topic Re: Anyone can connect on LDAP, no user's password verification in Alfresco Archive

Anyone can connect on LDAP, no user's password verification

potitius — Fri, 07 Aug 2015 10:44:40 GMT

Hello all,I finally succeed to integrate Activiti with Ldap but unfortunately, when doing a random test I knew that anyone who know just the usersID can log in successfully by inserting a random password. Why Activiti / LDAP is not checking the passwords ? How can I fix this please ? Thank you for y

Re: Anyone can connect on LDAP, no user's password verification

potitius — Fri, 07 Aug 2015 11:15:12 GMT

Got some other bad news,

inserting just a random password without a username will lead to a successful authentification.

Re: Anyone can connect on LDAP, no user's password verification

vasile_dirla — Fri, 07 Aug 2015 14:25:53 GMT

could you provide your LDAP settings ?

Re: Anyone can connect on LDAP, no user's password verification

potitius — Fri, 07 Aug 2015 15:41:16 GMT

Attached you will find my LDAP Config.
Thank you.

Re: Anyone can connect on LDAP, no user's password verification

vasile_dirla — Sat, 08 Aug 2015 06:42:34 GMT

Just tested and I get this:
<code>
javax.naming.AuthenticationException: [LDAP: error code 49 - INVALID_CREDENTIALS: Bind failed: Cannot authenticate user …]
</code>
try adding a breakpoint here:
LDAPConnectionUtil.java
<code>
public static InitialDirContext createDirectoryContext(LDAPConfigurator ldapConfigurator, String principal, String credentials) {…}
</code>
and with the debugger you'll see step by step what's happening when bind operation is done.

And now the most important part
just check your ldap server configuration (maybe is not secured and just allow anyone to access it):
http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-BindPW.html