[jboss-jira] [JBoss JIRA] (SECURITY-952) AdvancedLdapLoginModule with roleAttributeID="" and empty or unset roleFilter can lead to authentication failure

[Ondrej Lukas (JIRA)]

Ondrej Lukas created SECURITY-952:
-------------------------------------

             Summary: AdvancedLdapLoginModule with roleAttributeID="" and empty or unset roleFilter can lead to authentication failure
                 Key: SECURITY-952
                 URL: https://issues.jboss.org/browse/SECURITY-952
             Project: PicketBox 
          Issue Type: Bug
            Reporter: Ondrej Lukas
            Assignee: Stefan Guilhen


In case when AdvancedLdapLoginModule is correctly configured for authentication, but its attribute roleAttributeID is empty string and roleFilter is not set (i.e. is null) or roleFilter is empty string, then authentication with correct username and password fails. It is caused by internal NPE for searching roles.

Expected behavior is that users should be authenticated but no roles should be assigned to them.

Internal NPE:
{code}
java.lang.NullPointerException
	at org.jboss.security.negotiation.AdvancedLdapLoginModule.obtainRole(AdvancedLdapLoginModule.java:821)
	at org.jboss.security.negotiation.AdvancedLdapLoginModule.rolesSearch(AdvancedLdapLoginModule.java:762)
	at org.jboss.security.negotiation.AdvancedLdapLoginModule.innerLogin(AdvancedLdapLoginModule.java:412)
	at org.jboss.security.negotiation.AdvancedLdapLoginModule$AuthorizeAction.run(AdvancedLdapLoginModule.java:981)
	at org.jboss.security.negotiation.AdvancedLdapLoginModule.login(AdvancedLdapLoginModule.java:331)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
{code}



--
This message was sent by Atlassian JIRA
(v6.4.11#64026)