[DIRSERVER-2220] ApacheDS should not log credentials

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-M24
• Fix Version/s: 2.0.0.AM25
• Assignee: Unassigned
• Reporter: Albert van 't Hart
• Created: 18/Jan/18 07:36
• Updated: 23/Jan/18 07:24
• Resolved: 23/Jan/18 07:23

Description

It is a bad practice to log credentials (e.g. LDAP bind request). There are several places where bindContext is logged. See class AuthenticatorInterceptor:

LOG.info("Authenticator {} failed to authenticate: {}", authenticator, bindContext);

LOG.info("Unexpected failure for Authenticator {} : {}", authenticator, bindContext);

This will result in:

 

failed to authenticate: BindContext for Dn 'uid=[e-mail],ou=vanadenovation', credentials <0x6D 0x79 0x76 0x65 0x72 0x79 0x73 0x65 0x63 0x72 0x65 0x74 0x70 0x61 0x73 0x73 0x77 0x6F 0x72 0x64>