search

zowe / sample-spring-boot-api-service

Zowe REST API service SDK and sample API service that integrates with Zowe API Mediation Layer
Other
26 stars 18 forks source link

Check for empty password before calling PlatformUser #78

Closed plavjanik closed 4 years ago

plavjanik commented 4 years ago

Checks for an empty password before calling PlatformUser.authenticate() method from IBM JDK that could succeed in this situation. This has been a valid behavior of the underlying BPX4PWD callable service:

The name of a fullword that contains the length of the Pass parameter. This length must be between 1 and 8 characters for a password or PassTicket or between 9 and 100 characters for a password phrase. A length of zero indicates that the Pass parameter is to be ignored and causes a SURROGAT class check.

So it could succeed with an empty password in cases when the server user ID passed the SURROGAT class check.

Since it is a highly unexpected behavior that is documented three levels below the org.zowe.commons.zos.security.platform.PlatformUser.authenticate() documentation, the org.zowe.commons.zos.security.platformPlatformUser.authenticate() will fail with errno EINVAL (121). If the SURROGAT class check is needed in future then it will be implemented a special method to prevent this confusion.

Resolves #72