Originating bug: http://www.webgui.org/bugs/tracker/9775
We had a user who reported that in their LDAP setup that they allow
spaces inside of passwords (not on the end). Their other applications
allow them to log in with no problems, but WebGUI doesn't.
Using OpenLDAP, I set up two users, one with a space in their password,
and one without. I traced the password all the way through WebGUI until
it gets sent to Net::LDAP, and the password makes it there intact. Then
I logged some requests sent from Net::LDAP and noticed that the messages
sent to LDAP are different depending whether or not the user has a space
in their password:
0)^B^A^A`$^B^A^C^D^Wcn=Manager,dc=localhost<80>^Fsecret at
/usr/lib/perl5/vendor_perl/5.10.0/Net/LDAP.pm line 407.
0-^B^A^D`(^B^A^C^D^Xcn=spacebob,dc=localhost<80> space bob at
/usr/lib/perl5/vendor_perl/5.10.0/Net/LDAP.pm line 407.
0(^B^A^A`#^B^A^C^D^Vcn=joebob,dc=localhost<80>^Fjoebob at
/usr/lib/perl5/vendor_perl/5.10.0/Net/LDAP.pm line 407.
I don't know the internals of Net::LDAP well enough to know whether or
not this is a bug in Net::LDAP, or Convert::ASN1, or some other module.
RT for rt.cpan.org