summaryrefslogtreecommitdiff
path: root/src/providers/ldap
diff options
context:
space:
mode:
authorStephen Gallagher <sgallagh@redhat.com>2010-08-18 12:57:43 -0400
committerStephen Gallagher <sgallagh@redhat.com>2010-08-24 12:44:00 -0400
commit8262914f885b34a3a845327f59bd70b91ad0d561 (patch)
tree612c52a8e874fac5af3a2949428ba2b9faef42ae /src/providers/ldap
parentbf5a808fa92007c325c3996e79694badfab201d4 (diff)
downloadsssd-8262914f885b34a3a845327f59bd70b91ad0d561.tar.gz
sssd-8262914f885b34a3a845327f59bd70b91ad0d561.tar.bz2
sssd-8262914f885b34a3a845327f59bd70b91ad0d561.zip
Treat a zero-length password as a failure
Some LDAP servers allow binding with blank passwords. We should not allow a blank password to authenticate the SSSD.
Diffstat (limited to 'src/providers/ldap')
-rw-r--r--src/providers/ldap/ldap_auth.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index bddfba8c..d39803ea 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -511,6 +511,13 @@ static struct tevent_req *auth_send(TALLOC_CTX *memctx,
req = tevent_req_create(memctx, &state, struct auth_state);
if (!req) return NULL;
+ /* Treat a zero-length password as a failure */
+ if (password.length == 0) {
+ state->result = SDAP_AUTH_FAILED;
+ tevent_req_done(req);
+ return tevent_req_post(req, ev);
+ }
+
state->ev = ev;
state->ctx = ctx;
state->username = username;