We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Real-world AD deployments can have groups circularly reference each other, e.g. GroupA -> GroupB -> GroupC -> GroupA. In this case, when nested claims resolution is enabled, Linux clients will hang on recursive resolution at https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs#L123
GroupA -> GroupB -> GroupC -> GroupA
contoso.com
services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate(options => { if (!RuntimeInformation.IsOSPlatform(OSPlatform.Linux)) { return; } options.EnableLdap(settings => { settings.Domain = "contoso.com"; settings.MachineAccountName = "someuser"; settings.MachineAccountPassword = "somepassword"; }); }); services.AddAuthorization();
[ApiController] [Route("api/[controller]")] [Authorize(Roles = "GroupA")] public class SomeController : Controller { [HttpGet] [Route("someMethod")] public async Task<ActionResult<int>> SomeMethod() { return 1; } }
dotnet/aspnet:6.0
API call hangs, and eventually results in StackOverflowException.
StackOverflowException
The text was updated successfully, but these errors were encountered:
Proposed fix at bba75b7: basically to keep track of already processed groups via HashSet.
HashSet
Sorry, something went wrong.
Successfully merging a pull request may close this issue.
Describe the bug
Real-world AD deployments can have groups circularly reference each other, e.g.
GroupA -> GroupB -> GroupC -> GroupA
.In this case, when nested claims resolution is enabled, Linux clients will hang on recursive resolution at https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/Negotiate/src/Internal/LdapAdapter.cs#L123
To Reproduce
contoso.com
in the example).GroupA -> GroupB -> GroupC -> GroupA
.dotnet/aspnet:6.0
Exceptions (if any)
API call hangs, and eventually results in
StackOverflowException
.Further technical details
dotnet/aspnet:6.0
The text was updated successfully, but these errors were encountered: