Directory ApacheDS
  1. Directory ApacheDS
  2. DIRSERVER-1803

When the SimpleAuthenticator is disabled, and the auth level is set to SIMPLE, we can bind freely

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Blocker Blocker
    • Resolution: Fixed
    • Affects Version/s: 2.0.0-M10
    • Fix Version/s: 2.0.0-M11
    • Component/s: None
    • Labels:
      None

      Description

      Disable the SimpleAuthenticator, do a SIMPLE bind with a user and a password which don't exist on theserver : you get connected !

      dn: aaa=b
      pwd : azerty

      Connected !

        Activity

        Hide
        Emmanuel Lecharny added a comment -

        The reason is that we try to get the Authenticators related to the authent level required (Simple, Strong - for SASL - or anonymous), and if we find none, we delegate to the nexus :

        AuthenticatorInterceptor :

        Collection<Authenticator> authenticators = getAuthenticators( level );

        if ( authenticators == null )
        {
        LOG.debug( "No authenticators found, delegating bind to the nexus." );

        // as a last resort try binding via the nexus
        next( bindContext );

        BaseInterceptor :

        public void bind( BindOperationContext bindContext ) throws LdapException

        { // Do nothing here : there is no support for the Bind operation in Partition }

        and we are connected... This is seriously WRONG.

        Show
        Emmanuel Lecharny added a comment - The reason is that we try to get the Authenticators related to the authent level required (Simple, Strong - for SASL - or anonymous), and if we find none, we delegate to the nexus : AuthenticatorInterceptor : Collection<Authenticator> authenticators = getAuthenticators( level ); if ( authenticators == null ) { LOG.debug( "No authenticators found, delegating bind to the nexus." ); // as a last resort try binding via the nexus next( bindContext ); BaseInterceptor : public void bind( BindOperationContext bindContext ) throws LdapException { // Do nothing here : there is no support for the Bind operation in Partition } and we are connected... This is seriously WRONG.
        Hide
        Emmanuel Lecharny added a comment -
        Show
        Emmanuel Lecharny added a comment - Fixed with : http://svn.apache.org/r1446503
        Hide
        Emmanuel Lecharny added a comment -

        Closed all the resolved issues

        Show
        Emmanuel Lecharny added a comment - Closed all the resolved issues

          People

          • Assignee:
            Unassigned
            Reporter:
            Emmanuel Lecharny
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development