You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by tr...@apache.org on 2014/09/07 07:57:11 UTC
svn commit: r1622973 -
/jackrabbit/oak/trunk/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/security/authentication/ldap/impl/LdapIdentityProvider.java
Author: tripod
Date: Sun Sep 7 05:57:10 2014
New Revision: 1622973
URL: http://svn.apache.org/r1622973
Log:
OAK-2078 Prevent null/empty passwords in ldap provider
Modified:
jackrabbit/oak/trunk/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/security/authentication/ldap/impl/LdapIdentityProvider.java
Modified: jackrabbit/oak/trunk/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/security/authentication/ldap/impl/LdapIdentityProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/security/authentication/ldap/impl/LdapIdentityProvider.java?rev=1622973&r1=1622972&r2=1622973&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/security/authentication/ldap/impl/LdapIdentityProvider.java (original)
+++ jackrabbit/oak/trunk/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/security/authentication/ldap/impl/LdapIdentityProvider.java Sun Sep 7 05:57:10 2014
@@ -539,6 +539,12 @@ public class LdapIdentityProvider implem
final SimpleCredentials creds = (SimpleCredentials) credentials;
final ExternalUser user = getUser(creds.getUserID());
if (user != null) {
+ // OAK-2078: check for non-empty passwords to avoid anonymous bind on weakly configured servers
+ // see http://tools.ietf.org/html/rfc4513#section-5.1.1 for details.
+ if (creds.getPassword().length == 0) {
+ throw new LoginException("Refusing to authenticate against LDAP server: Empty passwords allowed.");
+ }
+
// authenticate
LdapConnection connection = null;
try {