomain,DC=com))' , base 'DC=mydomain,DC=com' and scope 'LEVEL'
ERROR:flask_ldap3_login:malformed filter
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8629604c50>
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8628eabf98>

SUCCESSFUL LOGIN

DEBUG:root:Validating LDAPLoginForm against LDAP
DEBUG:flask_ldap3_login:Opening connection with bind user '[e-mail]'
DEBUG:flask_ldap3_login:Successfully bound to LDAP as '[e-mail]' for search_bind method
DEBUG:flask_ldap3_login:Performing an LDAP Search using filter '(&(objectclass=person)(sAMAccountName=mpeters))', base 'DC=mydomain,DC=com', and scope 'SUBTREE'
DEBUG:flask_ldap3_login:Opening connection with bind user 'CN=Peters\, Mike,OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Directly binding a connection to a server with user:'CN=Peters\, Mike,OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Authentication was successful for user 'mpeters'
DEBUG:flask_ldap3_login:Searching for groups for specific user with filter '(&(objectclass=group)(uniqueMember=CN=Peters\, Mike,OU=HELPDESK,DC=mydomain,DC=com))' , base 'DC=mydomain,DC=com' and scope 'LEVEL'
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8629683828>
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8628e91048>

Asked in SO https://stackoverflow.com/questions/53068554/ad-user-cannot-loging-to-flask-app-ldap3

[geracastro]

Not a bug in latest build. Seems to be solved in the latest version of flask-ldap3-login. I did not upgrade but modified existing code:

Replaced this:

`search_filter = '(&{group_filter}({members_attr}={user_dn}))'.format('`    
`group_filter=self.config.get('LDAP_GROUP_OBJECT_FILTER'),`    
`members_attr=self.config.get('LDAP_GROUP_MEMBERS_ATTR'),`  
`user_dn=dn`  

with this:

`safe_dn = ldap3.utils.conv.escape_filter_chars(dn)`  
`search_filter = '(&{group_filter}({members_attr}={user_dn}))'.format(`  
`group_filter=self.config.get('LDAP_GROUP_OBJECT_FILTER'),`  
`members_attr=self.config.get('LDAP_GROUP_MEMBERS_ATTR'),`  
`user_dn=safe_dn`  

[Nick Whyte]

Looks like this was fixed by #42 🙂