[
https://issues.apache.org/jira/browse/KNOX-3425?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108372#comment-18108372
]
David Han commented on KNOX-3425:
---------------------------------
There are two issues contributing to this problem.
The first is a simple bug. The UserSearchInterceptor checks if the
BindOperationContext.getDn() is null. However, this returns empty string
instead. This bug allows an empty string dn and password to pass on to the
LdapProxyBackend.
The second problem occurs in my test setup against active directory. active
directory is configured to allows the anonymous bind but then restrict search.
The ldap proxy doesn't consider these other restrictions so only considers this
as a successful bind.
> Ldap Proxy may allow anonymous bind
> -----------------------------------
>
> Key: KNOX-3425
> URL: https://issues.apache.org/jira/browse/KNOX-3425
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.0.0, 3.1.0
>
>
> The UserSearchInterceptor is configured before the AuthenticationInterceptor.
> The search implementation swallows exceptions with the intention to allow
> partial results from multiple backends. The bug is that this exception
> handling behavior also swallows exceptions raised by the authentication
> interceptor.
> I think that the behavior should be changed to raise any exceptions rather
> than swallowing. Swallowing exceptions also makes it unclear if there were
> any configuration problems connecting to a remote backend.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
