(tomee) 31/34: require a non-empty password for LDAP caller binds

[rz...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rzo1 pushed a commit to branch tomee-10.x
in repository https://gitbox.apache.org/repos/asf/tomee.git

commit caca29f2a2be9edb7a10132182a490c4159eccf5
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sun Aug 30 20:35:16 2026 +0200

    require a non-empty password for LDAP caller binds
    
    (cherry picked from commit 8906902f6d0c27f14a1b81d7d97dc51659f48602)
---
 .../identitystore/TomEELDAPIdentityStore.java      |  7 ++-
 .../identitystore/TomEELDAPIdentityStoreTest.java  | 52 ++++++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java b/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java
index 2c169db53d..19221704c7 100644
--- a/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java
+++ b/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java
@@ -193,9 +193,14 @@ public class TomEELDAPIdentityStore implements IdentityStore {
         final UsernamePasswordCredential usernamePasswordCredential,
         final String callerDn) {
 
+        final String password = usernamePasswordCredential.getPasswordAsString();
+        if (StringUtils.isEmpty(password)) {
+            return false;
+        }
+
         try {
             // do a direct bind and see if an exception happens
-            silentlyCloseLdapContext(lookup(definition.url(), callerDn, usernamePasswordCredential.getPasswordAsString()));
+            silentlyCloseLdapContext(lookup(definition.url(), callerDn, password));
             return true;
 
         } catch (final Exception e) {
diff --git a/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java b/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java
new file mode 100644
index 0000000000..4c8de4892a
--- /dev/null
+++ b/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomee.security.identitystore;
+
+import jakarta.security.enterprise.credential.UsernamePasswordCredential;
+import jakarta.security.enterprise.identitystore.LdapIdentityStoreDefinition;
+import org.junit.Test;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+import static org.junit.Assert.assertFalse;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+public class TomEELDAPIdentityStoreTest {
+
+    @Test
+    public void emptyPasswordDoesNotBind() throws Exception {
+        final TomEELDAPIdentityStore store = new TomEELDAPIdentityStore();
+
+        final LdapIdentityStoreDefinition definition = mock(LdapIdentityStoreDefinition.class);
+        final Field definitionField = TomEELDAPIdentityStore.class.getDeclaredField("definition");
+        definitionField.setAccessible(true);
+        definitionField.set(store, definition);
+
+        final Method authenticate = TomEELDAPIdentityStore.class.getDeclaredMethod(
+            "authenticateWithCallerDn", UsernamePasswordCredential.class, String.class);
+        authenticate.setAccessible(true);
+
+        final boolean result = (Boolean) authenticate.invoke(store,
+            new UsernamePasswordCredential("user", ""), "cn=user,ou=people,dc=example,dc=org");
+
+        assertFalse(result);
+        verify(definition, never()).url();
+    }
+}