Duplicate new users being created on every login

[neilpb]

Hi roundcube forum

Currently deployed 1.5.2 into a multi node environment, migrated from 1.3.X, using updatedb.sh
Roundcube is running in docker with caddy v2 behind a Loadbalancer
Running MariaDB 10.6

$config['session_storage'] = 'db'; is configured for session mgmt

The problem is for some users, who login in, for every time that they log in a new user account is being created. This is causing contacts / settings and such to be lost as a new user_id is generated every time on login.

You can see user_id 28468 (below) was the import from 1.3.X, but then 1.5.2 creates new a user account every time that person logs in. have obscured the domain

This is happening on some account and not on others, seems random.

Any ideas, I would expect on login roundcube check to see if a user entry already exists before creating a new user?
Is this a session problem?

Had a look at https://www.roundcubeforum.net/index.php/topic,29652.msg75375.html#msg75375 which is similar setup
but we pass client IP to the docker/roundcube instance behind the load balancer, A tcpdump inside docker show all
remote IPv4 addresses can be seen.

MariaDB [roundcube]> select user_id,username,mail_host,created,last_login from users where username LIKE "%[email protected]%";
+---------+-------------------------+---------------------+---------------------+---------------------+
| user_id | username                | mail_host           | created             | last_login          |
+---------+-------------------------+---------------------+---------------------+---------------------+
|   28468 | [email protected] | imap.xxxxx.com.au | 2016-05-18 22:13:48 | 2022-02-14 11:20:37 |
|  197458 | [email protected] | imap.xxxxx.com.au | 2022-02-15 07:59:52 | 2022-02-15 07:59:52 |
|  197492 | [email protected] | imap.xxxxx.com.au | 2022-02-15 08:15:05 | 2022-02-15 08:15:05 |
|  197676 | [email protected] | imap.xxxxx.com.au | 2022-02-15 09:21:23 | 2022-02-15 09:21:23 |
|  197836 | [email protected] | imap.xxxxx.com.au | 2022-02-15 10:20:36 | 2022-02-15 10:20:36 |
|  197886 | [email protected] | imap.xxxxx.com.au | 2022-02-15 10:42:57 | 2022-02-15 10:42:57 |
|  197969 | [email protected] | imap.xxxxx.com.au | 2022-02-15 11:27:49 | 2022-02-15 11:27:49 |
|  198029 | [email protected] | imap.xxxxx.com.au | 2022-02-15 12:04:58 | 2022-02-15 12:04:58 |
|  198187 | [email protected] | imap.xxxxx.com.au | 2022-02-15 13:38:07 | 2022-02-15 13:38:07 |
|  198314 | [email protected] | imap.xxxxx.com.au | 2022-02-15 15:08:33 | 2022-02-15 15:08:33 |
|  198422 | [email protected] | imap.xxxxx.com.au | 2022-02-15 16:09:42 | 2022-02-15 16:09:42 |
|  198435 | [email protected] | imap.xxxxx.com.au | 2022-02-15 16:14:14 | 2022-02-15 16:14:14 |
|  198446 | [email protected] | imap.xxxxx.com.au | 2022-02-15 16:22:56 | 2022-02-15 16:22:56 |
|  198450 | [email protected] | imap.xxxxx.com.au | 2022-02-15 16:24:39 | 2022-02-15 16:24:39 |
|  198670 | [email protected] | imap.xxxxx.com.au | 2022-02-15 19:02:51 | 2022-02-15 19:02:51 |
|  198732 | [email protected] | imap.xxxxx.com.au | 2022-02-15 20:13:09 | 2022-02-15 20:13:09 |
|  198847 | [email protected] | imap.xxxxx.com.au | 2022-02-15 22:24:03 | 2022-02-15 22:24:03 |
|  198869 | [email protected] | imap.xxxxx.com.au | 2022-02-15 22:49:46 | 2022-02-15 22:49:46 |
|  199027 | [email protected] | imap.xxxxx.com.au | 2022-02-16 08:49:15 | 2022-02-16 08:49:15 |
|  199031 | [email protected] | imap.xxxxx.com.au | 2022-02-16 08:54:37 | 2022-02-16 08:54:37 |
|  199089 | [email protected] | imap.xxxxx.com.au | 2022-02-16 10:14:47 | 2022-02-16 10:14:47 |
|  199271 | [email protected] | imap.xxxxx.com.au | 2022-02-16 13:23:28 | 2022-02-16 13:23:28 |
|  199321 | [email protected] | imap.xxxxx.com.au | 2022-02-16 14:31:32 | 2022-02-16 14:31:32 |
|  199368 | [email protected] | imap.xxxxx.com.au | 2022-02-16 15:32:44 | 2022-02-16 15:32:44 |
|  199435 | [email protected] | imap.xxxxx.com.au | 2022-02-16 16:41:52 | 2022-02-16 16:41:52 |
|  199441 | [email protected] | imap.xxxxx.com.au | 2022-02-16 16:48:27 | 2022-02-16 16:48:27 |
|  199443 | [email protected] | imap.xxxxx.com.au | 2022-02-16 16:48:41 | 2022-02-16 16:48:41 |
|  199696 | [email protected] | imap.xxxxx.com.au | 2022-02-16 22:31:20 | 2022-02-16 22:31:20 |
|  199712 | [email protected] | imap.xxxxx.com.au | 2022-02-16 23:01:17 | 2022-02-16 23:01:17 |
|  199737 | [email protected] | imap.xxxxx.com.au | 2022-02-17 00:15:49 | 2022-02-17 00:15:49 |
+---------+-------------------------+---------------------+---------------------+---------------------+

MariaDB [roundcube]> select * from users where user_id = 28468\G;
*************************** 1. row ***************************
             user_id: 28468
            username: [email protected]
           mail_host: imap.xxxxx.com.au
             created: 2016-05-18 22:13:48
          last_login: 2022-02-14 11:20:37
            language: en_US
         preferences: a:29:...................."client_hash";s:32:"c4832d73c421c58b05be8853d0a4542a";}
        failed_login: 2021-12-30 01:40:07
failed_login_counter: 1

MariaDB [roundcube]> select * from users where user_id = 199441\G;
*************************** 1. row ***************************
             user_id: 199441
            username: [email protected]
           mail_host: imap.xxxxx.com.au
             created: 2022-02-16 16:48:27
          last_login: 2022-02-16 16:48:27
            language: en_US
         preferences: a:2:{s:11:"client_hash";s:16:"THXliskaYh4RkmZw";s:9:"junk_mbox";s:4:"Junk";}
        failed_login: NULL
failed_login_counter: NULL
1 row in set (0.000 sec)


MariaDB [roundcube]> select * from users where user_id = 199443\G;
*************************** 1. row ***************************
             user_id: 199443
            username: [email protected]
           mail_host: imap.xxxxx.com.au
             created: 2022-02-16 16:48:41
          last_login: 2022-02-16 16:48:41
            language: en_US
         preferences: a:2:{s:11:"client_hash";s:16:"WjRKYPDeGE6aZ7bY";s:9:"junk_mbox";s:4:"Junk";}
        failed_login: NULL
failed_login_counter: NULL
1 row in set (0.000 sec)



Doing a log in test into roundcube using this user with logging

roundcubemail/logs # grep '[email protected]' userlogins.log
[16-Feb-2022 13:43:22 +0000]: <k808g4ed> Successful login for [email protected] (ID: 199747) from 218.215.X.X (X-Forwarded-For: 218.215.X.X) in session k808g4ed9j3e5kli

roundcubemail/logs # cat session.log | grep 'k808g4ed'
[16-Feb-2022 13:43:22 +0000]: <k808g4ed> Session regenerate: 3jgu1ftfg5rok8vgn3tjusr2ss -> k808g4ed9j3e5kli3425dscih6
[16-Feb-2022 13:43:30 +0000]: <k808g4ed> Session destroy: k808g4ed9j3e5kli3425dscih6

user_id 199747 gets created

| 199696 | [email protected] | imap.xxxxx.com.au | 2022-02-16 22:31:20 | 2022-02-16 22:31:20 |
| 199712 | [email protected] | imap.xxxxx.com.au | 2022-02-16 23:01:17 | 2022-02-16 23:01:17 |
| 199737 | [email protected] | imap.xxxxx.com.au | 2022-02-17 00:15:49 | 2022-02-17 00:15:49 |
| 199745 | [email protected] | imap.xxxxx.com.au | 2022-02-17 00:35:53 | 2022-02-17 00:35:53 |
| 199746 | [email protected] | imap.xxxxx.com.au | 2022-02-17 00:36:04 | 2022-02-17 00:36:04 |
| 199747 | [email protected] | imap.xxxxx.com.au | 2022-02-17 00:43:22 | 2022-02-17 00:43:22 |
+---------+-------------------------+---------------------+---------------------+---------------------+

MariaDB [roundcube]> select * from users where user_id = 199747\G;
*************************** 1. row ***************************
             user_id: 199747
            username: [email protected]
           mail_host: imap.xxxxx.com.au
             created: 2022-02-17 00:43:22
          last_login: 2022-02-17 00:43:22
            language: en_GB
         preferences: a:2:{s:11:"client_hash";s:16:"r2rsowx7hm5UWviA";s:9:"junk_mbox";s:4:"Junk";}
        failed_login: NULL
failed_login_counter: NULL
1 row in set (0.000 sec)


Thanks
neilpb

[alec]

How's that even possible? There is a unique key on username+mail_host columns.

[neilpb]

Hi Alec,

That's why I want to know, we have not touched any of the login process code, we are using plugins such as rcguard 1.3.2
Everything else in RC 1.5.2 seems to be working, just these doubled up user accounts.