Elytron Ldap Realm searches roles before validating password ------------------------------------------------------------ Key: ELY-760 URL: https://issues.jboss.org/browse/ELY-760 Project: WildFly Elytron Issue Type: Bug Components: Realms Affects Versions: 1.1.0.Beta13 Reporter: Ondrej Lukas Assignee: Jan Kalina Priority: Critical In Ldap Realm roles are searched before actual user password is validated. Ldap Realm uses following flow: # searching for username # searching for roles (i.e. searching for attributes) # validating password for username It means even if wrong password is used then roles in LDAP are searched. Password should be validated before some roles are searched. Current behavior can result to performance issues.