389-ds-base

#47944 unauthenticated authentication should be also enforced after PRE_BIND plugins
Closed: wontfix Opened by tbordaz.

Closed: wontfix
Reopen Issue

unauthenticated authentication happens when a bind occurs with a zero length password (http://tools.ietf.org/html/rfc4513#section-5.1).

This is enforced in do_bind. By default such bind is rejected but is accepted if "nsslapd-allow-unauthenticated-binds" is set to 'on'.

With OTP, the received password is composed of ''. A BIND preop plugin will validate and strip the '' part. So the backend bind (ldbm_back_bind) will proceed only with the '' part.

If the part is empty, backend bind will report SLAPI_BIND_ANONYMOUS and the connection will be AUTH_NONE.

Before calling be->be_bind, we should check again the length of the credential and if empty password (unauthenticated authentication) is accepted or not.

Using OTP as 2FA, it makes no sense for a user to have empty password.
So this is a corner case, currently enforced by OTP plugin.

Will not fix

Metadata Update from @tbordaz:
- Issue set to the milestone: N/A

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/1275

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @spichugi:
- Issue close_status updated to: wontfix (was: Invalid)
Metadata
None
None
None
None
Normal
IPA
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.