Hello.
We are still in the testing/evaluation phase of using osTicket 1.10.1. So far we like the overall design, feature set, and work flow. I have run into several issues testing the LDAP/AD and pass-through auth plugins, but will focus here only on the problems we are experiencing now that they are disabled and uninstalled.
First, a user created an account by registering on the Landing page, and opened a ticket.
Then I installed and configured the LDAP/AD plugin. I created an Agent associated with the same user through LDAP. He was then able to log in using his AD credentials as a User and see the ticket that he had opened prior to the plugin being installed, and log in to the Agent portal and respond to tickets.
Then I installed and tested the Pass-Through Authentication plugin. I was able to make the Agent login work, but the User login did not. It logged this error:
PHP Fatal error: Uncaught ObjectNotUnique: One object was expected; however multiple objects in the database matched the query. In fact, there are 2 matching objects. in /var/www/html/osticket/include/class.orm.php:1176\nStack trace:\n#0 /var/www/html/osticket/include/class.orm.php(545): QuerySet->one()\n#1 /var/www/html/osticket/include/class.client.php(295): VerySimpleModel::lookup(Array)\n#2 /var/www/html/osticket/include/class.auth.php(656): EndUser->getAccount()\n#3 /var/www/html/osticket/include/class.auth.php(143): UserAuthenticationBackend->login(Object(ClientSession), Object(UserHttpAuthentication))\n#4 /var/www/html/osticket/login.php(117): ClientCreateRequest->attemptAutoRegister()\n#5 {main}\n thrown in /var/www/html/osticket/include/class.orm.php on line 1176
In order to continue testing, I disabled and uninstalled the pass-through authentication plugin for now. However, this multiple object return seems to persist, causing breakage in a number of places.
The worst is what happens when the above User tries to log in. Using his AD credentials in the web form now throws this error, which also exposes his AD credentials (redacted here):
PHP Fatal error: Uncaught ObjectNotUnique: One object was expected; however multiple objects in the database matched the query. In fact, there are 2 matching objects. in /var/www/html/osticket/include/class.orm.php:1176\nStack trace:\n#0 /var/www/html/osticket/include/class.orm.php(545): QuerySet->one()\n#1 /var/www/html/osticket/include/class.user.php(1152): VerySimpleModel::lookup(Array)\n#2 /var/www/html/osticket/include/class.auth.php(1203): UserAccount::lookupByUsername(*redacted_username*)\n#3 /var/www/html/osticket/include/class.auth.php(235): osTicketClientAuthentication->authenticate(*redacted_username*, *redacted_password*)\n#4 /var/www/html/osticket/login.php(52): AuthenticationBackend::process(*redacted_username*, *redacted_password*, Array)\n#5 {main}\n thrown in /var/www/html/osticket/include/class.orm.php on line 1176
The fact that the password is exposed in the error log is the most concerning part of this. I have now disabled and uninstalled the LDAP plugin. If we do move forward I will only enable it with Pass-Through working so that osTicket never receives the password.
There are other odd symptoms throughout the interface, but the errors in the log are basically this same multiple-object return, so there isn't much point in describing them in detail.
My questions for you are:
- It is a serious concern to me that a data error would expose the user's credentials in the error log. Do you share this concern?
- It is also a concern that the Pass-Through Auth plugin is apparently capable of corrupting the user data to make it unusable. Do you understand what is going on here? I would think the object interface would be abstracted enough to prevent this.
- Do you know what I need to change in the data to relieve the error so I can resume testing? I could just wipe the database and start over, but I would feel better about this if I could understand what went wrong.
