You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by co...@apache.org on 2026/09/23 12:39:12 UTC
(directory-ldap-api) branch coheigea/LdapConnectionTemplate created (now 646df1947)
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a change to branch coheigea/LdapConnectionTemplate
in repository https://gitbox.apache.org/repos/asf/directory-ldap-api.git
at 646df1947 LdapConnectionTemplate.authenticate accepts empty password as valid credentials
This branch includes the following new commits:
new 646df1947 LdapConnectionTemplate.authenticate accepts empty password as valid credentials
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(directory-ldap-api) 01/01: LdapConnectionTemplate.authenticate accepts empty password as valid credentials
Posted by co...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch coheigea/LdapConnectionTemplate
in repository https://gitbox.apache.org/repos/asf/directory-ldap-api.git
commit 646df19474562e818a9bbfdb1cc1eaa5e3677291
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Sep 23 13:38:48 2026 +0100
LdapConnectionTemplate.authenticate accepts empty password as valid credentials
---
.../ldap/client/template/LdapConnectionTemplate.java | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/ldap/client/api/src/main/java/org/apache/directory/ldap/client/template/LdapConnectionTemplate.java b/ldap/client/api/src/main/java/org/apache/directory/ldap/client/template/LdapConnectionTemplate.java
index 6bd8e5f4d..faa108ba1 100755
--- a/ldap/client/api/src/main/java/org/apache/directory/ldap/client/template/LdapConnectionTemplate.java
+++ b/ldap/client/api/src/main/java/org/apache/directory/ldap/client/template/LdapConnectionTemplate.java
@@ -225,6 +225,21 @@ public class LdapConnectionTemplate implements LdapConnectionOperations, ModelFa
private PasswordWarning authenticateConnection( final LdapConnection connection,
final Dn userDn, final char[] password ) throws PasswordException
{
+ // A password verification must never silently degrade to an unauthenticated
+ // bind (RFC 4513, 5.1.2) : a name with empty credentials would be granted an
+ // anonymous session by many servers, and would be reported as a successful
+ // authentication. Reject a missing or empty password before binding.
+ if ( ( password == null ) || ( password.length == 0 ) )
+ {
+ if ( LOG.isDebugEnabled() )
+ {
+ LOG.debug( I18n.msg( I18n.MSG_04105_MISSING_PASSWORD ) );
+ }
+
+ throw new PasswordException( I18n.msg( I18n.MSG_04105_MISSING_PASSWORD ) )
+ .setResultCode( ResultCodeEnum.INVALID_CREDENTIALS );
+ }
+
return passwordPolicyResponder.process(
new PasswordPolicyOperation()
{