LDAP - Escaping commas in CN #4397

New Issue

GiteaMirror · 2025-11-02T05:49:18-06:00

GiteaMirror commented

2025-11-02 05:49:18 -06:00

Originally created by @JessopDev on GitHub (Nov 26, 2019).

Gitea version (or commit ref): 1.10.0
Git version: 2.24.0
Operating system: Windows Server 2016
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:
...es/auth/ldap/ldap.go:101:findUserDN() [D] Failed search using filter[(&(objectCategory=Person)(memberof=CN=Gitea Group,OU=This\, Name\, Contains\, Commas,OU=Users,DC=domain,DC=com)(sAMAccountName=username)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))]: LDAP Result Code 201 "Filter Compile Error": ldap: invalid characters for escape in filter

Description

I am trying to set up Gitea to work with our Active Directory.

Unfortunately the Groups I have been given to work with are contained within an OU which has commas in it's name. This is the name of a department and cannot be changed.
The commas need to be escaped as commas are used to seperate the OUs within the string. The 'normal' way to do this in LDAP would be to escape using a backslash.

Unfortunately this is causing the error as given above 'ldap: invalid characters for escape in filter'.

This issue also seems to have been logged here: https://github.com/gogs/gogs/issues/4760

Does anyone know of a solution to this?

Thanks.

Originally created by @JessopDev on GitHub (Nov 26, 2019). - Gitea version (or commit ref): 1.10.0 - Git version: 2.24.0 - Operating system: Windows Server 2016 - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [x] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: `...es/auth/ldap/ldap.go:101:findUserDN() [D] Failed search using filter[(&(objectCategory=Person)(memberof=CN=Gitea Group,OU=This\, Name\, Contains\, Commas,OU=Users,DC=domain,DC=com)(sAMAccountName=username)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))]: LDAP Result Code 201 "Filter Compile Error": ldap: invalid characters for escape in filter` ## Description I am trying to set up Gitea to work with our Active Directory. Unfortunately the Groups I have been given to work with are contained within an OU which has commas in it's name. This is the name of a department and cannot be changed. The commas need to be escaped as commas are used to seperate the OUs within the string. The 'normal' way to do this in LDAP would be to escape using a backslash. Unfortunately this is causing the error as given above 'ldap: invalid characters for escape in filter'. This issue also seems to have been logged here: https://github.com/gogs/gogs/issues/4760 Does anyone know of a solution to this? Thanks.

GiteaMirror added the issue/confirmed topic/authentication labels 2025-11-02 05:49:18 -06:00

GiteaMirror commented

2025-11-02 05:49:18 -06:00

@guillep2k commented on GitHub (Nov 26, 2019):

Have you tried escaping the comma yourself? \2c instead of ,. Since a valid query contains commas, Gitea wouldn't know which commas to escape.

@guillep2k commented on GitHub (Nov 26, 2019): Have you tried escaping the comma yourself? `\2c` instead of `,`. Since a valid query _contains_ commas, Gitea wouldn't know which commas to escape.

GiteaMirror commented

2025-11-02 05:49:18 -06:00

@JessopDev commented on GitHub (Nov 26, 2019):

Thanks guillep2k,

I had actually tried escaping the commas using \2c and \, instead of ,. It turns out that what actually worked was using \5c instead of \ as the escape char - therefore my filter became:
(memberof=CN=Gitea Group,OU=This\5c, Name\5c, Contains\5c, Commas,OU=Users,DC=domain,DC=com)

This is somewhat unintuative - as \ is the standard escape character maybe it would be possible for Gitea to replace \ with \5c ?

If not, maybe this could be added to the documentation? (happy to contribute if that's helpful)

@JessopDev commented on GitHub (Nov 26, 2019): Thanks guillep2k, I had actually tried escaping the commas using `\2c` and `\,` instead of `,`. It turns out that what actually worked was using `\5c` instead of `\` as the escape char - therefore my filter became: `(memberof=CN=Gitea Group,OU=This\5c, Name\5c, Contains\5c, Commas,OU=Users,DC=domain,DC=com)` This is somewhat unintuative - as `\` is the standard escape character maybe it would be possible for Gitea to replace `\` with `\5c` ? If not, maybe this could be added to the documentation? (happy to contribute if that's helpful)

GiteaMirror commented

2025-11-02 05:49:18 -06:00

@guillep2k commented on GitHub (Nov 26, 2019):

If not, maybe this could be added to the documentation? (happy to contribute if that's helpful)

Please do! 😄

I think it's not a good idea to add any automatic replacement now because that would break some existing installations.

@guillep2k commented on GitHub (Nov 26, 2019): > > > If not, maybe this could be added to the documentation? (happy to contribute if that's helpful) Please do! 😄 I think it's not a good idea to add any automatic replacement now because that would break some existing installations.

GiteaMirror commented

2025-11-02 05:49:18 -06:00

@stale[bot] commented on GitHub (Jan 25, 2020):

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 25, 2020): This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

GiteaMirror referenced this issue

2025-11-02 12:55:50 -06:00

[PR #4397] [MERGED] Added question for Gitea hosted Gitea #17359

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#4397