LdapIdentityStore successfully authenticates blank username and password

[hermida.leandro.hermida.gmail.com]

Hello,

I am testing the LdapIdentityStore feature from the latest Seam 2.1 from trunk and it seems to successfully authenticate a blank set of credentials.  Here is my setup as instructed in the docs:

components.xml:

<security:identity-manager identity-store="#{ldapIdentityStore}"/>

<security:ldap-identity-store server-address="myldapserver.fmi.ch"
                              bind-DN="cn=mysearchuser,ou=User,ou=FMI,dc=domain,dc=com"
                              bind-credentials="secret"
                              user-DN-prefix="sAMAccountName="
                              user-DN-suffix=",ou=User,ou=FMI,dc=domain,dc=com"
                              user-context-DN="ou=User,ou=FMI,dc=domain,dc=com"
                              role-DN-prefix="cn="
                              role-DN-suffix=",ou=group,ou=FMI,dc=domain,dc=com"
                              role-context-DN="ou=group,ou=FMI,dc=domain,dc=com"
                              user-role-attribute="memberOf"
                              role-name-attribute="cn"
                              user-object-classes="user"/>

Then the login form:

<h:form id="loginForm" styleClass="loginForm">
    <h:outputLabel for="loginUsername" value="Username:"/>
    <h:inputText id="loginUsername" value="#{credentials.username}"/>
    
    <h:outputLabel for="loginPassword" value="Password:"/>
    <h:inputSecret id="loginPassword" value="#{credentials.password}"/>
    
    <h:commandButton id="loginButton" action="#{identity.login}"
                     value="Login">
    </h:commandButton>
</h:form>

[shane.bryzak]

I've updated IdentityManager to reject empty usernames, however I'm still surprised that at least no exception was thrown for you.  I tried this with the seamspace example and it threw an LDAP exception.

[hermida.leandro.hermida.gmail.com]

Hi,

I will give this a try again with a new Seam Web Project using 2.1.0.GA and report back whether I get an LDAP exception or not.

leandro

[rogerwbmd]

I am also new to ldap authentication. I have same problem couple days ago. I fixed this by putting

<module-option name="allowEmptyPasswords">false</module-option>

in my ldap application-policy in login-config.xml.

The thing I don't understand is should we do the same thing in LdapIdentyStore. I have not used to it and I wonder if i can use it to pull information (like first name,email out of the ldap)

-Roger