Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VAULT-31525 Remove lowercasing of RADIUS auth. #28884

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

JMGoldsmith
Copy link
Collaborator

Description

What does this PR do?

This PR will change the behavior of the RADIUS authentication plugin for Vault. It will now allow for users with capital letters in their usernames to be used within Vault. Previous behavior would return an all lower case user, which would be rejected by the RADIUS server if it was expecting mixed case or all caps.

This was changed due to user reports of issues with capitalization.

Existing usernames that were all lower case will not be affected, but if you use mixed case or all capitals, you will now be able to properly authenticate.

TODO only if you're a HashiCorp employee

  • Backport Labels: If this PR is in the ENT repo and needs to be backported, backport
    to N, N-1, and N-2, using the backport/ent/x.x.x+ent labels. If this PR is in the CE repo, you should only backport to N, using the backport/x.x.x label, not the enterprise labels.
    • If this fixes a critical security vulnerability or severity 1 bug, it will also need to be backported to the current LTS versions of Vault. To ensure this, use all available enterprise labels.
  • ENT Breakage: If this PR either 1) removes a public function OR 2) changes the signature
    of a public function, even if that change is in a CE file, double check that
    applying the patch for this PR to the ENT repo and running tests doesn't
    break any tests. Sometimes ENT only tests rely on public functions in CE
    files.
  • Jira: If this change has an associated Jira, it's referenced either
    in the PR description, commit message, or branch name.
  • RFC: If this change has an associated RFC, please link it in the description.
  • ENT PR: If this change has an associated ENT PR, please link it in the
    description. Also, make sure the changelog is in this PR, not in your ENT PR.

@JMGoldsmith JMGoldsmith added pr/no-milestone backport/ent/1.16.x+ent Changes are backported to 1.16.x+ent backport/ent/1.17.x+ent Changes are backported to 1.17.x+ent labels Nov 12, 2024
@github-actions github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Nov 12, 2024
Copy link

CI Results:
All Go tests succeeded! ✅

Copy link

Build Results:
All builds succeeded! ✅

@JMGoldsmith JMGoldsmith requested a review from a team November 12, 2024 14:14
@JMGoldsmith JMGoldsmith changed the title VAULT-31525 remove strings package, add test case, remove lowercasing of username VAULT-31525 Remove lowercasing of RADIUS auth. Nov 12, 2024
@@ -0,0 +1,3 @@
```release-note:bug
auth/radius: Fixed and issue where upper case items were returning as lower case.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
auth/radius: Fixed and issue where upper case items were returning as lower case.
auth/radius: Fixed an issue where usernames with upper case characters where not honored

We may also want to add a release-note:change since this is a behavior change that will also result in changes to how policies are assigned

@fairclothjm
Copy link
Contributor

I am not so sure about backporting this. This is a behavior change that could result in negative effects for existing users. RE: usernames are now case sensitive and vault policies may be assigned differently.

@fairclothjm
Copy link
Contributor

I added the missing backport/1.18.x label in case we do decide to backport this. But I don't think we should.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport/ent/1.16.x+ent Changes are backported to 1.16.x+ent backport/ent/1.17.x+ent Changes are backported to 1.17.x+ent backport/1.18.x hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed pr/no-milestone
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants