Affects Version/s: 7.0.X, 7.1.X, 7.2.X, Master
Component/s: Application Security > LDAP
Please note, this is NOT a security vulnerability, so the ticket does not need to be secured.
When setting the Import Interval for LDAP, the value is not used. This is due to a miss-match between the scheduler trigger and the user set interval.
Currently in master, when activating the UserImportMessageListener class (which imports LDAP users on the given interval), the default interval of 10 is always used in the scheduler. This is because regardless of the user-set value, the company with ID "0" is used for the configuration, resulting in the default value being used.
Once this happens, changing the interval is only useful in intervals of 10, because the scheduler has already been set (and will not change) to 10, resulting in the message being received every 10 minutes. So, and interval of 1 minute will only be called every 10 minutes, and one of 11 minutes will only be called every 20 minutes. This is because we actually check the last import time against the current time and offset the interval.
Steps to reproduce:
- Change the LDAP import interval to 2 in System Settings -> Authentication -> LDAP -> Import Interval.
- Check if the scheduler is triggered after 2 minutes.
Expected behavior: The scheduler is triggered after 2 minutes.
Actual behavior: The scheduler is not triggered after 2 minutes. It gets triggered after 10 minutes which is the starting default value. Only a server restart or bundle refresh will trigger the new value.
Reproduced on Master and Branch:
Script to help reproduce the issue: