[jboss-jira] [JBoss JIRA] (ELY-760) Elytron Ldap Realm searches roles before validating password

[Ondrej Lukas (JIRA)]

Ondrej Lukas created ELY-760:
--------------------------------

             Summary: Elytron Ldap Realm searches roles before validating password
                 Key: ELY-760
                 URL: https://issues.jboss.org/browse/ELY-760
             Project: WildFly Elytron
          Issue Type: Bug
            Reporter: Ondrej Lukas
            Assignee: Darran Lofthouse
            Priority: Critical


In Ldap Realm roles are searched before actual user password is validated. Ldap Realm uses following flow:
# searching for username
# searching for roles (i.e. searching for attributes)
# validating password for username

It means even if wrong password is used then roles in LDAP are searched. Password should be validated before some roles are searched. Current behavior can result to performance issues.



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)