Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-21 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 4/21/20 10:31, Mark H. Wood wrote: > On Mon, Apr 20, 2020 at 12:17:54PM -0400, Christopher Schultz > wrote: >> Hmm. The LDAP stuff I think wasn't me, but I understand it a >> little bit. Brian, is there a standard I can read for this? I'm

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-21 Thread Mark H. Wood
On Mon, Apr 20, 2020 at 12:17:54PM -0400, Christopher Schultz wrote: > Hmm. The LDAP stuff I think wasn't me, but I understand it a little > bit. Brian, is there a standard I can read for this? I'm familiar with > LDAP servers storing credentials with "{sha}" prefixes but not others. > Honestly,

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-20 Thread Mark Thomas
On 19/04/2020 06:59, Brian Burch wrote: > On 17/4/20 10:28 pm, Mark Thomas wrote: >> On 16/04/2020 09:56, Brian Burch wrote: >>> On 15/4/20 6:24 am, Mark Thomas wrote: >> >> >> I'd expect you to see an error message if your server.xml isn't quite right although that is what this looks

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Brian, On 4/17/20 08:28, Mark Thomas wrote: > On 16/04/2020 09:56, Brian Burch wrote: >> On 15/4/20 6:24 am, Mark Thomas wrote: > > > >>> I'd expect you to see an error message if your server.xml isn't >>> quite right although that is what this

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Brian, On 4/20/20 12:17, Christopher Schultz wrote: > Brian, > > On 4/17/20 08:28, Mark Thomas wrote: >> On 16/04/2020 09:56, Brian Burch wrote: >>> On 15/4/20 6:24 am, Mark Thomas wrote: > >> > I'd expect you to see an error message if your

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-19 Thread Brian Burch
On 17/4/20 10:28 pm, Mark Thomas wrote: On 16/04/2020 09:56, Brian Burch wrote: On 15/4/20 6:24 am, Mark Thomas wrote: I'd expect you to see an error message if your server.xml isn't quite right although that is what this looks like. There was no error message. I think my xml was

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-17 Thread Mark Thomas
On 16/04/2020 09:56, Brian Burch wrote: > On 15/4/20 6:24 am, Mark Thomas wrote: >> I'd expect you to see an error message if your server.xml isn't quite >> right although that is what this looks like. > > There was no error message. I think my xml was syntax-free, but it did > not reflect my

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-16 Thread Brian Burch
On 15/4/20 6:24 am, Mark Thomas wrote: On 14/04/2020 07:34, Brian Burch wrote: I searched for usages of MessageDigestCredentialHandler.setAlgorithm, but only found it used once - within TestJNDIRealm. I did not find any occurrences within tomcat mainline code, but would not be surprised if

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-14 Thread Brian Burch
On 14/4/20 8:05 pm, Brian Burch wrote: On 14/4/20 6:53 pm, logo wrote: Brian, see down below Am 2020-04-14 08:34, schrieb Brian Burch: My initial code inspection makes me strongly suspect tomcat does not initialise JNDIRealm and a nested CredentialHandler properly during startup.

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-14 Thread Mark Thomas
On 14/04/2020 07:34, Brian Burch wrote: > I searched for usages of MessageDigestCredentialHandler.setAlgorithm, > but only found it used once - within TestJNDIRealm. I did not find any > occurrences within tomcat mainline code, but would not be surprised if > the algorithm was intended to be

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-14 Thread Brian Burch
On 14/4/20 6:53 pm, logo wrote: Brian, see down below Am 2020-04-14 08:34, schrieb Brian Burch: I thought it would be helpful to start this issue on the users list because it will contain a lot of helpful search terms. I am upgrading a stable production tomcat 7.0.52 system to tomcat

Re: JNDI match of LDAP hashed passwords fail against cleartext

2020-04-14 Thread logo
Brian, see down below Am 2020-04-14 08:34, schrieb Brian Burch: I thought it would be helpful to start this issue on the users list because it will contain a lot of helpful search terms. I am upgrading a stable production tomcat 7.0.52 system to tomcat 8.5.54. Both were built from source

JNDI match of LDAP hashed passwords fail against cleartext

2020-04-14 Thread Brian Burch
I thought it would be helpful to start this issue on the users list because it will contain a lot of helpful search terms. I am upgrading a stable production tomcat 7.0.52 system to tomcat 8.5.54. Both were built from source code (tc8 cloned from git) and compiled under openjdk8. Many users