[
https://issues.apache.org/jira/browse/DIRAPI-472?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120603#comment-18120603
]
Emmanuel Lécharny commented on DIRAPI-472:
------------------------------------------
Found by Claude
> Pooled connections keep previous borrower's bind identity with default factory
> ------------------------------------------------------------------------------
>
> Key: DIRAPI-472
> URL: https://issues.apache.org/jira/browse/DIRAPI-472
> Project: Directory Client API
> Issue Type: Bug
> Affects Versions: 2.1.8
> Reporter: Emmanuel Lécharny
> Priority: Minor
> Fix For: 2.1.9
>
>
> An app pools with _DefaultPoolableLdapConnectionFactory_ and uses the pool
> both for service-account operations and to verify user passwords by binding.
> User _Mallory_ authenticates and the connection returns to the pool bound as
> _Mallory_.
> The next request borrows it for an administrative modify, which executes as
> _Mallory_ — failing *ACI* checks at best, or silently running under the wrong
> authorization context; conversely a later user-facing request may inherit a
> privileged identity a prior borrower established.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
