Defect #714
LDAP authentication without password
| Status: | Closed | Start: | 2008-02-22 | |
| Priority: | High | Due date: | ||
| Assigned to: | - | % Done: | 0% |
|
| Category: | Accounts | |||
| Target version: | 0.7 | |||
| Affected version: | 0.6.3 |
Resolution: | Fixed |
|
Description
I configured LDAP authentication using ActiveDirectory.
Users are able to log in by their username/password, but they also can log in with empty password.
If they enter wrong password (which is not an empty string) they got the "Invalid user or password" message.
I think the problem is in ruby-net-ldap. It is used in /app/models/auth_source_ldap.rb around line 50:
# authenticate user
ldap_con = initialize_ldap_con(dn, password)
return nil unless ldap_con.bind
ldap_con.bind returns true when empty string was given as password.
Redmine version: v0.6.3
ruby-net-ldap version: 0.0.4
History
2008-02-22 15:32 - Sven Schuchmann
You are right. The same thing here.
Authentication againt a Novell eDirecoty (LDAP)
with an empty password let's everyone in...
2008-02-22 17:13 - Witold Oleksiak
Confirmed - the same behavior when authenticating against MS Active Directory...
2008-02-22 18:34 - Jean-Philippe Lang
- Status changed from New to Resolved
- Resolution set to Fixed
I can not reproduce this problem with openldap. Anyway, the fix is committed in trunk (r1169) and 0.6 branch (r1170).
0.6.3 users can apply this patch to fix it:
http://www.redmine.org/repositories/diff/redmine?rev=1170