[jboss-jira] [JBoss JIRA] Resolved: (JBPORTAL-1785) Any LDAP user can login in the Portal with blank password

[Boleslaw Dawidowicz (JIRA)]

     [ http://jira.jboss.com/jira/browse/JBPORTAL-1785?page=all ]

Boleslaw Dawidowicz resolved JBPORTAL-1785.
-------------------------------------------

    Resolution: Done

I think this is LDAP specific and some servers treat blank passwords as anonymous login. I added 'allowEmptyPasswords' (default is now false) option to refuse authentication with such password:

<option-group>
         <group-name>common</group-name>
         ...
         <option>
            <name>allowEmptyPasswords</name>
            <value>true</value>
         </option>
        ...
</option-group>

This will go in 2.6.3. Identity jars will be updated in repo later today

> Any LDAP user can login in the Portal with blank password
> ---------------------------------------------------------
>
>                 Key: JBPORTAL-1785
>                 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1785
>             Project: JBoss Portal
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Portal Identity
>    Affects Versions: 2.6.2 Final
>         Environment: Any (Windows, Linux, MAC OSX)
>            Reporter: Marco Sarti
>         Assigned To: Boleslaw Dawidowicz
>             Fix For: 2.6.3 Final
>
>
> I refer to this document: 
> http://wiki.jboss.org/wiki/Wiki.jsp?page=ConfigurePortalForMicrosoftActiveDirectory
> With portal configured to authenticate users through LDAP/Active Directory, any user can login simply leaving the password field empty.
> The identity management correctly rejects wrong passwords, but accepts blank password and it completes the authentication process as the password was right.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira