CS12 LDAP Cannot Handle Duplicated "uid:" field For the Username

[sean-horn]

1. Attempt a login on an LDAP configured CS12 system with Manage as a valid user
2. Login fails if LDAP user record contains more than one "uid:" field. Which one should we choose?

As a customer, I would like Chef Server 12 to handle duplicated fields in user records, like two uid: fields as in

uid: someguy
uid: someguy@SOMEPLACE.SOMEWHERE.COM

CS12 seems to be tripping up on the above arrangement here
https://github.com/opscode/oc_erchef/blob/95d80e2af0b143e66c111584ed4626db8cfa6663/apps/oc_chef_wm/src/oc_chef_wm_authn_ldap.erl#L155-L159

redbug debugging results and full user record can be found in ZenDesk 2555

redbug results for find_and_authenticate for the above data were

% 16:27:19 <0.809.0>({mochiweb_acceptor,init,3}) 
% oc_chef_wm_authn_ldap:find_and_authenticate_user/4 -> {error, 
{badmatch, 
["someguy", 
"someguy@SOMEPLACE.SOMEWHERE.COM"]}}

This bug has lower priority than #68

[sean-horn]

Great rundown of the issue from the Samba project: https://bugzilla.samba.org/show_bug.cgi?id=6157

TL:DR We should pick the first "uid:" attribute found in the user record, because that's what nss_ldap would do. For compatibility with Manage, we would need to choose the one that is only letters, numbers, underscores.

[seth]

What's the failure we're seeing? If there are duplicate fields in a
proplist, then the proplist accessors should pick the first value. So from
a quick read of the link you gave I was thinking the code would do what we
want?

[stevendanna]

My hunch is that eldap is handing us back something like:

[{uid, ["bob"]}, {other, ldap_stuff}]

which works great with https://github.com/chef/oc_erchef/blob/95d80e2af0b143e66c111584ed4626db8cfa6663/apps/oc_chef_wm/src/oc_chef_wm_authn_ldap.erl#L156 But when we have multiple Uid fields, if eldap_search is handing us back:

[{uid, ["bob", "bobby"]}, {other, ldap_stuff}]

Then that match will fail:

15> [Uid] = proplists:get_value(uid, [{uid, ["bob", "bobby"]}, {other, ldap_stuff}]).
** exception error: no match of right hand side value ["bob","bobby"]