[
https://issues.apache.org/jira/browse/DIRSERVER-997?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emmanuel Lecharny updated DIRSERVER-997:
----------------------------------------
Component/s: aci
config
> Block search ability for userPassword attribute
> -----------------------------------------------
>
> Key: DIRSERVER-997
> URL: https://issues.apache.org/jira/browse/DIRSERVER-997
> Project: Directory ApacheDS
> Issue Type: Improvement
> Components: aci, config
> Affects Versions: pre-1.0, 1.0-RC1, 1.0-RC2, 1.0-RC3, 1.0-RC4, 1.0, 1.0.1,
> 1.0.2, 1.5.0, 1.5.1, 1.5.2
> Environment: All
> Reporter: Hans Lohmander
> Assignee: Emmanuel Lecharny
> Priority: Major
> Fix For: 2.0.0-M8, 2.0.0-RC1
>
>
> I entered this issue on request from the user list where this topic came up.
> The userPassword should not be available for search,
> else password fishing is possible.
> If you are allowed to do a search like
> $ ldapsearch -b o=some.root -s sub
> 'userPassword="{md5}b4b5835f03bd6748e0cc25790d6f3498"' dn
> it would render you all objects with the attribute userPassword equal to
> "the secret password", which may not be such a good idea.
> iPlanet DS 4.x allowed searches on ueserPassword attribute with
> directory manager privs I found out.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
