Forget about the previous mail. The message is simply swallowed and replaced by the correct message.
The inner message is just used for debugging purpose. My bad... On Mon, Jun 9, 2008 at 9:59 PM, Emmanuel Lecharny <[EMAIL PROTECTED]> wrote: > Hi, > > while reviewing the whole authentication system, I discovered that if > you provide a wrong password to an existing user, you will get a > LdapAuthenticationException error, with a "Password not correct for > user 'blah'". > > This is contracditory with RFC 4513 which says that if the password is > not valid for the DN, an InvalidCredentials error should be issued. > More important is the message, which gives a clear indication to the > user that the DN is correct, but its password is not the good one : > typically the wrong message to give to an attacker. > > I think we have to change this portion of the code. > > thoughts ? > > -- > Regards, > Cordialement, > Emmanuel Lécharny > www.iktek.com > -- Regards, Cordialement, Emmanuel Lécharny www.iktek.com
