[
https://issues.apache.org/jira/browse/KNOX-3425?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108729#comment-18108729
]
ASF subversion and git services commented on KNOX-3425:
-------------------------------------------------------
Commit 1cfef0d532f5f70dc434ae65f1668e95ef71a672 in knox's branch
refs/heads/master from David Han
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=1cfef0d53 ]
KNOX-3425: LDAP Proxy disallows anonymous binds to remote backends (#1358)
The LdapProxyBackend.authenticate method will now return false if either
the given DN or password is empty to prevent unauthorized and anonymous binds.
The UserSearchInterceptor is also updated to not call the backend if the DN
or password is empty.
> Ldap Proxy may allow anonymous bind
> -----------------------------------
>
> Key: KNOX-3425
> URL: https://issues.apache.org/jira/browse/KNOX-3425
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.0.0, 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> The UserSearchInterceptor is configured before the AuthenticationInterceptor.
> The search implementation swallows exceptions with the intention to allow
> partial results from multiple backends. The bug is that this exception
> handling behavior also swallows exceptions raised by the authentication
> interceptor.
> I think that the behavior should be changed to raise any exceptions rather
> than swallowing. Swallowing exceptions also makes it unclear if there were
> any configuration problems connecting to a remote backend.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
