[Security] make LdapBindAuthenticationProvider capable of searching for the DN #21402

lsmith77 · 2017-01-25T12:39:37Z

Q	A
Branch?	master
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	#16823, #20905
License	MIT
Doc PR	symfony/symfony-docs#7420

I guess due to the separation between the user and auth provider something like the following isn't ok (note: the following works just fine for me but if course in the end the username is the DN and not the user provided shorter username):

diff --git a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php
index 5ebb09a..18d7825 100644
--- a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php
+++ b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php
@@ -70,7 +70,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider
      */
     protected function checkAuthentication(UserInterface $user, UsernamePasswordToken $token)
     {
-        $username = $token->getUsername();
+        $username = $user->getUsername();
         $password = $token->getCredentials();
 
         if ('' === $password) {
@@ -78,10 +78,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider
         }
 
         try {
-            $username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN);
-            $dn = str_replace('{username}', $username, $this->dnString);
-
-            $this->ldap->bind($dn, $password);
+            $this->ldap->bind($username, $password);
         } catch (ConnectionException $e) {
             throw new BadCredentialsException('The presented password is invalid.');
         }
diff --git a/src/Symfony/Component/Security/Core/User/LdapUserProvider.php b/src/Symfony/Component/Security/Core/User/LdapUserProvider.php
index fc42419..8194c4c 100644
--- a/src/Symfony/Component/Security/Core/User/LdapUserProvider.php
+++ b/src/Symfony/Component/Security/Core/User/LdapUserProvider.php
@@ -115,7 +115,7 @@ class LdapUserProvider implements UserProviderInterface
     {
         $password = $this->getPassword($entry);
 
-        return new User($username, $password, $this->defaultRoles);
+        return new User($entry->getDn(), $password, $this->defaultRoles);
     }
 
     /**

Therefore I created an entire new auth provider.

lsmith77 · 2017-01-25T12:39:56Z

src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginLdapFactory.php

+
+        $provider = 'security.authentication.provider.ldap_'.$method.'.'.$id;
+
+        switch($method) {


there is probably a more elegant way to do this without duplicating so much code

lsmith77 · 2017-01-25T12:55:37Z

src/Symfony/Component/Security/Core/Authentication/Provider/LdapQueryAuthenticationProvider.php

+                throw new BadCredentialsException('The presented password is invalid.');
+            }
+
+            $this->ldap->bind($result->getIterator()->current()->getDn(), $password);


this could probably be rewritten as $this->ldap->bind($result[0]->getDn(), $password);

lsmith77 · 2017-01-25T13:01:28Z

src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginLdapFactory.php

+
+        $provider = 'security.authentication.provider.ldap_'.$method.'.'.$id;
+
+        switch ($method) {


there is probably a more elegant way to reduce the code duplication

nicolas-grekas · 2017-01-25T14:07:07Z

ping @csarrazi

lsmith77 · 2017-01-25T18:03:54Z

src/Symfony/Component/Security/Core/Authentication/Provider/LdapQueryAuthenticationProvider.php

+ *
+ * The only way to check user credentials is to first find the DN via query and then bind
+ *
+ * @author Charles Sarrazin <charles@sarraz.in>


@csarrazi since I used LdapBindAuthenticationProvider as the base I figured I should leave you as an author

BTW I did however think its not appropriate to extend from LdapBindAuthenticationProvider even though it would reduce some code duplication.

another approach could be to integrate the logic into LdapBindAuthenticationProvider

I think it would actually be better to integrate the logic inside LdapBindAuthenticationProvider.

@csarrazi ok .. how should I handle the new parameter without breaking BC on the constructor signature? use setter injection?

something like

diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginLdapFactory.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginLdapFactory.php index cd4158d..3d9d4b2 100644 --- a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginLdapFactory.php +++ b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/FormLoginLdapFactory.php @@ -27,7 +27,7 @@ class FormLoginLdapFactory extends FormLoginFactory protected function createAuthProvider(ContainerBuilder $container, $id, $config, $userProviderId) { $provider = 'security.authentication.provider.ldap_bind.'.$id; - $container + $definition = $container ->setDefinition($provider, new ChildDefinition('security.authentication.provider.ldap_bind')) ->replaceArgument(0, new Reference($userProviderId)) ->replaceArgument(1, new Reference('security.user_checker.'.$id)) @@ -36,6 +36,10 @@ class FormLoginLdapFactory extends FormLoginFactory ->replaceArgument(4, $config['dn_string']) ; + if (!empty($config['query_string'])) { + $definition->addMethodCall('setQueryString', [$config['query_string']]); + } + return $provider; } @@ -47,6 +51,7 @@ class FormLoginLdapFactory extends FormLoginFactory ->children() ->scalarNode('service')->defaultValue('ldap')->end() ->scalarNode('dn_string')->defaultValue('{username}')->end() + ->scalarNode('query_string')->end() ->end() ; } diff --git a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php index 5ebb09a..3dfe028 100644 --- a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php +++ b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php @@ -33,6 +33,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider private $userProvider; private $ldap; private $dnString; + private $queryString; /** * Constructor. @@ -54,6 +55,16 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider } /** + * Set a query string to use in order to find a DN for the username + * + * @param string $queryString + */ + public function setQueryString($queryString) + { + $this->queryString = $queryString; + } + + /** * {@inheritdoc} */ protected function retrieveUser($username, UsernamePasswordToken $token) @@ -79,7 +90,21 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider try { $username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN); - $dn = str_replace('{username}', $username, $this->dnString); + + if ($this->queryString) { + $query = str_replace('{username}', $username, $this->queryString); + + $query = $this->ldap->query($this->dnString, $query); + $result = $query->execute(); + if (1 !== $result->count()) { + throw new BadCredentialsException('The presented username is invalid.'); + } + + $dn = $result[0]->getDn(); + } else { + $username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN); + $dn = str_replace('{username}', $username, $this->dnString); + } $this->ldap->bind($dn, $password); } catch (ConnectionException $e) {

Yup, setter injection would be the way to go. By default the new attribute should be null, and the current behaviour should be the correct one in this case.

One thing, though. It seems that you have duplicate logic in the else part of your if statement:

$username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN);

lsmith77 · 2017-01-25T19:43:48Z

@csarrazi pushed (and fixed the duplicate code)

lsmith77 · 2017-01-25T20:40:41Z

added some tests

lsmith77 · 2017-01-25T20:45:02Z

I will test it tomorrow again when I have direct access to the LDAP server of the project where I am implementing this to confirm the tests are sufficient and the code is indeed working.

nietonfir · 2017-01-25T22:40:20Z

Just tested (both the original PR and the updated one - against current stable@3.2.2) against an OpenLDAP directory configured with a meta backend serving as a proxy for two different OpenLDAP instances (thus two different DNs - see #16823), works like a charm.

Your changes can also be applied directly to HttpBasicLdapFactory:

diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/HttpBasicLdapFactory.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/HttpBasicLdapFactory.php
index 961af71..4665c07 100644
--- a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/HttpBasicLdapFactory.php
+++ b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/Security/Factory/HttpBasicLdapFactory.php
@@ -28,7 +28,7 @@ class HttpBasicLdapFactory extends HttpBasicFactory
     public function create(ContainerBuilder $container, $id, $config, $userProvider, $defaultEntryPoint)
     {
         $provider = 'security.authentication.provider.ldap_bind.'.$id;
-        $container
+        $definition = $container
             ->setDefinition($provider, new ChildDefinition('security.authentication.provider.ldap_bind'))
             ->replaceArgument(0, new Reference($userProvider))
             ->replaceArgument(1, new Reference('security.user_checker.'.$id))
@@ -40,6 +40,11 @@ class HttpBasicLdapFactory extends HttpBasicFactory
         // entry point
         $entryPointId = $this->createEntryPoint($container, $id, $config, $defaultEntryPoint);
 
+
+        if (!empty($config['query_string'])) {
+            $definition->addMethodCall('setQueryString', array($config['query_string']));
+        }
+
         // listener
         $listenerId = 'security.authentication.listener.basic.'.$id;
         $listener = $container->setDefinition($listenerId, new ChildDefinition('security.authentication.listener.basic'));
@@ -57,6 +62,7 @@ class HttpBasicLdapFactory extends HttpBasicFactory
             ->children()
                 ->scalarNode('service')->defaultValue('ldap')->end()
                 ->scalarNode('dn_string')->defaultValue('{username}')->end()
+                ->scalarNode('query_string')->end()
             ->end()
         ;
     }

Refs symfony/symfony#21402

so that it matches the current FormLoginLdapFactory ldap implementation, where the DN can be search for before binding.

nietonfir · 2017-01-26T11:05:22Z

@lsmith77 created a PR to your branch. Hope that's what you meant… ;-)

lsmith77 · 2017-01-26T14:30:01Z

thx

Refs symfony#21402

lsmith77 · 2017-01-26T22:08:54Z

added support for HTTP basic as well and linked a doc PR.

will do final testing on my end tomorrow.

@csarrazi are the unit tests sufficient or do we also need some functional tests?

csarrazi · 2017-01-25T19:53:56Z

src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php

+
+            if ($this->queryString) {
+                $query = str_replace('{username}', $username, $this->queryString);
+


Remove newline.

csarrazi · 2017-01-25T19:54:05Z

src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php

+                $query = str_replace('{username}', $username, $this->queryString);
+
+                $query = $this->ldap->query($this->dnString, $query);
+                $result = $query->execute();


Add newline after this one and merge this line with the previous one (no need to keep the query variable, as it is not used for anything but for running its execute() method.

csarrazi · 2017-01-26T23:50:07Z

I don't think we need functional tests for this one. Functional tests are limited to the Ldap component's integration with OpenLDAP. The component was not updated here, so no functional tests are needed. Unit tests are sufficient here.

Update HttpBasicLdapFactory

lsmith77 · 2017-01-27T12:25:43Z

@csarrazi ok fixed your comments and tested it against the production LDAP server. all is well to merge from my side

csarrazi · 2017-01-27T17:53:09Z

👍

fabpot · 2017-01-28T22:15:04Z

Thank you @lsmith77.

… of searching for the DN (lsmith77, nietonfir) This PR was merged into the 3.3-dev branch. Discussion ---------- [Security] make LdapBindAuthenticationProvider capable of searching for the DN | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | #16823, #20905 | License | MIT | Doc PR | symfony/symfony-docs#7420 I guess due to the separation between the user and auth provider something like the following isn't ok (note: the following works just fine for me but if course in the end the username is the DN and not the user provided shorter username): ```diff diff --git a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php index 5ebb09a..18d7825 100644 --- a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php +++ b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php @@ -70,7 +70,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider */ protected function checkAuthentication(UserInterface $user, UsernamePasswordToken $token) { - $username = $token->getUsername(); + $username = $user->getUsername(); $password = $token->getCredentials(); if ('' === $password) { @@ -78,10 +78,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider } try { - $username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN); - $dn = str_replace('{username}', $username, $this->dnString); - - $this->ldap->bind($dn, $password); + $this->ldap->bind($username, $password); } catch (ConnectionException $e) { throw new BadCredentialsException('The presented password is invalid.'); } diff --git a/src/Symfony/Component/Security/Core/User/LdapUserProvider.php b/src/Symfony/Component/Security/Core/User/LdapUserProvider.php index fc42419..8194c4c 100644 --- a/src/Symfony/Component/Security/Core/User/LdapUserProvider.php +++ b/src/Symfony/Component/Security/Core/User/LdapUserProvider.php @@ -115,7 +115,7 @@ class LdapUserProvider implements UserProviderInterface { $password = $this->getPassword($entry); - return new User($username, $password, $this->defaultRoles); + return new User($entry->getDn(), $password, $this->defaultRoles); } /** ``` Therefore I created an entire new auth provider. Commits ------- 8ddd533 Merge pull request #1 from nietonfir/http_basic_ldap a783e5c Update HttpBasicLdapFactory a30191f make LdapBindAuthenticationProvider capable of searching for the DN

…capable of searching for the DN (lsmith77, nietonfir) This PR was merged into the 3.3-dev branch. Discussion ---------- [Security] make LdapBindAuthenticationProvider capable of searching for the DN | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | symfony#16823, symfony#20905 | License | MIT | Doc PR | symfony/symfony-docs#7420 I guess due to the separation between the user and auth provider something like the following isn't ok (note: the following works just fine for me but if course in the end the username is the DN and not the user provided shorter username): ```diff diff --git a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php index 5ebb09a..18d7825 100644 --- a/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php +++ b/src/Symfony/Component/Security/Core/Authentication/Provider/LdapBindAuthenticationProvider.php @@ -70,7 +70,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider */ protected function checkAuthentication(UserInterface $user, UsernamePasswordToken $token) { - $username = $token->getUsername(); + $username = $user->getUsername(); $password = $token->getCredentials(); if ('' === $password) { @@ -78,10 +78,7 @@ class LdapBindAuthenticationProvider extends UserAuthenticationProvider } try { - $username = $this->ldap->escape($username, '', LdapInterface::ESCAPE_DN); - $dn = str_replace('{username}', $username, $this->dnString); - - $this->ldap->bind($dn, $password); + $this->ldap->bind($username, $password); } catch (ConnectionException $e) { throw new BadCredentialsException('The presented password is invalid.'); } diff --git a/src/Symfony/Component/Security/Core/User/LdapUserProvider.php b/src/Symfony/Component/Security/Core/User/LdapUserProvider.php index fc42419..8194c4c 100644 --- a/src/Symfony/Component/Security/Core/User/LdapUserProvider.php +++ b/src/Symfony/Component/Security/Core/User/LdapUserProvider.php @@ -115,7 +115,7 @@ class LdapUserProvider implements UserProviderInterface { $password = $this->getPassword($entry); - return new User($username, $password, $this->defaultRoles); + return new User($entry->getDn(), $password, $this->defaultRoles); } /** ``` Therefore I created an entire new auth provider. Commits ------- 8ddd533 Merge pull request #1 from nietonfir/http_basic_ldap a783e5c Update HttpBasicLdapFactory a30191f make LdapBindAuthenticationProvider capable of searching for the DN

Refs symfony/symfony#21402

…reguiluz, lsmith77) This PR was merged into the master branch. Discussion ---------- Added query_string LDAP config option docs for symfony/symfony#21402 Commits ------- b82cafd clean up 446ba38 added query_string LDAP config option ed58da8 Minor reword f133269 Explain the query_string ldap authentication provider configuration key

carsonbot added Status: Needs Review Feature labels Jan 25, 2017

lsmith77 commented Jan 25, 2017

View reviewed changes

lsmith77 changed the title ~~added LdapQueryAuthenticationProvider~~ [Security] added LdapQueryAuthenticationProvider Jan 25, 2017

lsmith77 force-pushed the ldap_query_auth_provider branch 2 times, most recently from d7b1939 to 12e9d07 Compare January 25, 2017 12:41

This was referenced Jan 25, 2017

[Ldap] Use discovered DNs for the authentication bind #16823

Closed

[Security][Ldap] how to authenticate via LDAP bind with DNs differentiated by more than username #20905

Closed

lsmith77 added Security SecurityBundle labels Jan 25, 2017

lsmith77 force-pushed the ldap_query_auth_provider branch from 12e9d07 to a26e0b1 Compare January 25, 2017 12:42

lsmith77 commented Jan 25, 2017

View reviewed changes

nicolas-grekas added this to the 3.x milestone Jan 25, 2017

lsmith77 force-pushed the ldap_query_auth_provider branch 2 times, most recently from 90395dd to 04b82a8 Compare January 25, 2017 17:44

lsmith77 commented Jan 25, 2017

View reviewed changes

lsmith77 force-pushed the ldap_query_auth_provider branch from 04b82a8 to 4f7487c Compare January 25, 2017 19:42

lsmith77 changed the title ~~[Security] added LdapQueryAuthenticationProvider~~ [Security] make LdapBindAuthenticationProvider capable of searching for the query string Jan 25, 2017

lsmith77 force-pushed the ldap_query_auth_provider branch from 4f7487c to a70f80a Compare January 25, 2017 19:44

lsmith77 changed the title ~~[Security] make LdapBindAuthenticationProvider capable of searching for the query string~~ [Security] make LdapBindAuthenticationProvider capable of searching for the DN Jan 25, 2017

lsmith77 force-pushed the ldap_query_auth_provider branch from a70f80a to 93a02b2 Compare January 25, 2017 20:10

make LdapBindAuthenticationProvider capable of searching for the DN

a30191f

lsmith77 force-pushed the ldap_query_auth_provider branch from 93a02b2 to a30191f Compare January 25, 2017 20:32

nietonfir pushed a commit to nietonfir/symfony-docs that referenced this pull request Jan 26, 2017

Explain the query_string ldap authentication provider configuration keys

c62c8f8

Refs symfony/symfony#21402

Update HttpBasicLdapFactory

a783e5c

so that it matches the current FormLoginLdapFactory ldap implementation, where the DN can be search for before binding.

nietonfir mentioned this pull request Jan 26, 2017

Update HttpBasicLdapFactory lsmith77/symfony#1

Merged

nietonfir pushed a commit to nietonfir/symfony that referenced this pull request Jan 26, 2017

CS fix

062c904

Refs symfony#21402

nietonfir mentioned this pull request Jan 26, 2017

CS fix lsmith77/symfony#2

Closed

lsmith77 force-pushed the ldap_query_auth_provider branch from 5f89a03 to 0679a74 Compare January 26, 2017 21:47

csarrazi suggested changes Jan 26, 2017

View reviewed changes

Merge pull request #1 from nietonfir/http_basic_ldap

8ddd533

Update HttpBasicLdapFactory

lsmith77 force-pushed the ldap_query_auth_provider branch from 0679a74 to 8ddd533 Compare January 27, 2017 07:30

lsmith77 mentioned this pull request Jan 27, 2017

Added query_string LDAP config option symfony/symfony-docs#7420

Merged

fabpot closed this Jan 28, 2017

fabpot merged commit 8ddd533 into symfony:master Jan 28, 2017

lsmith77 deleted the ldap_query_auth_provider branch January 28, 2017 22:49

lsmith77 pushed a commit to lsmith77/symfony-docs that referenced this pull request Feb 3, 2017

Explain the query_string ldap authentication provider configuration key

f133269

Refs symfony/symfony#21402

csarrazi mentioned this pull request Mar 1, 2017

[Security] fixes LDAP bind authentication using wrong username #21588

Closed

nicolas-grekas modified the milestones: 3.x, 3.3 Mar 24, 2017

fabpot mentioned this pull request May 1, 2017

Release v3.3.0-BETA1 #22603

Merged

csarrazi mentioned this pull request Feb 28, 2018

LDAP Form Authentication dn_string substitution broken? #26316

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security] make LdapBindAuthenticationProvider capable of searching for the DN #21402

[Security] make LdapBindAuthenticationProvider capable of searching for the DN #21402

lsmith77 commented Jan 25, 2017 •

edited

Loading

lsmith77 Jan 25, 2017

lsmith77 Jan 25, 2017

lsmith77 Jan 25, 2017

nicolas-grekas commented Jan 25, 2017

lsmith77 Jan 25, 2017

lsmith77 Jan 25, 2017

lsmith77 Jan 25, 2017

csarrazi Jan 25, 2017

lsmith77 Jan 25, 2017

lsmith77 Jan 25, 2017

csarrazi Jan 25, 2017

csarrazi Jan 25, 2017

lsmith77 commented Jan 25, 2017

lsmith77 commented Jan 25, 2017

lsmith77 commented Jan 25, 2017

nietonfir commented Jan 25, 2017 •

edited

Loading

nietonfir commented Jan 26, 2017

lsmith77 commented Jan 26, 2017

lsmith77 commented Jan 26, 2017

csarrazi Jan 25, 2017

lsmith77 Jan 27, 2017

csarrazi Jan 25, 2017

lsmith77 Jan 27, 2017

csarrazi commented Jan 26, 2017

lsmith77 commented Jan 27, 2017

csarrazi commented Jan 27, 2017

fabpot commented Jan 28, 2017


		$provider = 'security.authentication.provider.ldap_'.$method.'.'.$id;

		switch($method) {


		$provider = 'security.authentication.provider.ldap_'.$method.'.'.$id;

		switch ($method) {


		if ($this->queryString) {
		$query = str_replace('{username}', $username, $this->queryString);

[Security] make LdapBindAuthenticationProvider capable of searching for the DN #21402

[Security] make LdapBindAuthenticationProvider capable of searching for the DN #21402

Conversation

lsmith77 commented Jan 25, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nicolas-grekas commented Jan 25, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lsmith77 commented Jan 25, 2017

lsmith77 commented Jan 25, 2017

lsmith77 commented Jan 25, 2017

nietonfir commented Jan 25, 2017 • edited Loading

nietonfir commented Jan 26, 2017

lsmith77 commented Jan 26, 2017

lsmith77 commented Jan 26, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

csarrazi commented Jan 26, 2017

lsmith77 commented Jan 27, 2017

csarrazi commented Jan 27, 2017

fabpot commented Jan 28, 2017

lsmith77 commented Jan 25, 2017 •

edited

Loading

nietonfir commented Jan 25, 2017 •

edited

Loading