From d7bfdc7996d22f37350e7c37385ad690a0ef364e Mon Sep 17 00:00:00 2001 From: XueLei Date: Tue, 20 Oct 2026 14:55:52 +0800 Subject: [PATCH] fix(ldap): reactivate device session on LDAP login LDAP login (loginLdap) does not call device.EnsureActiveOnLogin, unlike the password login path (loginHash). After a user logs out, their device session is marked inactive. Logging in again via LDAP then returns a token successfully, but every subsequent request (e.g. /api/me) fails with 401 "session inactive" because the session is never reactivated. Add the missing EnsureActiveOnLogin call and return device_key in the response, matching the password login flow. --- server/handles/ldap_login.go | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/server/handles/ldap_login.go b/server/handles/ldap_login.go index 3098abd59cf..2e34996da8e 100644 --- a/server/handles/ldap_login.go +++ b/server/handles/ldap_login.go @@ -7,6 +7,8 @@ import ( "strings" "github.com/alist-org/alist/v3/internal/conf" + "github.com/alist-org/alist/v3/internal/device" + "github.com/alist-org/alist/v3/internal/errs" "github.com/alist-org/alist/v3/internal/model" "github.com/alist-org/alist/v3/internal/op" "github.com/alist-org/alist/v3/internal/setting" @@ -110,13 +112,27 @@ func loginLdap(c *gin.Context, req *LoginReq) { } } + clientID := c.GetHeader("Client-Id") + if clientID == "" { + clientID = c.Query("client_id") + } + key := utils.GetMD5EncodeStr(fmt.Sprintf("%d-%s", user.ID, clientID)) + if err := device.EnsureActiveOnLogin(user.ID, key, c.Request.UserAgent(), c.ClientIP()); err != nil { + if errors.Is(err, errs.TooManyDevices) { + common.ErrorResp(c, err, 403) + } else { + common.ErrorResp(c, err, 400, true) + } + return + } + // generate token token, err := common.GenerateToken(user) if err != nil { common.ErrorResp(c, err, 400, true) return } - common.SuccessResp(c, gin.H{"token": token}) + common.SuccessResp(c, gin.H{"token": token, "device_key": key}) loginCache.Del(ip) }