From 0444d7f13d9b61d9972b8d6ff0764b3e93bda7c5 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 24 Sep 2026 01:26:57 +0200 Subject: [PATCH] NK-WP-0041-T02: diagnose Authelia plus-address filter defect; plan 4.39.28 Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e --- ...NK-WP-0041-onboarding-journey-usability.md | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/workplans/NK-WP-0041-onboarding-journey-usability.md b/workplans/NK-WP-0041-onboarding-journey-usability.md index 3a04261..db861e7 100644 --- a/workplans/NK-WP-0041-onboarding-journey-usability.md +++ b/workplans/NK-WP-0041-onboarding-journey-usability.md @@ -59,7 +59,7 @@ to a user; note it here if the password manager still misbehaves. ```task id: NK-WP-0041-T02 -status: todo +status: progress priority: medium state_hub_task_id: "83633649-3e5c-57e7-8207-609380a29c25" ``` @@ -73,6 +73,24 @@ escapes `+` DN-style inside the filter, and fix it through the reference configuration or the version. Users who use plus-addressing cannot sign in by email until then. +Diagnosis, 2026-09-24. This is an upstream Authelia defect. +`internal/authentication/ldap_util.go` `ldapEscape()` in v4.38.0 through +v4.38.19 (the last 4.38 release) and in v4.39.0 applies `ldap.EscapeFilter` +and then DN-escapes `, # + < > ; " =` as `\c`. Inside a filter, an escape +must be `\XX` hex, so the go-ldap filter compile fails for any username or +email containing one of those eight characters. v4.39.28 (2026-09-17) builds +the filter with `ldap.EscapeFilter(input)` only (`ldap_user_provider.go:720`). +No configuration workaround exists. + +Upgrade prepared. The target is `authelia/authelia:4.39.28`, pinned as +`sha256:bd97cff4…`. The live image is the floating tag `4.38` +(`sha256:46021dc2…`). The live `authelia-config` was validated locally with +placeholder secrets under both versions: each returned exit 0 with no errors +and the same set of auto-mapped deprecation warnings. Storage is SQLite on +the PVC, and 4.39 migrates the schema on start. The rollback therefore needs +the pre-upgrade copy (`backups/db.sqlite3.pre-4.39.28`) as well as the old +digest. The daily backups continue. + ## Route the portal findings to user-engine ```task