| Subject: | User able to authenticate with null password |
I'm not sure if this is a bug or intended behavior. I've setup a small
Catalyst project with CatalystX::SimpleLogin, and I'm authenticating
against an AD server. Here's the store information:
store => {
class => 'LDAP',
ldap_server => '<server_name>',
ldap_server_options => {
timeout => 30
},
binddn => 'CN=<user_name>,OU=Users,OU=Domain
Users,DC=dev,DC=my_org,DC=com',
bindpw => '<password>',
user_basedn => 'dc=dev,dc=my_org,dc=com',
user_filter => '(sAMAccountName=%s)',
user_scope => 'sub',
user_field => 'samaccountname',
},
The authentication works fine; the issue comes up when I use the same
username that's given in the 'binddn' field. I set the index page to
requiring a login, browse to it, put in the correct username in the
username box and leave the password blank, hit submit, and I'm taken to
the index page. It appears that line 218 in Backend.pm will set the
bindpw to the password given above if the password is null, and since
I'm using the same username as the bind account, the re-bind succeeds.
Like I said, I'm not sure if this is a bug or intended behavior since I
should be using a service type account for the initial bind.