[DERBY-2736] Connecting with an invalid user identifier performs authentication before rejecting the connection.

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 10.0.2.0, 10.0.2.1, 10.1.1.0, 10.1.2.1, 10.1.3.1, 10.2.1.6, 10.2.2.0, 10.3.1.4
• Component/s: Services
• Labels: derby_triage10_5_2
• Urgency: Normal
• Issue & fix info: Newcomer, Repro attached
• Bug behavior facts: Security
• Assignee: Unassigned
• Reporter: Daniel John Debrunner
• Created: 31/May/07 16:17
• Updated: 29/Oct/12 17:58

Description

Ideally no authentication attempt should be made because the user identifier is invalid.
E.g. with this URL

jdbc:derby:db1;user=123

the connection attempt will correctly fail but only after the authentication mechanism is called.

If the application has installed its own UserAuthenticator class then that class will be called with an invalid identifier.
I believe that the connection request should fail before calling any authentication, developers should only be required
to handle valid identifiers.

Issue Links

• relates to: DERBY-5968 A failed connection attempt may nevertheless manage to boot the database.