eldap search result record has changed in Erlang 24.3

[michaelklishin]

See #4281 for the background.

In erlang/otp#5538, the eldap_search_result record gets a new field, which means matching
will break for code that was compiled on any earlier version (e.g. 24.0):
https://github.com/erlang/otp/pull/5538/files#diff-30e064e89b115da7e974f229ed5c92f28e489da679ef42f17e70b9e7cf874179R24.

This happens in the RabbitMQ authN/authZ backend for LDAP in this case statement.
Matching on both tuples both pre-24.3 and 24.3+ instead of a record should help. We have run into this before.

Note that CI would not hit this issue. In order to reproduce, you have to build on Erlang pre-24.3 but run on 24.3.

[BSchwetzel]

Should this also be fixed in 3.9.14? We are using the helm chart generously provided by Bitnami, but I still cannot login via LDAP. Please see this issue I created regarding this: bitnami/charts#9458

My advanced config looks like this:

%% -*- mode: erlang -*-
%% ----------------------------------------------------------------------------
%% RabbitMQ Configuration File.
%%
%% Related doc guide: http://www.rabbitmq.com/configure.html. See
%% http://rabbitmq.com/documentation.html for documentation ToC.
%% ----------------------------------------------------------------------------
[
 %% ----------------------------------------------------------------------------
 %% RabbitMQ LDAP Plugin
 %%
 %% Related doc guide: http://www.rabbitmq.com/ldap.html.
 %%
 %% ----------------------------------------------------------------------------
  {rabbitmq_auth_backend_ldap,
    [
      {tag_queries, [
        {administrator, {in_group_nested, "CN=SUPERGROUP,OU=REDACTED,OU=REDACTED,DC=REDACTED,DC=REDACTED,DC=REDACTED"}},
        {management,    {in_group_nested, "CN=SUPERGROUP,OU=REDACTED,OU=REDACTED,DC=REDACTED,DC=REDACTED,DC=REDACTED"}}
      ]},
      {log, false},
      {dn_lookup_attribute,   "sAMAccountName"},
      {dn_lookup_base,        "OU=REDACTED,OU=REDACTED,DC=REDACTED,DC=REDACTED,DC=REDACTED"},
      {group_lookup_base,     "OU=REDACTED,OU=REDACTED,DC=REDACTED,DC=REDACTED,DC=REDACTED"},
      {dn_lookup_bind, {"CN=REDACTED,OU=REDACTED,OU=REDACTED,OU=REDACTED,DC=REDACTED,DC=REDACTED,DC=REDACTED","REDACTED"}}
    ]
  }
].

I might add: We are actively using nested groups, so maybe this is a constellation which is not working right now? Basically, my user is a member of SUBGROUP, which is in turn a member of SUPERGROUP. My tag_queries use SUPERGROUP.

This setup worked flawlessly in RabbitMQ 3.9.13, as long as the container image used in the helm chart used Erlang 24.2. I assumed that RabbitMQ 3.9.14 running on Erlang 24.3 would work fine again.

Please let me know if you need anything else from me.

[michaelklishin]

@BSchwetzel we had a confirmation from a user that it has been fixed on Erlang 24.3. Using the "latest toolchain" package is another way to run on 24.3, since it is compiled on 24.3. There isn't much we can do beyond this change.

Unlike #4281, you haven't provided any evidence or logs. We cannot assume it's the same issue. All changes were introduced in Erlang 24.3.

[michaelklishin]

@BSchwetzel we do not using existing issues for discussions, investigations or troubleshooting. That's what GitHub Discussions are for.

[michaelklishin]

LDAP Activity logging.

[michaelklishin]

and here's the original reporter confirming that the exception on Erlang 24.3 is gone with RabbitMQ 3.9.14.