[botdeniska]

Contribution Licensing (no CLA, inbound=outbound, DCO required)

This pull request contributes to PGSTY SILO (pgsty/silo). Code contributions
are accepted under AGPL-3.0-or-later, the same license as the server.
This project does not use a CLA or require a separate Apache-2.0 license grant.
By submitting this pull request I represent that I have the right to contribute
the code changes under this repository's
GNU Affero General Public License v3.0 or later
and retain copyright in my original work. Existing copyright and license
notices remain intact; separately licensed material keeps its applicable terms.
Every commit must carry a DCO Signed-off-by trailer
(git commit -s) certifying the
Developer Certificate of Origin — see
CONTRIBUTING.md.

Description

Fixes #272.

The console tries the built-in login (root) after a failed LDAP login only when the LDAP STS error contains "not found" (silo-console api/client.go, NewConsoleCredentials). Since 3b950f8 the uniform auth failure says only LDAP authentication failed, so with LDAP enabled root cannot log in to the console.

One commit:

fix(sts): keep "not found" in the LDAP auth failure so the console can log in root

1. errLDAPAuthenticationFailed (cmd/sts-handlers.go) becomes LDAP authentication failed: user not found or invalid password, with a comment on why the words matter. It stays one message for unknown users and wrong passwords, with the same 400 InvalidParameterValue. LDAP infrastructure failures are not touched (ErrSTSUpstreamError).
2. New TestLDAPAuthFailureKeepsConsoleFallback (cmd/sts-handlers_test.go) applies the console's check to the auth failure from ldapBindErrorToSTS. The existing uniform-message checks compare against errLDAPAuthenticationFailed.Error() and pass unchanged.

Motivation and Context

With LDAP enabled, new built-in users cannot be created, so root is the only non-LDAP console login, and it is the way back in when the LDAP side is misconfigured. A server-side message keeps every console that relies on the "not found" fallback working, without a console release. Details and a script are in the issue.

How to test this PR?

go test ./cmd -count=1 -run '^(TestLDAPAuthFailureKeepsConsoleFallback|TestLDAPBindErrorToSTS)$' -v

On main, with this test file (git checkout <this branch> -- cmd/sts-handlers_test.go):

    sts-handlers_test.go:2058: the console would not try the built-in login after "LDAP authentication failed"
--- FAIL: TestLDAPAuthFailureKeepsConsoleFallback (0.00s)

Run locally on Go 1.27.3 (darwin/arm64), on main 0cfca29cb:

• make verifiers (golangci-lint: 0 issues), make build
• STS and LDAP tests: go test ./cmd -count=1 -run '^(Test.*STS.*|Test.*LDAP.*)$': ok
• the Docker-backed LDAP suites, which check the uniform message for an unknown user and a wrong password end to end: _MINIO_LDAP_TEST_SERVER=localhost:13391 go test ./cmd -count=1 -run '^Test.*LDAP.*$' against quay.io/minio/openldap: ok

Manual check with the script from the issue (OpenLDAP, one server with 4 drives, embedded console): root's console login goes from 401 to 204; LDAP logins and the wrong-password case do not change, and STS gives the same message for an unknown user and a wrong password.

Compatibility impact

No API, configuration, storage metadata, metric, route or dependency changes.

• Message text: the Message of the 400 InvalidParameterValue for an LDAP auth failure changes. Clients that compare the exact text need the new one; the code and the status do not change.
• Console: after a failed LDAP login it now also tries the built-in login, one extra STS AssumeRole call per failed console login. That is the console's behavior before 3b950f8.
• Enumeration: unknown users and wrong passwords still get identical responses.
• Rollback brings back the console 401 for root.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Optimization (provides speedup with no functional changes)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• All commits are signed off (git commit -s) per the DCO
• Fixes a regression (If yes, please add commit-id or PR # here): 3b950f8
• Unit tests added/updated
• make verifiers passes
• Relevant package tests and make build pass
• Compatibility and rollback impact documented
• Internal documentation updated (not needed)
• Public documentation update opened in pgsty/silo.pgsty.com, if needed (not needed)