Broken password validation - Githubissues

ContainX / marathon-ldap

LDAP / Active Directory Authentication and Authorization Plugin for Mesosphere Marathon

Other

60 stars 32 forks source link

Broken password validation #27

Closed kamaradclimber closed 5 years ago

kamaradclimber commented 5 years ago

Since merge of https://github.com/ContainX/marathon-ldap/pull/23, master branch of this repository allows anyone to authenticate as any (existing) user in ldap.

To reproduce:

configure bindUser and bindPassword (bindUser must not contain {username} but be a real username)
try to connect to marathon using an existing user from ldap (and a random password) => you are authenticated as the target user

This issue was introduced by https://github.com/ContainX/marathon-ldap/commit/a778d9de1b7191bddfbe596fc5827b27257c19bb which remove step where user password is validated (by always using bind credentials).