[
https://issues.apache.org/jira/browse/ARTEMIS-2010?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16568822#comment-16568822
]
ASF GitHub Bot commented on ARTEMIS-2010:
-----------------------------------------
GitHub user jbertram opened a pull request:
https://github.com/apache/activemq-artemis/pull/2213
ARTEMIS-2010 actively detect unauthenticated LDAP Bind requests
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/jbertram/activemq-artemis ARTEMIS-2010
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/activemq-artemis/pull/2213.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #2213
----
commit 793d7514ca59b9e6d307809a701e7d8af3369f2e
Author: Justin Bertram <jbertram@...>
Date: 2018-08-03T21:39:09Z
ARTEMIS-2010 actively detect unauthenticated LDAP Bind requests
----
> LDAPLoginModule should actively detect unauthenticated Bind requests
> --------------------------------------------------------------------
>
> Key: ARTEMIS-2010
> URL: https://issues.apache.org/jira/browse/ARTEMIS-2010
> Project: ActiveMQ Artemis
> Issue Type: Bug
> Reporter: Justin Bertram
> Assignee: Justin Bertram
> Priority: Major
>
> The [LDAP spec|https://tools.ietf.org/html/rfc4513#section-6.3.1] states:
> bq. Operational experience shows that clients can (and frequently do) misuse
> the unauthenticated authentication mechanism of the simple Bind method (see
> Section 5.1.2). For example, a client program might make a decision to grant
> access to non-directory information on the basis of successfully completing a
> Bind operation. LDAP server implementations may return a success response to
> an unauthenticated Bind request. This may erroneously leave the client with
> the impression that the server has successfully authenticated the identity
> represented by the distinguished name when in reality, an anonymous
> authorization state has been established. Clients that use the results from
> a simple Bind operation to make authorization decisions should actively
> detect unauthenticated Bind requests (by verifying that the supplied password
> is not empty) and react appropriately.
> Artemis falls into the this last category of "Clients that use the results
> from a simple Bind operation to make authorization decisions." Therefore the
> {{LDAPLoginModule}} should reject authentication attempts using empty or null
> passwords.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
