[jboss-jira] [JBoss JIRA] (ELY-760) Elytron Ldap Realm searches roles before validating password

[Ondrej Lukas (JIRA)]

     [ https://issues.jboss.org/browse/ELY-760?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ondrej Lukas updated ELY-760:
-----------------------------
    Component/s: Realms


> Elytron Ldap Realm searches roles before validating password
> ------------------------------------------------------------
>
>                 Key: ELY-760
>                 URL: https://issues.jboss.org/browse/ELY-760
>             Project: WildFly Elytron
>          Issue Type: Bug
>          Components: Realms
>    Affects Versions: 1.1.0.Beta13
>            Reporter: Ondrej Lukas
>            Assignee: Darran Lofthouse
>            Priority: Critical
>
> In Ldap Realm roles are searched before actual user password is validated. Ldap Realm uses following flow:
> # searching for username
> # searching for roles (i.e. searching for attributes)
> # validating password for username
> It means even if wrong password is used then roles in LDAP are searched. Password should be validated before some roles are searched. Current behavior can result to performance issues.



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)