nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Bamboo groups API error, if group name contain quotes (&quote; , %22 , " )

Joshua Greenman

I have external Active Directory integration with groups that contain quotes in their name (example: che"ck), and since our last upgrade from version 6.10.2 to 8.0.0 we are having trouble to edit plan permission or view group details/members because those requests use the /rest/api/latest/admin/groups/{name : (.+)?}/more-members?filter endpoint that return http error code 400 - bad request.

i tried different tomcat versions (from tomcat 8.5.X to 9.0.X) with no success

i also tried empty tomcat application locally and checked http://localhost:8085/che"ck endpoint that returned http error 404 not found, so i dont think its tomcat issue

i also tried the confluence API (7.13.0) with the same groups with no problem at all.

Any suggestions?

Accepted answers

All comments

Eduardo Alvarenga

Hello @Joshua Greenman

Can you share the full error message so we can understand it better?

Regards,

Eduardo Alvarenga
Atlassian Support APAC

Shay_hfv9ok

Hello Eduardo,

The same error does not occur for users who have quotes in their name.

Looks like you're not encoding the group names.

In addition, when we try to remove those groups from plan permissions, we encounter the same error.

Thanks,

Shay

Joshua Greenman

hi @Eduardo Alvarenga

i tried to reproduce the problem with the latest bamboo version with bamboo official docker image but the result are the same.

Joshua

Eduardo Alvarenga

Hello @Joshua Greenman

This sounds like a good use for the STRICT_QUOTE_ESCAPING property.

That setting was deprecated on Tomcat 8. Instead, you need to add something like this to your <bamboo-install>/conf/web.xml under servlet class org.apache.jasper.servlet.JspServlet:

<init-param>
  <param-name>strictQuoteEscaping</param-name>
  <param-value>false</param-value>
</init-param>

Regards,

Eduardo Alvarenga
Atlassian Support APAC

Shay_hfv9ok

We found in our AD that (groups) SamAccountName values are missing single/double quotes.

So, we decided to switch "Group_Name" from AD CN to AD samAccountName in Bamboo CWD_GROUP table.

In addition, we tried to preserve CWD_GROUP.id in order to maintain existing permissions and prevent the creation of new groups.

We did the following steps:

1. We synced the samAccountName from AD to CWD_Group.Description.

2. We took a DB backup and created 3 temp tables from the below:

a. CWD_GROUP --> CWD_GROUP_TMP

b. CWD_MEMBERSHIP --> CWD_MEMBERSHIP_TMP

c. ACL_ENTRY --> ACL_ENTRY_TMP

3. We switched between CWD_GROUP.group_name (also lower_group_name) and CWD_GROUP.description (AD.SamAccounName).

4. We updated cwd_membership.parent_name (and lower_parent_name) from the "new" CWD_GROUP.Group_Name.

5. We found that we also need to update cwd_membership.child_name (and lower_child_name) when the membership_type is "group_group".

6. We updated ACL_ENTRY.SID to the "new" Group_Names.

7. We edited the relevant directory (under "User Directory" -->"Group Schema Setting") and changed the map of "Group Name Attribute" from CN to SamAccountName and ran Full Sync.

Btw, the auto refresh of this page doesn't work.

The steps above seem to solve the problem.

But now when we are clicking on the group_name under Administration --> Groups, the value of Group_Name (SamAccountName) is obtained which is less clear than its display name (CN).

Therefore, in future versions consider presenting the group description (in our case - cn) in addition to the Group_Name.

Thanks in advance,

Shay

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

bamboo