administrators group

gdivis

The purge failure is unexpected, but I've seen something similar in the past with from an imported SQL Server database that had some invalid data in it. For now, leaving those IDs in the database shouldn't affect your performance. We'll look into adding more robust detection of invalid data to the cleanup page. Regardless, the order of cleanups performed shouldn't matter.

PackageAnalyzer does quite a bit more in ProGet 2026, so I would expect it to take a bit longer, but not that much.

I'll bring both of these up with the team and post again here with an update.

-Greg

gdivis

Hi @joris.guex,

Sorry for the delay - I've been out of the office for a bit.

I've logged this as PG-3379, scheduled for the next release of ProGet 2026.12 on Oct 2. I haven't looked at the code yet, but it should be another trivial fix to bring this fully up to spec.

Thanks!
-Greg

rhessinger

Hi @sai.pabbareddy,

Glad to hear it all works as expected!

Thanks,
Rich

rhessinger

Hi @sai.pabbareddy,

Thanks for the heads up. The cache fix should exist in 26.0.11-rc.15, but I'll be very interested to hear if you still see those issues after the upgrade. Please keeps us informed and we can look into it further.

Thanks,
Rich

rhessinger

Hi @sai.pabbareddy,

My apologies. Looks like I typoed the date on that other post. I had the day of Friday correct, but the date should have been Sept 18, 2026. It will be releasing later today (normally in the evening in EST). I updated that response also to have the correct date.

Thanks,
Rich

rhessinger

Hi @sai.pabbareddy,

I think it would be a good idea to have you send over the exact directory config. The code paths for searching for users and groups are virtually identical, with the only difference being the LDAP filter. You can see what we are doing directly by looking at the code in GitHub: https://github.com/Inedo/inedox-inedocore/blob/16155c425cf4b4d180e2e7ced7af90e36fb4ed35/InedoCore/InedoExtension/UserDirectories/OpenLdap/OpenLdapUserDirectory.cs#L300

I'm guessing there is something else going on that is causing this, maybe a hidden unicode character or something. When you paste in the ldap queries, can you make sure to include them using a markdown code block (``` ... ```)?

Thanks,
Rich

rhessinger

Hi @sai.pabbareddy,

Let me run some other tests. It could be related to the LDAP escaping that is happening, but that would be highly unlikely as we have many other users currently using the OpenLDAP/Generic LDAP user directory. I think the more peculiar thing is that when you hard coded the uid, the logs didn't show ?uid=, but with the %s it did. That makes me think that it does not like the value that is being passed in. Does the group search have the same issue and log message?

Thanks,
Rich

rhessinger

Hi @sai.pabbareddy,

Glad to hear those settings fixed the initial error.

The LdapReferralException is probably an issue with Samba 4's communication pattern. An LDAP referral typically happens when the AD server is handing off the AD connection to a different LDAP server. The fix is traditionally to connect ProGet to the upstream LDAP server directly. As ProGet supports multiple user directories to be active, this typically isn't a problem. My guess is that Samba 4 uses referrals as a hack for some issue that came up with AD. Based on your comments, I'm guessing the hack is to fix something how it looks up groups (or recursive groups), but I can't confirm that for sure. In v5, we moved this user directory to Active Directory only and force the magic OID for recursive group searches that Microsoft uses.

You can test if the group portion is the issue by selecting the load by username option in the Test User Directory option and entering a group and username.

We have not seen any direct Samba 4 ProGet users in support as of yet, so Samba 4 quirks are still a bit unknown to us. Looking at the code, it is most likely due to ProGet running in a container versus installed on Windows. We have to use a different library for LDAP based on the operating system. In this case, I think the issue is that referral chasing is disabled by default on linux. We can enable that feature in code, but it will require some extra testing on our part because this affects ALL ldap queries on the docker version of ProGet.

Another option is to use the OpenLDAP/Generic LDAP user directory and configure it for Active Directory.

Thanks,
Rich

rhessinger

Hi @sai.pabbareddy,

The port can be changed to a custom port on the advanced tab.

It looks like the %s is actually working in ProGet, but instead this is a feature of osixia/openldap OpenLDAP Server. When the logs shows a ? mark in front of an attribute in a sqerch query (like ?uid=), it means that either the uid attribute is missing of the objectClass does not exist, which therefore cannot confirm that uid exists on those objects. It also could be that the value is hidden for security reasons and you have to change your logging level to see. If you can provide me with the LDAP object for ldapuser1, I can help you build the proper search queries.

Thanks,
Rich

atripp

Hi @seanl_4808 ,

Like SAML, OIDC is not intended for developer/CLI tools, but desktop-based applications. I'm not aware of any client-tooling that supports or plans to support OIDC, so there's no sense in having a sever-based tool supported OIDC.

API keys are considered the modern/secure solution. The reason that WIA/OIDC is considered less secure comes down to reducing the attack surface. A rouge user or process would be able to do very little with a limited-access ProGet API key, compared with domain credentials.

Thanks,
Alana

administrators

Posts

Member List