[
https://issues.apache.org/jira/browse/KNOX-3425?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108868#comment-18108868
]
ASF subversion and git services commented on KNOX-3425:
-------------------------------------------------------
Commit a7033887a494d13dd2e90b8cd9925f6d7ee8a409 in knox's branch
refs/heads/v3.0.0 from David Han
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=a7033887a ]
KNOX-3425: LDAP Proxy disallows anonymous binds to remote backends (#1358)
The LdapProxyBackend.authenticate method will now return false if either
the given DN or password is empty to prevent unauthorized and anonymous binds.
The UserSearchInterceptor is also updated to not call the backend if the DN
or password is empty.
(cherry picked from commit 1cfef0d532f5f70dc434ae65f1668e95ef71a672)
> Ldap Proxy may allow anonymous bind
> -----------------------------------
>
> Key: KNOX-3425
> URL: https://issues.apache.org/jira/browse/KNOX-3425
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.0.0, 3.1.0
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> The UserSearchInterceptor is configured before the AuthenticationInterceptor.
> The search implementation swallows exceptions with the intention to allow
> partial results from multiple backends. The bug is that this exception
> handling behavior also swallows exceptions raised by the authentication
> interceptor.
> I think that the behavior should be changed to raise any exceptions rather
> than swallowing. Swallowing exceptions also makes it unclear if there were
> any configuration problems connecting to a remote backend.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
