Fetching contacts fails

[svdvonde]

Hi,

In Overleaf's share menu, I'd like to make all LDAP users available as contact (findable by name or email) for all other LDAP users. Apologies if I'm making basic configuration mistakes, but this is my attempt at configuring this contact relation:

OVERLEAF_LDAP_SEARCH_BASE=ou=People,dc=vub,dc=ac,dc=be
OVERLEAF_LDAP_SEARCH_FILTER=(|(uid={{username}})(mail={{username}}))
OVERLEAF_LDAP_EMAIL_ATT=mail
OVERLEAF_LDAP_FIRST_NAME_ATT=givenName
OVERLEAF_LDAP_LAST_NAME_ATT=sn
OVERLEAF_LDAP_NAME_ATT=cn
OVERLEAF_LDAP_SEARCH_ATTRIBUTES=["uid", "sn", "givenName", "mail"]

OVERLEAF_LDAP_CONTACTS_FILTER=(objectClass=person)

When I try this out, an error is thrown by this line of code in the application:

web           | {"name":"web","hostname":"b261c454490f","pid":203,"level":50,"err":{"message":"ldapUser[attEmail]?.toLowerCase is not a function","name":"TypeError","stack":"TypeError: ldapUser[attEmail]?.toLowerCase is not a function\n    at /overleaf/services/web/modules/ldap-authentication/app/src/LdapContacts.js:53:36\n    at Array.reduce (<anonymous>)\n    at fetchLdapContacts (/overleaf/services/web/modules/ldap-authentication/app/src/LdapContacts.js:44:37)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async getContacts (/overleaf/services/web/modules/ldap-authentication/index.js:20:33)","info":{}},"responseTimeMs":49,"req":{"method":"GET","url":"/user/contacts","remoteAddress":"127.0.0.1","headers":{"referer":"http://myldap-server/project/66ed882aedcaf8b4a66179ec","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Edg/128.0.0.0"}},"res":{"statusCode":500,"headers":{"content-length":"796"}},"msg":"GET /user/contacts","time":"2024-09-20T14:51:11.592Z","v":0}

[yu-i-i]

Try the following filter instead:

OVERLEAF_LDAP_CONTACTS_FILTER=(&(objectClass=person)(mail=*))

It seems that one of the entries in your search results has an undefined mail attribute, and the code incorrectly assumed that this wouldn’t happen. I'll resolve this by skipping such entries from the search results. However, please note that having a mail attribute is essential — all users and contacts must have an email address defined, as it is used as an ID in the Overleaf database.

[yu-i-i]

Can you safely delete the user whose contacts exhibit this behavior from mongo database? If so, could you recreate the user and observe what happens? If the behavior remains the same, I would suggest examining the contacts behavior in the mainstream version, without ldap. Unfortunately, I cannot reproduce the bug you have.

[svdvonde]

Our self-hosted version of Overleaf is not (yet) being used by users, so the only user is me, and I can destroy the database if I want.

There seems to be something particular about the LDAP config of these 3 users. I can exclude them in the contacts filter:

OVERLEAF_LDAP_CONTACTS_FILTER=(&(objectClass=person)(mail=*)(!(uid=problem-user-1))(!(uid=problem-user-2))(!(uid=problem-user-3)))

This basically resolves the issue, and the sharing menu works as expected. Tomorrow I'll try to find out what makes these 3 users different from the others. Maybe it can help track down a very specific bug.

[svdvonde]

I looked at the attributes of these 3 users compared to others, and I could not find a common denominator that somehow made them different. The problem shall remain a mystery 🙂 In my case, it is not longer an issue. When I additionally filtered for active accounts (which is desirable anyway), the problematic users were also excluded.

[yu-i-i]

I’m not a fan of such mysteries, so here's one last attempt :) Is it possible that the names or emails of these users contain unprintable characters? It shouldn't be an issue, but you never know. Would you be able to provide the ldapsearch output for one of these users, with any sensitive data redacted?

[svdvonde]

The following is the output of ldapsearch of 1 of the problematic accounts, the only 'redacted' info is the local part of mail which was a normal email address with normal [a-z] characters.

# moves, People, vub.ac.be
dn: uid=moves,ou=People,dc=vub,dc=ac,dc=be
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
cn: User MOVES
sn: MOVES
givenName: User
uid: moves
uidNumber: 1108
gidNumber: 1110
homeDirectory: /home/moves
loginShell: /bin/bash
gecos: User MOVES
mail: xxxxxxxx@vub.ac.be
sambaLogonTime: 0
sambaLogoffTime: 2147483647
sambaPwdCanChange: 0
displayName: User MOVES
sambaSID: S-1-5-21-3904260993-2295595841-432895439-3216
shadowExpire: 10000015172
shadowMax: 9999999999
sambaKickoffTime: 864001310906676
sambaAcctFlags: [DU]

Compare this to the ldapsearch output of my account which is non-problematic (with redacted email .. for bots or something):

# svdvonde, People, vub.ac.be
dn: uid=svdvonde,ou=People,dc=vub,dc=ac,dc=be
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: sambaSamAccount
cn: Sam Van den Vonder
sn: Van den Vonder
uid: svdvonde
uidNumber: 1200
gidNumber: 1193
homeDirectory: /home/svdvonde
loginShell: /bin/bash
gecos: Sam Van den Vonder
givenName: Sam
sambaLogonTime: 0
sambaLogoffTime: 2147483647
sambaPwdCanChange: 0
displayName: Sam Van den Vonder
sambaSID: S-1-5-21-3904260993-2295595841-432895439-3400
sambaPrimaryGroupSID: S-1-5-21-3904260993-2295595841-432895439-3387
sambaLogonScript: logon.bat
sambaHomePath: \\SOFT\svdvonde
sambaHomeDrive: H:
sambaAcctFlags: [U]
shadowExpire: 10000017041
shadowMax: 9999999999
sambaKickoffTime: 864001472392192
roomNumber: F.10.730
mail: xxxxxxxx@vub.ac.be

I diff'd the two records (as well as for the other 2 problematic users), and I cannot identify anything unusual. If you have any theories I'd be happy to check it against the 2 other problematic users as well.

[yu-i-i]

I cannot fix this; my code only builds a list of LDAP contacts, while displaying the contacts is managed by the main code. Just a small note: when you type a letter in the empty input field, it searches for contacts containing that letter. After pressing backspace (input field is empty again), it shows the full list of all contacts, though I have a window with a scrollbar where I can only see 8 contacts at a time.

I also noticed something in the upstream code mentioning a limit of 50 contacts. Probably, the code may show you 50 contacts initially, and then another 50 after the next backspace. I'm not sure—just a guess.

Additionally, I have a general thought: typically, a person has a limited number of potential collaborators, often from the same department. I believe it would be beneficial to structure the LDAP database so that people from the same department share the same group ID or something similar. This way, a filter could be set up to show each user only those with the same property, keeping the contacts list manageable.