morningman opened a new pull request, #68099:
URL: https://github.com/apache/doris/pull/68099
Cherry-picked from #61440 (master commit d715350c96b) to branch-4.2.
### What problem does this PR solve?
Issue Number: close #60353
Related PR: #61440
Problem Summary:
The legacy LDAP authentication path accepted an empty password: LDAP reports
a bind with a non-empty DN and an empty password as a successful
*unauthenticated* bind, so anyone who knew a valid LDAP user name could log in
to Doris without a password.
This adds the `ldap_allow_empty_pass` FE config (`ldap.conf`, default
`false`). `LdapManager.checkUserPasswd` now rejects an empty password up front,
before the cached-password comparison and the LDAP bind, so a previously cached
empty password cannot short-circuit the check either. Setting
`ldap_allow_empty_pass = true` restores the legacy behaviour. The plugin-based
LDAP authentication (fe-authentication LDAP plugin) already rejects empty
passwords and is not affected.
Conflict resolution: only `LdapManagerTest.java` conflicted. branch-4.2
carries two extra tests
(`testCheckUserPasswdCachedPasswdMatchLogsInfoWithoutThreshold`,
`testGetUserInfoLogsInfoWithoutThreshold`) at the position where master
inserted the new tests; the new tests are placed right after
`testCheckUserPasswd()` and the branch tests are left untouched. The added
lines are identical to the master commit.
### Release note
New `ldap_allow_empty_pass` property in `ldap.conf` for the legacy LDAP
authentication path. Login with an empty LDAP password is now rejected by
default; set it to `true` to restore the previous behaviour.
### Check List (For Author)
- Test <!-- At least one of them must be included. -->
- [ ] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason <!-- Add your reason? -->
- Behavior changed:
- [ ] No.
- [x] Yes. Empty LDAP passwords are rejected by default on the legacy
LDAP path; `ldap_allow_empty_pass = true` opts back in.
- Does this need documentation?
- [ ] No.
- [x] Yes. https://github.com/apache/doris-website/pull/3403
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label <!-- Add branch pick label that this PR should
merge into -->
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
