This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 2ca1885f9ae1 CAMEL-26687: camel-spring-ldap - the authenticate
operation fails fast when the password is missing or empty (#29321)
2ca1885f9ae1 is described below
commit 2ca1885f9ae1fcd19d1b3e153ece216624be40a4
Author: Claus Ibsen <[email protected]>
AuthorDate: Fri Nov 6 14:28:19 2026 +0100
CAMEL-26687: camel-spring-ldap - the authenticate operation fails fast when
the password is missing or empty (#29321)
Signed-off-by: Claus Ibsen <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
.../camel/catalog/docs/spring-ldap-component.adoc | 2 ++
.../src/main/docs/spring-ldap-component.adoc | 2 ++
.../component/springldap/SpringLdapProducer.java | 14 +++++++--
.../springldap/SpringLdapProducerTest.java | 35 ++++++++++++++++++++++
4 files changed, 50 insertions(+), 3 deletions(-)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/spring-ldap-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/spring-ldap-component.adoc
index 826bea007443..6337e1467dea 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/spring-ldap-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/spring-ldap-component.adoc
@@ -126,6 +126,8 @@ deleted.
The message body must have entries with the keys *`filter`* and *`password`*.
The
values must be an instance of `String` representing a valid LDAP filter and a
user password, respectively.
+A missing or empty password fails the operation with an
`org.springframework.ldap.AuthenticationException`,
+without contacting the LDAP server.
=== Modify Attributes
diff --git
a/components/camel-spring-parent/camel-spring-ldap/src/main/docs/spring-ldap-component.adoc
b/components/camel-spring-parent/camel-spring-ldap/src/main/docs/spring-ldap-component.adoc
index 826bea007443..6337e1467dea 100644
---
a/components/camel-spring-parent/camel-spring-ldap/src/main/docs/spring-ldap-component.adoc
+++
b/components/camel-spring-parent/camel-spring-ldap/src/main/docs/spring-ldap-component.adoc
@@ -126,6 +126,8 @@ deleted.
The message body must have entries with the keys *`filter`* and *`password`*.
The
values must be an instance of `String` representing a valid LDAP filter and a
user password, respectively.
+A missing or empty password fails the operation with an
`org.springframework.ldap.AuthenticationException`,
+without contacting the LDAP server.
=== Modify Attributes
diff --git
a/components/camel-spring-parent/camel-spring-ldap/src/main/java/org/apache/camel/component/springldap/SpringLdapProducer.java
b/components/camel-spring-parent/camel-spring-ldap/src/main/java/org/apache/camel/component/springldap/SpringLdapProducer.java
index 650aad2df94a..961dcc4eaca1 100644
---
a/components/camel-spring-parent/camel-spring-ldap/src/main/java/org/apache/camel/component/springldap/SpringLdapProducer.java
+++
b/components/camel-spring-parent/camel-spring-ldap/src/main/java/org/apache/camel/component/springldap/SpringLdapProducer.java
@@ -26,6 +26,7 @@ import javax.naming.directory.ModificationItem;
import org.apache.camel.Exchange;
import org.apache.camel.support.DefaultProducer;
import org.apache.camel.util.ObjectHelper;
+import org.springframework.ldap.AuthenticationException;
import org.springframework.ldap.core.AttributesMapper;
import org.springframework.ldap.core.ContextSource;
import org.springframework.ldap.core.LdapOperations;
@@ -72,7 +73,7 @@ public class SpringLdapProducer extends DefaultProducer {
* see <a
http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol>http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol</a>
* key: "attributes" - necessary for the bind operation only; an instance
of javax.naming.directory.Attributes,
* containing the information necessary to create an LDAP node.
- * key: "password" - necessary for the authentication operation only;
+ * key: "password" - necessary for the authentication operation only; a
missing or empty password fails the operation
* key: "modificationItems" - necessary for the modify_attributes
operation only;
* key: "function" - necessary for the function_driven operation only;
provides a flexible hook into the {@link LdapTemplate} to call any method
* key: "request" - necessary for the function_driven operation only;
passed into the "function" to enable the client to bind parameters that need to
be passed into the {@link LdapTemplate}
@@ -118,8 +119,15 @@ public class SpringLdapProducer extends DefaultProducer {
ldapTemplate.unbind(dn);
break;
case AUTHENTICATE:
-
ldapTemplate.authenticate(LdapQueryBuilder.query().base(dn).filter((String)
body.get(FILTER)),
- (String) body.get(PASSWORD));
+ String password = (String) body.get(PASSWORD);
+ if (password == null || password.isEmpty()) {
+ // fail the same way regardless of the Spring LDAP version
and authentication strategy in use
+ throw new AuthenticationException(
+ new javax.naming.AuthenticationException(
+ "The authenticate operation needs a
non-empty password in the '" + PASSWORD
+ + "'
entry of the body"));
+ }
+
ldapTemplate.authenticate(LdapQueryBuilder.query().base(dn).filter((String)
body.get(FILTER)), password);
break;
case MODIFY_ATTRIBUTES:
ModificationItem[] modificationItems = (ModificationItem[])
body.get(MODIFICATION_ITEMS);
diff --git
a/components/camel-spring-parent/camel-spring-ldap/src/test/java/org/apache/camel/component/springldap/SpringLdapProducerTest.java
b/components/camel-spring-parent/camel-spring-ldap/src/test/java/org/apache/camel/component/springldap/SpringLdapProducerTest.java
index 6a7af2e28344..b6cd1f4bf593 100644
---
a/components/camel-spring-parent/camel-spring-ldap/src/test/java/org/apache/camel/component/springldap/SpringLdapProducerTest.java
+++
b/components/camel-spring-parent/camel-spring-ldap/src/test/java/org/apache/camel/component/springldap/SpringLdapProducerTest.java
@@ -37,6 +37,7 @@ import org.mockito.ArgumentMatchers;
import org.mockito.Mock;
import org.mockito.junit.jupiter.MockitoSettings;
import org.mockito.quality.Strictness;
+import org.springframework.ldap.AuthenticationException;
import org.springframework.ldap.core.AttributesMapper;
import org.springframework.ldap.core.LdapOperations;
import org.springframework.ldap.core.LdapTemplate;
@@ -45,9 +46,12 @@ import org.springframework.ldap.query.LdapQuery;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.ArgumentMatchers.isNull;
import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
@@ -268,6 +272,37 @@ class SpringLdapProducerTest extends CamelTestSupport {
verify(ldapTemplate).authenticate(ArgumentMatchers.any(LdapQuery.class),
eq(password));
}
+ @Test
+ void testAuthenticateWithEmptyPassword() {
+ Map<String, Object> body = new HashMap<>();
+ body.put(SpringLdapProducer.DN, "cn=dn");
+ body.put(SpringLdapProducer.FILTER, "filter");
+ body.put(SpringLdapProducer.PASSWORD, "");
+
+ assertAuthenticateFailsWithoutCallingLdap(body);
+ }
+
+ @Test
+ void testAuthenticateWithoutPassword() {
+ Map<String, Object> body = new HashMap<>();
+ body.put(SpringLdapProducer.DN, "cn=dn");
+ body.put(SpringLdapProducer.FILTER, "filter");
+
+ assertAuthenticateFailsWithoutCallingLdap(body);
+ }
+
+ private void assertAuthenticateFailsWithoutCallingLdap(Map<String, Object>
body) {
+ Exchange exchange = new DefaultExchange(context);
+ Message in = new DefaultMessage(context);
+
+
when(ldapEndpoint.getOperation()).thenReturn(LdapOperation.AUTHENTICATE);
+
+ AuthenticationException e = assertThrows(AuthenticationException.class,
+ () -> processBody(exchange, in, body));
+ assertTrue(e.getMessage().contains(SpringLdapProducer.PASSWORD));
+ verify(ldapTemplate, never()).authenticate(any(LdapQuery.class),
anyString());
+ }
+
@Test
public void testModifyAttributes() throws Exception {
String dn = "cn=dn";
