LDAP: consider blank values as null #11636

weizhouapache · 2025-09-15T08:17:08Z

Description

This PR fixes #11570

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

codecov · 2025-09-15T08:24:39Z

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 16.17%. Comparing base (7c7497c) to head (f305421).
⚠️ Report is 34 commits behind head on 4.20.

Files with missing lines	Patch %	Lines
...pache/cloudstack/ldap/OpenLdapUserManagerImpl.java	0.00%	3 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20   #11636      +/-   ##
============================================
- Coverage     16.17%   16.17%   -0.01%     
  Complexity    13297    13297              
============================================
  Files          5656     5656              
  Lines        498151   498151              
  Branches      60441    60441              
============================================
- Hits          80588    80586       -2     
- Misses       408591   408593       +2     
  Partials       8972     8972

Flag	Coverage Δ
uitests	`4.00% <ø> (ø)`
unittests	`17.03% <0.00%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

weizhouapache · 2025-09-15T10:43:36Z

@blueorangutan package

blueorangutan · 2025-09-15T10:44:04Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

sureshanaparti

clgtm

Copilot

Pull Request Overview

This PR fixes an issue with LDAP authentication by replacing null checks with blank value checks to better handle empty or whitespace-only strings in LDAP configuration values.

Replaces null checks with StringUtils.isNotBlank() for string validations
Replaces manual collection size check with CollectionUtils.isNotEmpty()
Improves handling of blank/empty LDAP configuration values

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

...er-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java

DaanHoogland

clgtm

blueorangutan · 2025-09-15T12:31:23Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 15008

weizhouapache · 2025-09-15T12:58:52Z

@blueorangutan package

blueorangutan · 2025-09-15T13:00:05Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

weizhouapache · 2025-09-15T15:03:33Z

moving to 4.20.3 milestone

blueorangutan · 2025-09-15T15:08:53Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✖️ debian ✔️ suse15. SL-JID 15015

weizhouapache · 2025-09-18T18:18:25Z

@blueorangutan package

blueorangutan · 2025-09-18T18:20:03Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-09-18T20:31:47Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15086

shwstppr

code lgtm

DaanHoogland · 2025-09-26T13:20:59Z

@blueorangutan test keepEnv

blueorangutan · 2025-09-26T13:22:04Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-09-27T05:21:20Z

[SF] Trillian test result (tid-14451)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 54140 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr11636-t14451-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

DaanHoogland · 2025-10-10T11:03:37Z

It works for the global setting @weizhouapache , but not for the domain level setting, @weizhouapache . You think we should do that as well?

weizhouapache · 2025-10-10T11:46:51Z

It works for the global setting @weizhouapache , but not for the domain level setting, @weizhouapache . You think we should do that as well?

@DaanHoogland
I guess you mean we change the way of getting values ?

domain or zone value (if domain value is null)
===>
domain or zone value (if domain value is null or blank)

DaanHoogland · 2025-10-10T15:09:49Z

It works for the global setting @weizhouapache , but not for the domain level setting, @weizhouapache . You think we should do that as well?

@DaanHoogland I guess you mean we change the way of getting values ?
domain or zone value (if domain value is null)
===>
domain or zone value (if domain value is null or blank)

No I mean if I empty a domain value it still gets “” instead of null. (as a global value does) i.e. your change only applies on the global level.

weizhouapache · 2025-10-10T16:33:59Z

It works for the global setting @weizhouapache , but not for the domain level setting, @weizhouapache . You think we should do that as well?

@DaanHoogland I guess you mean we change the way of getting values ?
domain or zone value (if domain value is null)
===>
domain or zone value (if domain value is null or blank)
No I mean if I empty a domain value it still gets “” instead of null. (as a global value does) i.e. your change only applies on the global level.

oh, I did not notice where the values come from.
I think LdapConfiguration.java considers the domain level configurations, does it ?

DaanHoogland · 2025-10-10T17:13:37Z

It works for the global setting @weizhouapache , but not for the domain level setting, @weizhouapache . You think we should do that as well?

@DaanHoogland I guess you mean we change the way of getting values ?
domain or zone value (if domain value is null)
===>
domain or zone value (if domain value is null or blank)
No I mean if I empty a domain value it still gets “” instead of null. (as a global value does) i.e. your change only applies on the global level.
oh, I did not notice where the values come from.
I think LdapConfiguration.java considers the domain level configurations, does it ?

Yes initially if a domain is given, but with considering override of course. If no domain is passed global is considered.

weizhouapache · 2025-10-10T17:53:25Z

oh, I did not notice where the values come from.
I think LdapConfiguration.java considers the domain level configurations, does it ?

Yes initially if a domain is given, but with considering override of course. If no domain is passed global is considered.

I am trying to understand what the problem is.

If domain setting is blank or empty, it will be used, but this PR considers it as null.
Is it what you expected ?
or, should the global setting be considered ?

DaanHoogland · 2025-10-13T07:19:53Z

oh, I did not notice where the values come from.
I think LdapConfiguration.java considers the domain level configurations, does it ?

Yes initially if a domain is given, but with considering override of course. If no domain is passed global is considered.

I am trying to understand what the problem is.

If domain setting is blank or empty, it will be used, but this PR considers it as null. Is it what you expected ? or, should the global setting be considered ?

I just re-tested it;

on domain level set a value for ldap.search.group.principle
check in the DB domain-settings table that it is set
set the setting for this domain to “”
in the DB it will be an empty string
reset the domain level setting
in the DB the record is gone

So my question is, is this the behaivure we want

in domain an empty string is just an empty string
globally an empty string leads to a NULL in the DB
cc @scottsignal

I think an empty string should be an empty string. We could put a validation of sorts in place but introducing this inconsistency is not desirable imnsho.

weizhouapache · 2025-10-13T08:07:21Z

I just re-tested it;

on domain level set a value for ldap.search.group.principle

check in the DB domain-settings table that it is set

set the setting for this domain to “”

in the DB it will be an empty string

reset the domain level setting

in the DB the record is gone

So my question is, is this the behaivure we want

in domain an empty string is just an empty string

globally an empty string leads to a NULL in the DB
cc @scottsignal

I think an empty string should be an empty string. We could put a validation of sorts in place but introducing this inconsistency is not desirable imnsho.

I agree it would be better to deal with the global settings with default "NULL"
closing this PR

scottsignal · 2025-10-21T18:10:18Z

@DaanHoogland @weizhouapache I'm sorry for my late response on this.

I am fine with leaving it the way it is. I think this PR #11728 would address this anyways.

LDAP: consider blank values as null

64e68d8

boring-cyborg bot added the component:LDAP label Sep 15, 2025

weizhouapache added this to the 4.20.2 milestone Sep 15, 2025

weizhouapache marked this pull request as ready for review September 15, 2025 09:19

Merge branch '4.20' into 4.20-ldap-black-values

f305421

sureshanaparti requested a review from Copilot September 15, 2025 11:06

sureshanaparti approved these changes Sep 15, 2025

View reviewed changes

Copilot AI reviewed Sep 15, 2025

View reviewed changes

...er-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/OpenLdapUserManagerImpl.java Show resolved Hide resolved

DaanHoogland approved these changes Sep 15, 2025

View reviewed changes

weizhouapache modified the milestones: 4.20.2, 4.20.3 Sep 15, 2025

weizhouapache linked an issue Sep 15, 2025 that may be closed by this pull request

ldap.search.group.principle Issue #11570

Closed

weizhouapache modified the milestones: 4.20.3, 4.20.2 Sep 18, 2025

DaanHoogland added the status:needs-testing label Sep 19, 2025

shwstppr approved these changes Sep 26, 2025

View reviewed changes

DaanHoogland self-assigned this Oct 10, 2025

weizhouapache closed this Oct 13, 2025

weizhouapache removed this from the 4.20.2 milestone Oct 13, 2025

weizhouapache removed a link to an issue Oct 13, 2025

ldap.search.group.principle Issue #11570

Closed

DaanHoogland mentioned this pull request Oct 23, 2025

ldap.search.group.principle Issue #11570

Closed

LDAP: consider blank values as null #11636

LDAP: consider blank values as null #11636

Uh oh!

Conversation

weizhouapache commented Sep 15, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

weizhouapache commented Sep 15, 2025

Uh oh!

blueorangutan commented Sep 15, 2025

Uh oh!

sureshanaparti left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Sep 15, 2025

Uh oh!

weizhouapache commented Sep 15, 2025

Uh oh!

blueorangutan commented Sep 15, 2025

Uh oh!

weizhouapache commented Sep 15, 2025

Uh oh!

blueorangutan commented Sep 15, 2025

Uh oh!

weizhouapache commented Sep 18, 2025

Uh oh!

blueorangutan commented Sep 18, 2025

Uh oh!

blueorangutan commented Sep 18, 2025

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Sep 26, 2025

Uh oh!

blueorangutan commented Sep 26, 2025

Uh oh!

blueorangutan commented Sep 27, 2025

Uh oh!

DaanHoogland commented Oct 10, 2025

Uh oh!

weizhouapache commented Oct 10, 2025

Uh oh!

DaanHoogland commented Oct 10, 2025

Uh oh!

weizhouapache commented Oct 10, 2025

Uh oh!

DaanHoogland commented Oct 10, 2025

Uh oh!

weizhouapache commented Oct 10, 2025

Uh oh!

DaanHoogland commented Oct 13, 2025

Uh oh!

weizhouapache commented Oct 13, 2025

Uh oh!

scottsignal commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

codecov bot commented Sep 15, 2025 •

edited

Loading

scottsignal commented Oct 21, 2025 •

edited

Loading