DEV-311 ldap-bind-timeout (#55)

Tu-S · web-flow · commit fc47abcd0f0e · 2024-11-01T16:45:36.000+07:00
diff --git a/MultiFactor.Radius.Adapter/Configuration/ClientConfiguration.cs b/MultiFactor.Radius.Adapter/Configuration/ClientConfiguration.cs
@@ -239,5 +239,10 @@ public bool ShouldLoadUserGroups()
         /// Overrides the root-level config.
         /// </summary>
         public RandomWaiterConfig InvalidCredentialDelay { get; internal set; }
+        
+        /// <summary>
+        /// Ldap connection timeout
+        /// </summary>
+        public TimeSpan LdapBindTimeout { get; set; } = new TimeSpan(0, 0, 30);
     }
 }
diff --git a/MultiFactor.Radius.Adapter/Configuration/ServiceConfiguration.cs b/MultiFactor.Radius.Adapter/Configuration/ServiceConfiguration.cs
@@ -359,6 +359,7 @@ public static ClientConfiguration LoadClientSettings(string name,
             var bypassSecondFactorWhenApiUnreachableSetting = appSettings.Settings["bypass-second-factor-when-api-unreachable"]?.Value;
             var multiFactorApiKeySetting = appSettings.Settings["multifactor-nas-identifier"]?.Value;
             var multiFactorApiSecretSetting = appSettings.Settings["multifactor-shared-secret"]?.Value;
+            var ldapBindTimeoutSetting = appSettings.Settings["ldap-bind-timeout"]?.Value;
 
             if (string.IsNullOrEmpty(firstFactorAuthenticationSourceSettings))
             {
@@ -496,6 +497,14 @@ public static ClientConfiguration LoadClientSettings(string name,
             {
                 throw new Exception($"Configuration error: to enable pre-auth second factor for this client please set 'invalid-credential-delay' min value to 2 or more");
             }
+            
+            if (TimeSpan.TryParseExact(ldapBindTimeoutSetting, @"hh\:mm\:ss", null, System.Globalization.TimeSpanStyles.None, out var ldapBindTimeout))
+            {
+                if (ldapBindTimeout > TimeSpan.Zero)
+                {
+                    configuration.LdapBindTimeout = ldapBindTimeout;
+                }
+            }
 
             return configuration;
         }
diff --git a/MultiFactor.Radius.Adapter/Server/FirstAuthFactorProcessing/AnonymousProcessor.cs b/MultiFactor.Radius.Adapter/Server/FirstAuthFactorProcessing/AnonymousProcessor.cs
@@ -84,6 +84,7 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque
                     _logger.Debug($"Loading attributes for user '{{user:l}}' at {domainIdentity}", user.Name);
                     using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))
                     {
+                        connection.Bind();
                         var schema = _metadataCache.Get(
                             request.Configuration.Name,
                             domainIdentity,
@@ -95,18 +96,15 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque
                 catch (UserDomainNotPermittedException ex)
                 {
                     _logger.Warning(ex.Message);
-                    continue;
                 }
                 catch (UserNameFormatException ex)
                 {
                     _logger.Warning(ex.Message);
-                    continue;
                 }
                 catch (Exception ex)
                 {
                     _logger.Error(ex, $"Loading attributes of user '{{user:l}}' at {domainIdentity} failed", request.UserName);
                     _logger.Information("Run MultiFactor.Raduis.Adapter as user with domain read permissions (basically any domain user)");
-                    continue;
                 }
             }
 
diff --git a/MultiFactor.Radius.Adapter/Server/FirstAuthFactorProcessing/RadiusFirstAuthFactorProcessor.cs b/MultiFactor.Radius.Adapter/Server/FirstAuthFactorProcessing/RadiusFirstAuthFactorProcessor.cs
@@ -143,6 +143,7 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque
                     _logger.Debug($"Loading attributes for user '{{user:l}}' at {domainIdentity}", user.Name);
                     using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))
                     {
+                        connection.Bind();
                         var schema = _metadataCache.Get(
                             request.Configuration.Name,
                             domainIdentity,
@@ -154,18 +155,15 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque
                 catch (UserDomainNotPermittedException ex)
                 {
                     _logger.Warning(ex.Message);
-                    continue;
                 }
                 catch (UserNameFormatException ex)
                 {
                     _logger.Warning(ex.Message);
-                    continue;
                 }
                 catch (Exception ex)
                 {
                     _logger.Error(ex, $"Loading attributes of user '{{user:l}}' at {domainIdentity} failed", userName);
                     _logger.Information("Run MultiFactor.Raduis.Adapter as user with domain read permissions (basically any domain user)");
-                    continue;
                 }
             }
 
diff --git a/MultiFactor.Radius.Adapter/Services/ActiveDirectory/ActiveDirectoryService.cs b/MultiFactor.Radius.Adapter/Services/ActiveDirectory/ActiveDirectoryService.cs
@@ -139,6 +139,7 @@ public bool ChangePassword(PendingRequest request, string currentPassword, out b
 
                 using (var connection = _connectionFactory.CreateAsCurrentProcessUser(_domain))
                 {
+                    connection.Bind();
                     var domain = LdapIdentity.FqdnToDn(_domain);
                     var schema = _forestMetadataCache.Get(
                         request.Configuration.Name,
@@ -196,6 +197,7 @@ private bool VerifyMembership(ClientConfiguration clientConfig, LdapIdentity use
             
             using (var connection = _connectionFactory.CreateAsCurrentProcessUser(_domain))
             {
+                connection.Bind();
                 var forestSchema = _forestMetadataCache.Get(
                     clientConfig.Name,
                     domain,
@@ -271,10 +273,13 @@ private void VerifyCredential(LdapIdentity user, PendingRequest request)
         {
             _logger.Debug("Verifying user '{User:l}' credential and status at {Domain:l}", user, _domain);
             
-            using (_ = _connectionFactory.Create(_domain, user.Name, request.Passphrase.Password))
+            using (var ldapConnection = _connectionFactory.Create(_domain, user.Name, request.Passphrase.Password, request.Configuration.LdapBindTimeout))
             {
-                _logger.Information("User '{User:l}' credential and status verified successfully in {Domain:l}", user, _domain);
+                _logger.Debug("Start bind to {Domain} as '{User}'", _domain, user.Name);
+                ldapConnection.Bind();
             }
+            
+            _logger.Information("User '{User:l}' credential and status verified successfully in {Domain:l}", user, _domain);
         }
 
         private bool IsMemberOf(LdapProfile profile, string group)
diff --git a/MultiFactor.Radius.Adapter/Services/ActiveDirectory/MembershipVerification/ActiveDirectoryMembershipVerifier.cs b/MultiFactor.Radius.Adapter/Services/ActiveDirectory/MembershipVerification/ActiveDirectoryMembershipVerifier.cs
@@ -70,6 +70,7 @@ public ComplexMembershipVerificationResult VerifyMembership(PendingRequest reque
 
                     using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))
                     {
+                        connection.Bind();
                         var schema = _metadataCache.Get(
                             request.Configuration.Name,
                             domainIdentity,
@@ -100,15 +101,13 @@ public ComplexMembershipVerificationResult VerifyMembership(PendingRequest reque
                     result.AddDomainResult(MembershipVerificationResult.Create(domainIdentity)
                         .SetSuccess(false)
                         .Build());
-                    continue;
                 }
                 catch (UserNameFormatException ex)
                 {
                     _logger.Warning(ex.Message);
                     result.AddDomainResult(MembershipVerificationResult.Create(domainIdentity)
                         .SetSuccess(false)
                         .Build());
-                    continue;
                 }
                 catch (Exception ex)
                 {
@@ -117,7 +116,6 @@ public ComplexMembershipVerificationResult VerifyMembership(PendingRequest reque
                     result.AddDomainResult(MembershipVerificationResult.Create(domainIdentity)
                         .SetSuccess(false)
                         .Build());
-                    continue;
                 }
             }
 
diff --git a/MultiFactor.Radius.Adapter/Services/Ldap/AdLdsService.cs b/MultiFactor.Radius.Adapter/Services/Ldap/AdLdsService.cs
@@ -54,8 +54,11 @@ public bool VerifyCredentialAndMembership(PendingRequest request)
             {
                 _logger.Debug($"Verifying user '{logonName}' credential and status at {ldapUrl}");
 
-                using (var connection = _connectionFactory.CreateForAdlds(ldapUrl, logonName, request.Passphrase.Password))
+                using (var connection = _connectionFactory.CreateForAdlds(ldapUrl, logonName, request.Passphrase.Password, request.Configuration.LdapBindTimeout))
                 {
+                    var isLdaps = ldapUrl.Scheme.ToLower() == "ldaps";
+                    _logger.Debug("Start bind to {Scheme}://{Server} as '{User}'", isLdaps ? "LDAPS" : "LDAP", ldapUrl.Authority, logonName);
+                    connection.Bind();
                     _logger.Information($"User '{user.Name}' credential and status verified successfully at {ldapUrl}");
 
                     return true;
diff --git a/MultiFactor.Radius.Adapter/Services/Ldap/LdapConnectionFactory.cs b/MultiFactor.Radius.Adapter/Services/Ldap/LdapConnectionFactory.cs
@@ -11,42 +11,44 @@ public class LdapConnectionFactory
     {
         private readonly ILogger _logger;
         private readonly PassedLineArguments _lineArguments;
-
+        
         public LdapConnectionFactory(ILogger logger, PassedLineArguments lineArguments)
         {
             _logger = logger;
             _lineArguments = lineArguments;
         }
 
         /// <summary>
-        /// Creates new connection to a ldap domain, binds as a current process user credential using Negotiate auth type and returns it.
+        /// Creates new connection to a ldap domain using a current process user credential with Negotiate auth type.
         /// </summary>
         /// <param name="domain">LDAP domain</param>
+        /// <param name="connectionTimeout">Connection timeout.</param>
         /// <returns></returns>
         /// <exception cref="ArgumentException"></exception>
-        public LdapConnection CreateAsCurrentProcessUser(string domain)
+        public LdapConnection CreateAsCurrentProcessUser(string domain, TimeSpan? connectionTimeout = null)
         {
             if (string.IsNullOrWhiteSpace(domain))
             {
                 throw new ArgumentException($"'{nameof(domain)}' cannot be null or whitespace.", nameof(domain));
             }
-
-            _logger.Debug("Start connection to {Domain}", domain);
+            
             var connection = new LdapConnection(domain);
             connection.SessionOptions.ProtocolVersion = 3;
-            connection.SessionOptions.RootDseCache = true;    
-
+            connection.SessionOptions.RootDseCache = true;
+            if (connectionTimeout.HasValue)
+            {
+                connection.Timeout = connectionTimeout.Value;
+            }
             if (_lineArguments.Has(KnownLineArg.ACT_AS_USER) && _lineArguments.Has(KnownLineArg.ACT_AS_USER_PWD))
             {
                 var u = _lineArguments[KnownLineArg.ACT_AS_USER];
                 var p = _lineArguments[KnownLineArg.ACT_AS_USER_PWD];
-                _logger.Debug("Start bind to {Domain} with a passed user credential {u:l}:{p:l}", domain, u, HidePwd(p));
-                connection.Bind(new NetworkCredential(u, p));
+                _logger.Debug("Connection was created to {Domain} with a passed user credential {u:l}:{p:l}", domain, u, HidePwd(p));
+                connection.Credential = new NetworkCredential(u, p);
             }
             else
             {
-                _logger.Debug("Start bind to {Domain} as a process user", domain);
-                connection.Bind();
+                _logger.Debug("Connection was created to {Domain} with credential of a process user", domain);
             }
             
             return connection;  
@@ -63,15 +65,16 @@ private static string HidePwd(string pwd)
         }
 
         /// <summary>
-        /// Creates new connection to a ldap domain, binds with the specified credential using Negotiate auth type and returns it.
+        /// Creates new connection to a ldap domain with the specified credential using Negotiate auth type.
         /// </summary>
         /// <param name="domain">LDAP domain.</param>
         /// <param name="userName">Username.</param>
         /// <param name="password">Password.</param>
+        /// <param name="connectionTimeout">Connection timeout.</param>
         /// <returns></returns>
         /// <exception cref="ArgumentException"></exception>
         /// <exception cref="ArgumentNullException"></exception>
-        public LdapConnection Create(string domain, string userName, string password)
+        public LdapConnection Create(string domain, string userName, string password, TimeSpan? connectionTimeout = null)
         {
             if (string.IsNullOrWhiteSpace(domain))
             {
@@ -87,15 +90,15 @@ public LdapConnection Create(string domain, string userName, string password)
             {
                 throw new ArgumentNullException(nameof(password));
             }
-
-            _logger.Debug("Start connection to {Domain}", domain);
+            
             var connection = new LdapConnection(domain);
             connection.Credential = new NetworkCredential(userName, password);
             connection.SessionOptions.ProtocolVersion = 3;
             connection.SessionOptions.RootDseCache = true;
-
-            _logger.Debug("Start bind to {Domain} as '{User}'", domain, userName);
-            connection.Bind();
+            if (connectionTimeout.HasValue)
+            {
+                connection.Timeout = connectionTimeout.Value;
+            }
             return connection;  
         }
 
@@ -105,10 +108,11 @@ public LdapConnection Create(string domain, string userName, string password)
         /// <param name="ldapServer">LDAP uri.</param>
         /// <param name="logonName">Logon name.</param>
         /// <param name="password">Password.</param>
+        /// <param name="connectionTimeout">Connection timeout.</param>
         /// <returns></returns>
         /// <exception cref="ArgumentNullException"></exception>
         /// <exception cref="ArgumentException"></exception>
-        public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string password)
+        public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string password, TimeSpan? connectionTimeout = null)
         {
             if (ldapServer is null)
             {
@@ -124,8 +128,7 @@ public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string pa
             {
                 throw new ArgumentNullException(nameof(password));
             }
-
-            _logger.Debug("Start connection to {Server}", ldapServer.Authority);
+            
             var connection = new LdapConnection(ldapServer.Authority);
             connection.Credential = new NetworkCredential(logonName, password);
             connection.SessionOptions.RootDseCache = true;
@@ -136,10 +139,11 @@ public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string pa
             {
                 connection.SessionOptions.SecureSocketLayer = true;
             }
+            if (connectionTimeout.HasValue)
+            {
+                connection.Timeout = connectionTimeout.Value;
+            }
 
-            _logger.Debug("Start bind to {Scheme}://{Server} as '{User}'",
-                isLdaps ? "LDAPS" : "LDAP", ldapServer.Authority, logonName);
-            connection.Bind();
             return connection;  
         }
     }
diff --git a/MultiFactor.Radius.Adapter/Services/NetbiosService.cs b/MultiFactor.Radius.Adapter/Services/NetbiosService.cs
@@ -59,6 +59,8 @@ private string ResolveDomainByNetBios(ClientConfiguration clientConfig, string f
                 _logger.Information("Degradation of the domain resolving method for {UserName:l}", fullUserName);
                 using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))
                 {
+                    _logger.Debug("Start connection to {Domain}", domain);
+                    connection.Bind();
                     var dnDomain = LdapIdentity.FqdnToDn(domain);
                     var schema = _forestMetadataCache.Get(
                         clientConfig.Name,
diff --git a/README.md b/README.md
@@ -94,6 +94,9 @@ The component's parameters are stored in ```MultiFactor.Radius.Adapter.exe.confi
   <!--Timeout for requests in the Multifactor API, the minimum value is 65 seconds-->
   <add key="multifactor-api-timeout" value="00:01:05"/>
 
+  <!-- [Optional] Ldap bind request timeout. The default value is 30 seconds. -->
+  <add key="ldap-bind-timeout" value="00:00:30"/>
+  
   <!-- Logging level: 'Debug', 'Info', 'Warn', 'Error' -->
   <add key="logging-level" value="Debug"/>
 
diff --git a/README.ru.md b/README.ru.md
@@ -95,7 +95,10 @@ Remote Authentication Dial-In User Service (RADIUS) &mdash; сетевой пр
 
   <!--Доступ к API Мультифактора через HTTP прокси (опционально)-->
   <!--add key="multifactor-api-proxy" value="http://proxy:3128"/-->
-
+  
+  <!-- [Опционально] Таймаут для ldap bind запроса. Значение по умолчанию 30 секунд -->
+  <add key="ldap-bind-timeout" value="00:00:30"/>
+  
   <!-- Уровень логирования: 'Debug', 'Info', 'Warn', 'Error' -->
   <add key="logging-level" value="Debug"/>
 

Original file line number	Diff line number	Diff line change
`@@ -239,5 +239,10 @@ public bool ShouldLoadUserGroups()`
`239`	`239`	`/// Overrides the root-level config.`
`240`	`240`	`/// </summary>`
`241`	`241`	`public RandomWaiterConfig InvalidCredentialDelay { get; internal set; }`
	`242`	`+`
	`243`	`+ /// <summary>`
	`244`	`+ /// Ldap connection timeout`
	`245`	`+ /// </summary>`
	`246`	`+ public TimeSpan LdapBindTimeout { get; set; } = new TimeSpan(0, 0, 30);`
`242`	`247`	`}`
`243`	`248`	`}`
Original file line number	Diff line number	Diff line change
`@@ -359,6 +359,7 @@ public static ClientConfiguration LoadClientSettings(string name,`
`359`	`359`	`var bypassSecondFactorWhenApiUnreachableSetting = appSettings.Settings["bypass-second-factor-when-api-unreachable"]?.Value;`
`360`	`360`	`var multiFactorApiKeySetting = appSettings.Settings["multifactor-nas-identifier"]?.Value;`
`361`	`361`	`var multiFactorApiSecretSetting = appSettings.Settings["multifactor-shared-secret"]?.Value;`
	`362`	`+ var ldapBindTimeoutSetting = appSettings.Settings["ldap-bind-timeout"]?.Value;`
`362`	`363`
`363`	`364`	`if (string.IsNullOrEmpty(firstFactorAuthenticationSourceSettings))`
`364`	`365`	`{`
`@@ -496,6 +497,14 @@ public static ClientConfiguration LoadClientSettings(string name,`
`496`	`497`	`{`
`497`	`498`	`throw new Exception($"Configuration error: to enable pre-auth second factor for this client please set 'invalid-credential-delay' min value to 2 or more");`
`498`	`499`	`}`
	`500`	`+`
	`501`	`+ if (TimeSpan.TryParseExact(ldapBindTimeoutSetting, @"hh\:mm\:ss", null, System.Globalization.TimeSpanStyles.None, out var ldapBindTimeout))`
	`502`	`+ {`
	`503`	`+ if (ldapBindTimeout > TimeSpan.Zero)`
	`504`	`+ {`
	`505`	`+ configuration.LdapBindTimeout = ldapBindTimeout;`
	`506`	`+ }`
	`507`	`+ }`
`499`	`508`
`500`	`509`	`return configuration;`
`501`	`510`	`}`
Original file line number	Diff line number	Diff line change
`@@ -84,6 +84,7 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque`
`84`	`84`	`_logger.Debug($"Loading attributes for user '{{user:l}}' at {domainIdentity}", user.Name);`
`85`	`85`	`using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))`
`86`	`86`	`{`
	`87`	`+ connection.Bind();`
`87`	`88`	`var schema = _metadataCache.Get(`
`88`	`89`	`request.Configuration.Name,`
`89`	`90`	`domainIdentity,`
`@@ -95,18 +96,15 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque`
`95`	`96`	`catch (UserDomainNotPermittedException ex)`
`96`	`97`	`{`
`97`	`98`	`_logger.Warning(ex.Message);`
`98`		`- continue;`
`99`	`99`	`}`
`100`	`100`	`catch (UserNameFormatException ex)`
`101`	`101`	`{`
`102`	`102`	`_logger.Warning(ex.Message);`
`103`		`- continue;`
`104`	`103`	`}`
`105`	`104`	`catch (Exception ex)`
`106`	`105`	`{`
`107`	`106`	`_logger.Error(ex, $"Loading attributes of user '{{user:l}}' at {domainIdentity} failed", request.UserName);`
`108`	`107`	`_logger.Information("Run MultiFactor.Raduis.Adapter as user with domain read permissions (basically any domain user)");`
`109`		`- continue;`
`110`	`108`	`}`
`111`	`109`	`}`
`112`	`110`
Original file line number	Diff line number	Diff line change
`@@ -143,6 +143,7 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque`
`143`	`143`	`_logger.Debug($"Loading attributes for user '{{user:l}}' at {domainIdentity}", user.Name);`
`144`	`144`	`using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))`
`145`	`145`	`{`
	`146`	`+ connection.Bind();`
`146`	`147`	`var schema = _metadataCache.Get(`
`147`	`148`	`request.Configuration.Name,`
`148`	`149`	`domainIdentity,`
`@@ -154,18 +155,15 @@ private Dictionary<string, string[]> LoadRequiredAttributes(PendingRequest reque`
`154`	`155`	`catch (UserDomainNotPermittedException ex)`
`155`	`156`	`{`
`156`	`157`	`_logger.Warning(ex.Message);`
`157`		`- continue;`
`158`	`158`	`}`
`159`	`159`	`catch (UserNameFormatException ex)`
`160`	`160`	`{`
`161`	`161`	`_logger.Warning(ex.Message);`
`162`		`- continue;`
`163`	`162`	`}`
`164`	`163`	`catch (Exception ex)`
`165`	`164`	`{`
`166`	`165`	`_logger.Error(ex, $"Loading attributes of user '{{user:l}}' at {domainIdentity} failed", userName);`
`167`	`166`	`_logger.Information("Run MultiFactor.Raduis.Adapter as user with domain read permissions (basically any domain user)");`
`168`		`- continue;`
`169`	`167`	`}`
`170`	`168`	`}`
`171`	`169`
Original file line number	Diff line number	Diff line change
`@@ -139,6 +139,7 @@ public bool ChangePassword(PendingRequest request, string currentPassword, out b`
`139`	`139`
`140`	`140`	`using (var connection = _connectionFactory.CreateAsCurrentProcessUser(_domain))`
`141`	`141`	`{`
	`142`	`+ connection.Bind();`
`142`	`143`	`var domain = LdapIdentity.FqdnToDn(_domain);`
`143`	`144`	`var schema = _forestMetadataCache.Get(`
`144`	`145`	`request.Configuration.Name,`
`@@ -196,6 +197,7 @@ private bool VerifyMembership(ClientConfiguration clientConfig, LdapIdentity use`
`196`	`197`
`197`	`198`	`using (var connection = _connectionFactory.CreateAsCurrentProcessUser(_domain))`
`198`	`199`	`{`
	`200`	`+ connection.Bind();`
`199`	`201`	`var forestSchema = _forestMetadataCache.Get(`
`200`	`202`	`clientConfig.Name,`
`201`	`203`	`domain,`
`@@ -271,10 +273,13 @@ private void VerifyCredential(LdapIdentity user, PendingRequest request)`
`271`	`273`	`{`
`272`	`274`	`_logger.Debug("Verifying user '{User:l}' credential and status at {Domain:l}", user, _domain);`
`273`	`275`
`274`		`- using (_ = _connectionFactory.Create(_domain, user.Name, request.Passphrase.Password))`
	`276`	`+ using (var ldapConnection = _connectionFactory.Create(_domain, user.Name, request.Passphrase.Password, request.Configuration.LdapBindTimeout))`
`275`	`277`	`{`
`276`		`- _logger.Information("User '{User:l}' credential and status verified successfully in {Domain:l}", user, _domain);`
	`278`	`+ _logger.Debug("Start bind to {Domain} as '{User}'", _domain, user.Name);`
	`279`	`+ ldapConnection.Bind();`
`277`	`280`	`}`
	`281`	`+`
	`282`	`+ _logger.Information("User '{User:l}' credential and status verified successfully in {Domain:l}", user, _domain);`
`278`	`283`	`}`
`279`	`284`
`280`	`285`	`private bool IsMemberOf(LdapProfile profile, string group)`
Original file line number	Diff line number	Diff line change
`@@ -70,6 +70,7 @@ public ComplexMembershipVerificationResult VerifyMembership(PendingRequest reque`
`70`	`70`
`71`	`71`	`using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))`
`72`	`72`	`{`
	`73`	`+ connection.Bind();`
`73`	`74`	`var schema = _metadataCache.Get(`
`74`	`75`	`request.Configuration.Name,`
`75`	`76`	`domainIdentity,`
`@@ -100,15 +101,13 @@ public ComplexMembershipVerificationResult VerifyMembership(PendingRequest reque`
`100`	`101`	`result.AddDomainResult(MembershipVerificationResult.Create(domainIdentity)`
`101`	`102`	`.SetSuccess(false)`
`102`	`103`	`.Build());`
`103`		`- continue;`
`104`	`104`	`}`
`105`	`105`	`catch (UserNameFormatException ex)`
`106`	`106`	`{`
`107`	`107`	`_logger.Warning(ex.Message);`
`108`	`108`	`result.AddDomainResult(MembershipVerificationResult.Create(domainIdentity)`
`109`	`109`	`.SetSuccess(false)`
`110`	`110`	`.Build());`
`111`		`- continue;`
`112`	`111`	`}`
`113`	`112`	`catch (Exception ex)`
`114`	`113`	`{`
`@@ -117,7 +116,6 @@ public ComplexMembershipVerificationResult VerifyMembership(PendingRequest reque`
`117`	`116`	`result.AddDomainResult(MembershipVerificationResult.Create(domainIdentity)`
`118`	`117`	`.SetSuccess(false)`
`119`	`118`	`.Build());`
`120`		`- continue;`
`121`	`119`	`}`
`122`	`120`	`}`
`123`	`121`
Original file line number	Diff line number	Diff line change
`@@ -54,8 +54,11 @@ public bool VerifyCredentialAndMembership(PendingRequest request)`
`54`	`54`	`{`
`55`	`55`	`_logger.Debug($"Verifying user '{logonName}' credential and status at {ldapUrl}");`
`56`	`56`
`57`		`- using (var connection = _connectionFactory.CreateForAdlds(ldapUrl, logonName, request.Passphrase.Password))`
	`57`	`+ using (var connection = _connectionFactory.CreateForAdlds(ldapUrl, logonName, request.Passphrase.Password, request.Configuration.LdapBindTimeout))`
`58`	`58`	`{`
	`59`	`+ var isLdaps = ldapUrl.Scheme.ToLower() == "ldaps";`
	`60`	`+ _logger.Debug("Start bind to {Scheme}://{Server} as '{User}'", isLdaps ? "LDAPS" : "LDAP", ldapUrl.Authority, logonName);`
	`61`	`+ connection.Bind();`
`59`	`62`	`_logger.Information($"User '{user.Name}' credential and status verified successfully at {ldapUrl}");`
`60`	`63`
`61`	`64`	`return true;`
Original file line number	Diff line number	Diff line change
`@@ -11,42 +11,44 @@ public class LdapConnectionFactory`
`11`	`11`	`{`
`12`	`12`	`private readonly ILogger _logger;`
`13`	`13`	`private readonly PassedLineArguments _lineArguments;`
`14`		`-`
	`14`	`+`
`15`	`15`	`public LdapConnectionFactory(ILogger logger, PassedLineArguments lineArguments)`
`16`	`16`	`{`
`17`	`17`	`_logger = logger;`
`18`	`18`	`_lineArguments = lineArguments;`
`19`	`19`	`}`
`20`	`20`
`21`	`21`	`/// <summary>`
`22`		`- /// Creates new connection to a ldap domain, binds as a current process user credential using Negotiate auth type and returns it.`
	`22`	`+ /// Creates new connection to a ldap domain using a current process user credential with Negotiate auth type.`
`23`	`23`	`/// </summary>`
`24`	`24`	`/// <param name="domain">LDAP domain</param>`
	`25`	`+ /// <param name="connectionTimeout">Connection timeout.</param>`
`25`	`26`	`/// <returns></returns>`
`26`	`27`	`/// <exception cref="ArgumentException"></exception>`
`27`		`- public LdapConnection CreateAsCurrentProcessUser(string domain)`
	`28`	`+ public LdapConnection CreateAsCurrentProcessUser(string domain, TimeSpan? connectionTimeout = null)`
`28`	`29`	`{`
`29`	`30`	`if (string.IsNullOrWhiteSpace(domain))`
`30`	`31`	`{`
`31`	`32`	`throw new ArgumentException($"'{nameof(domain)}' cannot be null or whitespace.", nameof(domain));`
`32`	`33`	`}`
`33`		`-`
`34`		`- _logger.Debug("Start connection to {Domain}", domain);`
	`34`	`+`
`35`	`35`	`var connection = new LdapConnection(domain);`
`36`	`36`	`connection.SessionOptions.ProtocolVersion = 3;`
`37`		`- connection.SessionOptions.RootDseCache = true;`
`38`		`-`
	`37`	`+ connection.SessionOptions.RootDseCache = true;`
	`38`	`+ if (connectionTimeout.HasValue)`
	`39`	`+ {`
	`40`	`+ connection.Timeout = connectionTimeout.Value;`
	`41`	`+ }`
`39`	`42`	`if (_lineArguments.Has(KnownLineArg.ACT_AS_USER) && _lineArguments.Has(KnownLineArg.ACT_AS_USER_PWD))`
`40`	`43`	`{`
`41`	`44`	`var u = _lineArguments[KnownLineArg.ACT_AS_USER];`
`42`	`45`	`var p = _lineArguments[KnownLineArg.ACT_AS_USER_PWD];`
`43`		`- _logger.Debug("Start bind to {Domain} with a passed user credential {u:l}:{p:l}", domain, u, HidePwd(p));`
`44`		`- connection.Bind(new NetworkCredential(u, p));`
	`46`	`+ _logger.Debug("Connection was created to {Domain} with a passed user credential {u:l}:{p:l}", domain, u, HidePwd(p));`
	`47`	`+ connection.Credential = new NetworkCredential(u, p);`
`45`	`48`	`}`
`46`	`49`	`else`
`47`	`50`	`{`
`48`		`- _logger.Debug("Start bind to {Domain} as a process user", domain);`
`49`		`- connection.Bind();`
	`51`	`+ _logger.Debug("Connection was created to {Domain} with credential of a process user", domain);`
`50`	`52`	`}`
`51`	`53`
`52`	`54`	`return connection;`
`@@ -63,15 +65,16 @@ private static string HidePwd(string pwd)`
`63`	`65`	`}`
`64`	`66`
`65`	`67`	`/// <summary>`
`66`		`- /// Creates new connection to a ldap domain, binds with the specified credential using Negotiate auth type and returns it.`
	`68`	`+ /// Creates new connection to a ldap domain with the specified credential using Negotiate auth type.`
`67`	`69`	`/// </summary>`
`68`	`70`	`/// <param name="domain">LDAP domain.</param>`
`69`	`71`	`/// <param name="userName">Username.</param>`
`70`	`72`	`/// <param name="password">Password.</param>`
	`73`	`+ /// <param name="connectionTimeout">Connection timeout.</param>`
`71`	`74`	`/// <returns></returns>`
`72`	`75`	`/// <exception cref="ArgumentException"></exception>`
`73`	`76`	`/// <exception cref="ArgumentNullException"></exception>`
`74`		`- public LdapConnection Create(string domain, string userName, string password)`
	`77`	`+ public LdapConnection Create(string domain, string userName, string password, TimeSpan? connectionTimeout = null)`
`75`	`78`	`{`
`76`	`79`	`if (string.IsNullOrWhiteSpace(domain))`
`77`	`80`	`{`
`@@ -87,15 +90,15 @@ public LdapConnection Create(string domain, string userName, string password)`
`87`	`90`	`{`
`88`	`91`	`throw new ArgumentNullException(nameof(password));`
`89`	`92`	`}`
`90`		`-`
`91`		`- _logger.Debug("Start connection to {Domain}", domain);`
	`93`	`+`
`92`	`94`	`var connection = new LdapConnection(domain);`
`93`	`95`	`connection.Credential = new NetworkCredential(userName, password);`
`94`	`96`	`connection.SessionOptions.ProtocolVersion = 3;`
`95`	`97`	`connection.SessionOptions.RootDseCache = true;`
`96`		`-`
`97`		`- _logger.Debug("Start bind to {Domain} as '{User}'", domain, userName);`
`98`		`- connection.Bind();`
	`98`	`+ if (connectionTimeout.HasValue)`
	`99`	`+ {`
	`100`	`+ connection.Timeout = connectionTimeout.Value;`
	`101`	`+ }`
`99`	`102`	`return connection;`
`100`	`103`	`}`
`101`	`104`
`@@ -105,10 +108,11 @@ public LdapConnection Create(string domain, string userName, string password)`
`105`	`108`	`/// <param name="ldapServer">LDAP uri.</param>`
`106`	`109`	`/// <param name="logonName">Logon name.</param>`
`107`	`110`	`/// <param name="password">Password.</param>`
	`111`	`+ /// <param name="connectionTimeout">Connection timeout.</param>`
`108`	`112`	`/// <returns></returns>`
`109`	`113`	`/// <exception cref="ArgumentNullException"></exception>`
`110`	`114`	`/// <exception cref="ArgumentException"></exception>`
`111`		`- public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string password)`
	`115`	`+ public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string password, TimeSpan? connectionTimeout = null)`
`112`	`116`	`{`
`113`	`117`	`if (ldapServer is null)`
`114`	`118`	`{`
`@@ -124,8 +128,7 @@ public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string pa`
`124`	`128`	`{`
`125`	`129`	`throw new ArgumentNullException(nameof(password));`
`126`	`130`	`}`
`127`		`-`
`128`		`- _logger.Debug("Start connection to {Server}", ldapServer.Authority);`
	`131`	`+`
`129`	`132`	`var connection = new LdapConnection(ldapServer.Authority);`
`130`	`133`	`connection.Credential = new NetworkCredential(logonName, password);`
`131`	`134`	`connection.SessionOptions.RootDseCache = true;`
`@@ -136,10 +139,11 @@ public LdapConnection CreateForAdlds(Uri ldapServer, string logonName, string pa`
`136`	`139`	`{`
`137`	`140`	`connection.SessionOptions.SecureSocketLayer = true;`
`138`	`141`	`}`
	`142`	`+ if (connectionTimeout.HasValue)`
	`143`	`+ {`
	`144`	`+ connection.Timeout = connectionTimeout.Value;`
	`145`	`+ }`
`139`	`146`
`140`		`- _logger.Debug("Start bind to {Scheme}://{Server} as '{User}'",`
`141`		`- isLdaps ? "LDAPS" : "LDAP", ldapServer.Authority, logonName);`
`142`		`- connection.Bind();`
`143`	`147`	`return connection;`
`144`	`148`	`}`
`145`	`149`	`}`
Original file line number	Diff line number	Diff line change
`@@ -59,6 +59,8 @@ private string ResolveDomainByNetBios(ClientConfiguration clientConfig, string f`
`59`	`59`	`_logger.Information("Degradation of the domain resolving method for {UserName:l}", fullUserName);`
`60`	`60`	`using (var connection = _connectionFactory.CreateAsCurrentProcessUser(domain))`
`61`	`61`	`{`
	`62`	`+ _logger.Debug("Start connection to {Domain}", domain);`
	`63`	`+ connection.Bind();`
`62`	`64`	`var dnDomain = LdapIdentity.FqdnToDn(domain);`
`63`	`65`	`var schema = _forestMetadataCache.Get(`
`64`	`66`	`clientConfig.Name,`