Bitu allows creating usernames with first character lowercase
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	• taavi
	Jan 22 2024, 10:35 PM

Description

The LDAP cn attribute directly maps to the Wikitech account username, and due to MediaWiki title naming rules the first character only is case-insensitive and the canonical representation should be always uppercase. It seems like as of T355060: Bitu changes the provided username Bitu is no longer ensuring that the first character is uppercase allowing users such as cn: arinaigum (1) be created.

Filing initially as private since I don't know how Wikitech behaves with two accounts that only differ by the first character capitalization.

Details

	Subject	Repo	Branch	Lines +/-
	Capitalize first character in CNs.	operations/software/bitu	master	+43 -4

Customize query in gerrit

Related Objects

Mentioned In: T355591: Requesting access to wmf for arinaigum
Mentioned Here: T165795: Ldap auth extension vs. ldap vs. username Case
T355060: Bitu changes the provided username

Event Timeline

• taavi created this task.Jan 22 2024, 10:35 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 22 2024, 10:35 PM

SLyngshede-WMF changed the task status from Open to In Progress.Jan 23 2024, 8:52 AM

SLyngshede-WMF triaged this task as High priority.

Fix has been deployed, we'll just leave the task open for a bit, until we're sure that everything works.

SLyngshede-WMF closed this task as Resolved.Jan 23 2024, 2:28 PM

SLyngshede-WMF claimed this task.

• taavi changed the visibility from "Custom Policy" to "Public (No Login Required)".Jan 23 2024, 2:29 PM

• taavi changed the edit policy from "Custom Policy" to "All Users".

How many users with a broken username are there? Do we want to do anything about those?

I just complied the list, there are 46. We can either go in and update their CN, I think that should be perfectly safe.

@MoritzMuehlenhoff what do you think, go in an modify the CNs or wait and see if someone complains?

I just need to double check, some are actually fixed.

Looking up each user in LDAP indicates that 24 might experience issues.

• taavi mentioned this in T355591: Requesting access to wmf for arinaigum.Jan 25 2024, 7:45 PM

See T165795: Ldap auth extension vs. ldap vs. username Case for some historical context on LDAP cn values and MediaWiki that have led to some of this issue

SLyngshede-WMF moved this task from Backlog to Resolved on the Bitu board.Apr 11 2024, 10:45 AM

Bitu allows creating usernames with first character lowercaseClosed, ResolvedPublicSecurityActions

Description

Details

Related Objects

Event Timeline

Bitu allows creating usernames with first character lowercase
Closed, ResolvedPublicSecurity
Actions