grealish / pwm

Automatically exported from code.google.com/p/pwm
0 stars 0 forks source link

Password at Main Login Screen Not Case Sensitive #400

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1.Try to login into the main PWM login screen with an existing user (or create 
a new one)
Example: http://pwmdemo.weisberg.net/pwm/private/Login

2.Enter the password with all letters switched to capital
Example:
true password= Abcde1234A
switched (incorrect) password= ABCDE1234A
other (incorrect) version= abcde1234a

3.As Login is not case sensitive it will grant you access successfully.
It will accept all versions of the password

What is the expected output? What do you see instead?
+Expected output is login rejection as the password is incorrect.
+Instead is not detecting password correctly and is granting access.

What version of PWM are you using?
+All versions. Please run this test on the demo server.

What ldap directory and version are you using?
+Not related

Please paste any error log messages below:
+No error messages.

Original issue reported on code.google.com by cuan...@gmail.com on 29 May 2013 at 4:03

GoogleCodeExporter commented 9 years ago
This is an issue with the ldap directory, not PWM.  In case of demo server, 
case sensitivity is not enabled on the ldap password policy.

Original comment by jrivard on 29 May 2013 at 5:06

GoogleCodeExporter commented 9 years ago
Hello, is this issue resolved?

I'm testing PWM 1.7.0 with Novell eDirectory v8.8 SP7.

What do you mean for is an ldap directory issue? I have the password policy 
with case sensitive option enabled.

Thanks

Original comment by jinwu.so...@gmail.com on 29 Jan 2014 at 3:48