{"record":{"id":"1b921b32f1113fb5","repo":"crowdsecurity/crowdsec","slug":"allowed-ou-configuration-contains-invalid-empty-st","errorCode":null,"errorMessage":"allowed_ou configuration contains invalid empty string","messagePattern":"allowed_ou configuration contains invalid empty string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/middlewares/v1/tls_auth.go","lineNumber":75,"sourceCode":"\n\t\trevokedByCRL, checkedByCRL := ta.crlChecker.isRevokedBy(cert, issuer)\n\t\tcouldCheck = couldCheck && checkedByCRL\n\n\t\tif revokedByCRL && checkedByCRL {\n\t\t\treturn errors.New(\"certificate revoked by CRL\"), couldCheck\n\t\t}\n\t}\n\n\treturn nil, couldCheck\n}\n\nfunc (ta *TLSAuth) setAllowedOu(allowedOus []string) error {\n\tuniqueOUs := make(map[string]struct{})\n\n\tfor _, ou := range allowedOus {\n\t\t// disallow empty ou\n\t\tif ou == \"\" {\n\t\t\treturn errors.New(\"allowed_ou configuration contains invalid empty string\")\n\t\t}\n\n\t\tif _, exists := uniqueOUs[ou]; exists {\n\t\t\tta.logger.Warningf(\"dropping duplicate ou %s\", ou)\n\t\t\tcontinue\n\t\t}\n\n\t\tuniqueOUs[ou] = struct{}{}\n\n\t\tta.AllowedOUs = append(ta.AllowedOUs, ou)\n\t}\n\n\treturn nil\n}\n\nfunc (ta *TLSAuth) checkAllowedOU(ous []string) error {\n\tfor _, ou := range ous {\n\t\tif slices.Contains(ta.AllowedOUs, ou) {","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/tls_auth.go#L57-L93","documentation":"setAllowedOu validates the allowed_ou TLS auth configuration list before use. An empty string entry in the list is rejected because an empty OrganizationalUnit would make OU matching meaningless/over-permissive, so TLSAuth construction (NewTLSAuth) fails.","triggerScenarios":"NewTLSAuth is given an allowed_ous/allowed_ou slice containing \"\", typically parsed from the API server's tls.allowed_ou config list.","commonSituations":"Trailing comma in a YAML list item or a hand-edited config producing an empty element; environment/config templating that expands an unset variable to an empty string.","solutions":["Open the api.server.tls config section and remove the empty string element from allowed_ou","If a value comes from a template/variable, ensure it is set or skip the entry when empty","Restart CrowdSec after fixing the config"],"exampleFix":"// before (config.yaml)\ntls:\n  allowed_ou:\n    - crowdsec\n    - \"\"\n// after\ntls:\n  allowed_ou:\n    - crowdsec","handlingStrategy":"validation","validationCode":"// validate config before handing to NewTLSAuth\nfor _, ou := range cfg.TLS.AllowedOU {\n    if strings.TrimSpace(ou) == \"\" {\n        return errors.New(\"allowed_ou contains an empty entry\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid trailing commas in YAML lists that can produce empty elements","Guard template variables: skip empty values instead of emitting them","Lint crowdsec config files after edits"],"tags":["tls","config","ou","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}