This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/main by this push:
new 8906902f6d require a non-empty password for LDAP caller binds
8906902f6d is described below
commit 8906902f6d0c27f14a1b81d7d97dc51659f48602
Author: Markus Jung <[email protected]>
AuthorDate: Sun Aug 30 20:35:16 2026 +0200
require a non-empty password for LDAP caller binds
---
.../identitystore/TomEELDAPIdentityStore.java | 7 ++-
.../identitystore/TomEELDAPIdentityStoreTest.java | 52 ++++++++++++++++++++++
2 files changed, 58 insertions(+), 1 deletion(-)
diff --git
a/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java
b/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java
index 1a86913e14..c72e2385fc 100644
---
a/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java
+++
b/tomee/tomee-security/src/main/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStore.java
@@ -192,9 +192,14 @@ public class TomEELDAPIdentityStore implements
IdentityStore {
final UsernamePasswordCredential usernamePasswordCredential,
final String callerDn) {
+ final String password =
usernamePasswordCredential.getPasswordAsString();
+ if (StringUtils.isEmpty(password)) {
+ return false;
+ }
+
try {
// do a direct bind and see if an exception happens
- silentlyCloseLdapContext(lookup(definition.url(), callerDn,
usernamePasswordCredential.getPasswordAsString()));
+ silentlyCloseLdapContext(lookup(definition.url(), callerDn,
password));
return true;
} catch (final Exception e) {
diff --git
a/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java
b/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java
new file mode 100644
index 0000000000..4c8de4892a
--- /dev/null
+++
b/tomee/tomee-security/src/test/java/org/apache/tomee/security/identitystore/TomEELDAPIdentityStoreTest.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomee.security.identitystore;
+
+import jakarta.security.enterprise.credential.UsernamePasswordCredential;
+import jakarta.security.enterprise.identitystore.LdapIdentityStoreDefinition;
+import org.junit.Test;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+
+import static org.junit.Assert.assertFalse;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+public class TomEELDAPIdentityStoreTest {
+
+ @Test
+ public void emptyPasswordDoesNotBind() throws Exception {
+ final TomEELDAPIdentityStore store = new TomEELDAPIdentityStore();
+
+ final LdapIdentityStoreDefinition definition =
mock(LdapIdentityStoreDefinition.class);
+ final Field definitionField =
TomEELDAPIdentityStore.class.getDeclaredField("definition");
+ definitionField.setAccessible(true);
+ definitionField.set(store, definition);
+
+ final Method authenticate =
TomEELDAPIdentityStore.class.getDeclaredMethod(
+ "authenticateWithCallerDn", UsernamePasswordCredential.class,
String.class);
+ authenticate.setAccessible(true);
+
+ final boolean result = (Boolean) authenticate.invoke(store,
+ new UsernamePasswordCredential("user", ""),
"cn=user,ou=people,dc=example,dc=org");
+
+ assertFalse(result);
+ verify(definition, never()).url();
+ }
+}
