This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 470fb4956b Always use a simple bind to validate a user and password
via a bind
470fb4956b is described below
commit 470fb4956b91b859359a431371839c973b52e0f8
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Sep 28 14:13:13 2026 +0100
Always use a simple bind to validate a user and password via a bind
---
java/org/apache/catalina/realm/JNDIRealm.java | 9 ++++-----
webapps/docs/changelog.xml | 5 +++++
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/java/org/apache/catalina/realm/JNDIRealm.java
b/java/org/apache/catalina/realm/JNDIRealm.java
index 64648778d0..77dd34dc84 100644
--- a/java/org/apache/catalina/realm/JNDIRealm.java
+++ b/java/org/apache/catalina/realm/JNDIRealm.java
@@ -148,6 +148,7 @@ public class JNDIRealm extends RealmBase {
private static final String NULL_USER_ROLE_ATTRIBUTE_PLACEHOLDER =
"tomcat-unset-ignore";
private static final String AUTHENTICATION_NAME_GSSAPI = "GSSAPI";
+ private static final String AUTHENTICATION_NAME_SIMPLE = "simple";
/**
@@ -1979,10 +1980,8 @@ public class JNDIRealm extends RealmBase {
// Elicit an LDAP bind operation using the provided user credentials
try {
userCredentialsAdd(context, dn, credentials);
- // Need to make sure GSSAPI SASL authentication is not used if
configured
- if
(AUTHENTICATION_NAME_GSSAPI.equals(preservedEnvironment.get(Context.SECURITY_AUTHENTICATION)))
{
- context.removeFromEnvironment(Context.SECURITY_AUTHENTICATION);
- }
+ // Check credentials by performing a simple bind
+ context.addToEnvironment(Context.SECURITY_AUTHENTICATION,
AUTHENTICATION_NAME_SIMPLE);
if (containerLog.isTraceEnabled()) {
containerLog.trace(" binding as " + dn);
}
@@ -1993,7 +1992,7 @@ public class JNDIRealm extends RealmBase {
containerLog.trace(" bind attempt failed", e);
}
} finally {
- // Restore GSSAPI SASL if previously configured
+ // Restore any previously configured authentication mechanism
restoreEnvironmentParameter(context,
Context.SECURITY_AUTHENTICATION, preservedEnvironment);
userCredentialsRemove(context);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 1508835008..91159fb3ea 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -292,6 +292,11 @@
<code>AprLifecycleListener</code> and throw an Error when FIPS is
requested but not available. (markt)
</fix>
+ <fix>
+ Ensure that, as per the documentation, a simple bind is always used
when
+ the JNDI realm binds using the user provided name and password to
+ authenticate the user. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
