This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit caca29f2a2be9edb7a10132182a490c4159eccf5 Author: Markus Jung <[email protected]> AuthorDate: Sun Aug 30 20:35:16 2026 +0200 require a non-empty password for LDAP caller binds (cherry picked from commit 8906902f6d0c27f14a1b81d7d97dc51659f48602) --- .../identitystore/TomEELDAPIdentityStore.java | 7 ++- .../identitystore/TomEELDAPIdentityStoreTest.java | 52 ++++++++++++++++++++++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java b/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java index 2c169db53d..19221704c7 100644 --- a/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java +++ b/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java @@ -193,9 +193,14 @@ public class TomEELDAPIdentityStore implements IdentityStore { final UsernamePasswordCredential usernamePasswordCredential, final String callerDn) { + final String password = usernamePasswordCredential.getPasswordAsString(); + if (StringUtils.isEmpty(password)) { + return false; + } + try { // do a direct bind and see if an exception happens - silentlyCloseLdapContext(lookup(definition.url(), callerDn, usernamePasswordCredential.getPasswordAsString())); + silentlyCloseLdapContext(lookup(definition.url(), callerDn, password)); return true; } catch (final Exception e) { diff --git a/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java b/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java new file mode 100644 index 0000000000..4c8de4892a --- /dev/null +++ b/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.tomee.security.identitystore; + +import jakarta.security.enterprise.credential.UsernamePasswordCredential; +import jakarta.security.enterprise.identitystore.LdapIdentityStoreDefinition; +import org.junit.Test; + +import java.lang.reflect.Field; +import java.lang.reflect.Method; + +import static org.junit.Assert.assertFalse; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.never; +import static org.mockito.Mockito.verify; + +public class TomEELDAPIdentityStoreTest { + + @Test + public void emptyPasswordDoesNotBind() throws Exception { + final TomEELDAPIdentityStore store = new TomEELDAPIdentityStore(); + + final LdapIdentityStoreDefinition definition = mock(LdapIdentityStoreDefinition.class); + final Field definitionField = TomEELDAPIdentityStore.class.getDeclaredField("definition"); + definitionField.setAccessible(true); + definitionField.set(store, definition); + + final Method authenticate = TomEELDAPIdentityStore.class.getDeclaredMethod( + "authenticateWithCallerDn", UsernamePasswordCredential.class, String.class); + authenticate.setAccessible(true); + + final boolean result = (Boolean) authenticate.invoke(store, + new UsernamePasswordCredential("user", ""), "cn=user,ou=people,dc=example,dc=org"); + + assertFalse(result); + verify(definition, never()).url(); + } +}
