You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@directory.apache.org by Alex Karasulu <ak...@apache.org> on 2007/10/15 03:43:50 UTC

[ApacheDS] Why does LdapPrincipal now store passwords?

I was going through the code and found that the LdapPrincipal is now storing
the user's
password.  This is an immense security risk!  Why would we do such a thing?


Alex

Re: [ApacheDS] Why does LdapPrincipal now store passwords?

Posted by Emmanuel Lecharny <el...@gmail.com>.

I think this was an optimization, to avoid a lookup. I'm not sure
about the security risk in this case, but maybe you have something
else in mind.

Can you give us what you are thinking about ?

Thanks !

On 10/15/07, Alex Karasulu <ak...@apache.org> wrote:
> I was going through the code and found that the LdapPrincipal is now storing
> the user's
> password.  This is an immense security risk!  Why would we do such a thing?
>
> Alex
>
>

-- 
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com