]
Jan Kalina reassigned WFLY-7946:
--------------------------------
Assignee: Jan Kalina (was: Darran Lofthouse)
Elytron ldap-realm does not handle loops in referrals
-----------------------------------------------------
Key: WFLY-7946
URL:
https://issues.jboss.org/browse/WFLY-7946
Project: WildFly
Issue Type: Bug
Components: Security
Affects Versions: 11.0.0.Alpha1
Reporter: Ondrej Lukas
Assignee: Jan Kalina
Priority: Critical
Attachments: print-roles.war
According to LDAP specification [1]: "Clients that follow referrals MUST ensure that
they do not loop between servers. They MUST NOT repeatedly contact the same server for the
same request with the same parameters.".
When application server is configured to use ldap-realm with dir-context which uses
referral-mode=follow or throw and LDAP servers contain loop then it leads to infinite
cycle. It can results to java.lang.OutOfMemoryError on EAP server.
[1]
http://tools.ietf.org/html/rfc4511#section-4.1.10