Major Description
The LDAP spec states:
Operational experience shows that clients can (and frequently do) misuse the unauthenticated authentication mechanism of the simple Bind method (see Section 5.1.2). For example, a client program might make a decision to grant access to non-directory information on the basis of successfully completing a Bind operation. LDAP server implementations may return a success response to an unauthenticated Bind request. This may erroneously leave the client with the impression that the server has successfully authenticated the identity represented by the distinguished name when in reality, an anonymous authorization state has been established. Clients that use the results from a simple Bind operation to make authorization decisions should actively detect unauthenticated Bind requests (by verifying that the supplied password is not empty) and react appropriately.
Artemis falls into the this last category of "Clients that use the results from a simple Bind operation to make authorization decisions." Therefore the LDAPLoginModule should reject authentication attempts using empty or null passwords.
Attachments
Issue Links
- links to
