No LDAP Roles returned if INVALID_DN_SYNTAX on one role is thrown

[shadowlord017]

If you have LDAP Group with invalid syntax in DN, roles will be empty in case you use resolve_nested_roles. It's because of wide use try..catch in fillRoles function (exception is thrown and no other groups are checked).

It seems that opendistro-for-elasticsearch/deprecated-security-advanced-modules#8 can solve this problem, but it is like frozen.

[2019-10-31T12:13:48,706][ERROR][c.a.o.s.a.BackendRegistry] [msk-dc01-elk-es01] Cannot retrieve roles for User [name=UserName, roles=[], requestedTenant=null] from ldap due to ElasticsearchSecurityException[[org.ldaptive.LdapException@118611119::resultCode=INVALID_DN_SYNTAX, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1, message=javax.naming.InvalidNameException: CN=_Users - "Organization" Все,OU=_Organization,DC=example,DC=com: [LDAP: error code 34 - 0000208F: LdapErr: DSID-0C0907C1, coorg.elasticsearch.ElasticsearchSecurityException: [org.ldaptive.LdapException@118611119::resultCode=INVALID_DN_SYNTAX, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1, message=javax.naming.InvalidNameException: CN=_Users - "Organization" Все,OU=_Organization,DC=example,DC=com: [LDAP: error code 34 - 0000208F: LdapErr: DS at com.amazon.dlic.auth.ldap.backend.LDAPAuthorizationBackend.fillRoles(LDAPAuthorizationBackend.java:854) ~[opendistro_security_advanced_modules-1.2.0.0.jar:1.2.0.0]

[nateynateynate]

Hi @shadowlord017 - looks like you might still be using OpenDistro. The OpenSearch Project has since superceded OpenDistro. Do you mind attempting this again using the latest version of OpenSearch?

[davidlago]

We are doing some "spring cleaning in the fall", and to make sure we focus our energies on the right issues and we get a better picture of the state of the repo, we are closing all issues that we are carrying over from the ODFE era (ODFE is no longer supported/maintained, see post here).

If you believe this issue should still be considered for current versions of OpenSearch, apologies! Please let us know by re-opening it.

Thanks!