[CAUSEWAY-2157] Secman: Non-existing User gets created in DB even though not authenticated via LDAP

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 2.0.0-M3
• Assignee: Andi Huber
• Reporter: Andi Huber
• Created: 02/Aug/19 07:06
• Updated: 25/Jan/23 10:34
• Resolved: 02/Aug/19 08:48

Description

When using Secman with delegated authentication to LDAP, any login attempt authenticated or not will create an (disabled) user-account in the DB.

While not a security risk, this allows attackers to 'fill' the database with arbitrary garbage.

Desired behavior for this scenario is to auto-create user accounts in the DB only if these do successfully authenticate with the delegated authentication mechanism.