Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-109

Principal attributes containing UTF-8 characters cause exceptions in Crowd client

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Highest Highest
    • 0.4.2, 0.4.4
    • 0.3.2
    • Integration/Connectors
    • None
    • Active Directory

      Calls to findPrincipalByName are failing with below exception. When I look at the SOAP calls I find that char 4337 to be the active directory "ObjectSID" property which is UTF-8. This error stops the Email, Fullname and groups from showing up in Jira. See attachment.

      2007-01-03 16:05:54,468 http-8080-Processor25 FATAL [service.soap.client.SecurityServerClient] Unable to connect to the crowd server: Could not invoke service.. Nested exception is org.codehaus.xfire.fault.XFireFault: Error parsing document.. Nested exception is com.ctc.wstx.exc.WstxUnexpectedCharException: Illegal character ((CTRL-CHAR, code 17))
      at [row,col

      {unknown-source}]: [1,4337]
      org.codehaus.xfire.XFireRuntimeException: Could not invoke service.. Nested exception is org.codehaus.xfire.fault.XFireFault: Error parsing document.. Nested exception is com.ctc.wstx.exc.WstxUnexpectedCharException: Illegal character ((CTRL-CHAR, code 17))
      at [row,col {unknown-source}

      ]: [1,4337]
      org.codehaus.xfire.fault.XFireFault: Error parsing document.. Nested exception is com.ctc.wstx.exc.WstxUnexpectedCharException: Illegal character ((CTRL-CHAR, code 17))
      at [row,col

      {unknown-source}

      ]: [1,4337]
      at org.codehaus.xfire.fault.XFireFault.createFault(XFireFault.java:89)
      at org.codehaus.xfire.client.Client.onReceive(Client.java:386)
      at org.codehaus.xfire.transport.http.HttpChannel.sendViaClient(HttpChannel.java:139)
      at org.codehaus.xfire.transport.http.HttpChannel.send(HttpChannel.java:48)
      at org.codehaus.xfire.handler.OutMessageSender.invoke(OutMessageSender.java:26)
      at org.codehaus.xfire.handler.HandlerPipeline.invoke(HandlerPipeline.java:131)
      at org.codehaus.xfire.client.Invocation.invoke(Invocation.java:75)
      at org.codehaus.xfire.client.Client.invoke(Client.java:335)
      at org.codehaus.xfire.client.XFireProxy.handleRequest(XFireProxy.java:77)
      at org.codehaus.xfire.client.XFireProxy.invoke(XFireProxy.java:57)
      at $Proxy5.findPrincipalByName(Unknown Source)
      at com.atlassian.crowd.integration.service.soap.client.SecurityServerClient.findPrincipalByName(SecurityServerClient.java:270)
      at com.atlassian.crowd.integration.osuser.CrowdBaseProvider.findPrincipalByName(CrowdBaseProvider.java:123)
      at com.atlassian.crowd.integration.osuser.CrowdPropertySet.init(CrowdPropertySet.java:237)
      at com.opensymphony.module.propertyset.PropertySetManager.getInstance(PropertySetManager.java:45)
      at com.opensymphony.module.propertyset.PropertySetManager.getInstance(PropertySetManager.java:22)
      at com.atlassian.crowd.integration.osuser.CrowdProfileProvider.getPropertySet(CrowdProfileProvider.java:25)
      at com.opensymphony.user.Entity.getPropertySet(Entity.java:87)
      at com.opensymphony.user.User.getFullName(User.java:83)

        1. badCharFinder.zip
          2 kB
        2. jira-crowd-bug.png
          jira-crowd-bug.png
          8 kB

            [CWD-109] Principal attributes containing UTF-8 characters cause exceptions in Crowd client

            Yes no worries please see attached. See eclipse .classpath file for dependencies.

            Chris Hatch added a comment - Yes no worries please see attached. See eclipse .classpath file for dependencies.

            Wow – could you share that with us?

            We have a few different LDAP servers and I would love to run this verses all of them.

            Best regards,

            Justen

            Justen Stepka [Atlassian] added a comment - Wow – could you share that with us? We have a few different LDAP servers and I would love to run this verses all of them. Best regards, Justen

            There are still more! Actually I've just written a program to find every one in the directory that contains binary characters and found the following:
            mS-DS-CreatorSID, mSMQDigests, mSMQEncryptKey, mSMQSignCertificates, mSMQSignKey, mSMQSites

            Could you add each of these also? Cheers.

            Chris Hatch added a comment - There are still more! Actually I've just written a program to find every one in the directory that contains binary characters and found the following: mS-DS-CreatorSID, mSMQDigests, mSMQEncryptKey, mSMQSignCertificates, mSMQSignKey, mSMQSites Could you add each of these also? Cheers.

            Added 'userParameters' to the restricted parameters list.

            Justen Stepka [Atlassian] added a comment - Added 'userParameters' to the restricted parameters list.

            Adding userParameter attribute to exclusion list.

            Justen Stepka [Atlassian] added a comment - Adding userParameter attribute to exclusion list.

            We have tested this and have found the userParameters (http://msdn2.microsoft.com/en-us/library/ms680847.aspx) attribute causes the exception to be thrown also. It can contain binary characters as written by AD tools. Can you exclude this attribute also?

            Chris Hatch added a comment - We have tested this and have found the userParameters ( http://msdn2.microsoft.com/en-us/library/ms680847.aspx ) attribute causes the exception to be thrown also. It can contain binary characters as written by AD tools. Can you exclude this attribute also?

            Changed the objectSID and objectGUID to do a non-case senstive filter restriction on AD attribute IDs.

            Justen Stepka [Atlassian] added a comment - Changed the objectSID and objectGUID to do a non-case senstive filter restriction on AD attribute IDs.

            objectGUID and objectSid are removed when aggregating the attributes of an entity in an Active Directory LDAP server.

            This is available for the 0.4-RELEASE and a elegant solution that checks if the attribute is binary will need to be added for the 1.0 release.

            Justin Koke added a comment - objectGUID and objectSid are removed when aggregating the attributes of an entity in an Active Directory LDAP server. This is available for the 0.4-RELEASE and a elegant solution that checks if the attribute is binary will need to be added for the 1.0 release.

            So that thread is suggesting that the error is caused because certain binary characters must be escaped before being used in XML and the Crowd active directory connector is not doing this escaping yet.

            There seems to be a very simple workaround to me.. Drop any binary LDAP attribute altogether in 1.0...

            Damon Rand added a comment - So that thread is suggesting that the error is caused because certain binary characters must be escaped before being used in XML and the Crowd active directory connector is not doing this escaping yet. There seems to be a very simple workaround to me.. Drop any binary LDAP attribute altogether in 1.0...

            Justin Koke added a comment - Some helpful-ish docs: http://archive.woodstox.codehaus.org/user/11dae57c0609180322q2c1b9e15v9cbd91546e04737%40mail.gmail.com

              Unassigned Unassigned
              65037adbeda8 Damon Rand
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: