LDAP Authentication, returns true if the password is null

Question

LDAP Authentication, returns true if the password is null

Navigation

#1 by (1 votes)

0

LDAP authentication seems to have a bug.

Script

# Dados do servidor
$server = '192.168.0.1';
$domain = '@meudominio.dom';
$port    = 389;

# Dados para acesso
$auth_user = 'rbz';
$auth_pass = '123';

# Criando conexão
$ldap_conn = ldap_connect($server, $port) or exit('Erro na conexão');
if (!$ldap_conn) exit('Falha na conexão');

# Bind
$bind = @ldap_bind($ldap_conn, $auth_user.$domain, $auth_pass) or exit("Erro em bind");
if (!$bind) exit('Usuário e/ou senha incorreto(s)!');

Problem

If the value of $auth_pass is null , return is true. Independent of the user, or even null user.

Doubt

Why does @ldap_bind return true when the password is null ?
How to avoid this failure?

php

asked by anonymous 20.09.2018 / 21:22

1 answer

How to filter Combobox data using the Laravel Framework? Alternative to $ .html (''); to clean a div in Jquery

score 1 · Accepted Answer

As defined in the RFC 4513 .

5.1.1. Anonymous Authentication Mechanism of Simple Bind

An LDAP client may use the anonymous authentication mechanism of the simple Bind method to explicitly establish an anonymous authorization state by sending a request with a name value of zero length and specifying the simple authentication choice with a password value of zero length.

Translating, when using a valid credential (user) and using a zero-sized password (or without sending a password), an anonymous authorization is performed.

This authorization, from the LDAP perspective, is configured to be allowed and may be limited, as some operations may not be permitted through anonymous authentication.

You can configure the server to reject these types of settings or add password length validation together.

$bind = @ldap_bind($ldap_conn, $auth_user.$domain, $auth_pass) or exit("Erro em bind");
if (!$bind || strlen(trim($auth_pass)) == 0) exit('Usuário e/ou senha incorreto(s)!');

There are, in addition, other types of mechanisms such as the "Authentication Authentication Mechanism", where neither user nor password is used for bind:

5.1.2. Unauthenticated Authentication Mechanism of Simple Bind

An LDAP client may use the unauthenticated authentication mechanism of the simple Bind method to establish an anonymous authorization state by sending a request with a name value (a distinguished name in LDAP string form [RFC4514] of non-zero length) and specifying the simple authentication choice containing the password value of zero length.

If your LDAP server allows this, you should also configure or treat it in code.