]
Jan Kalina reassigned ELY-760:
------------------------------
Assignee: Jan Kalina (was: Darran Lofthouse)
Elytron Ldap Realm searches roles before validating password
------------------------------------------------------------
Key: ELY-760
URL:
https://issues.jboss.org/browse/ELY-760
Project: WildFly Elytron
Issue Type: Bug
Components: Realms
Affects Versions: 1.1.0.Beta13
Reporter: Ondrej Lukas
Assignee: Jan Kalina
Priority: Critical
In Ldap Realm roles are searched before actual user password is validated. Ldap Realm
uses following flow:
# searching for username
# searching for roles (i.e. searching for attributes)
# validating password for username
It means even if wrong password is used then roles in LDAP are searched. Password should
be validated before some roles are searched. Current behavior can result to performance
issues.