This is an automated email from the ASF dual-hosted git repository.
morningman pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris-website.git
The following commit(s) were added to refs/heads/master by this push:
new b403239b3f4 [enhance](auth) introduction of configuration property to
prohibit login with empty LDAP password (#3403)
b403239b3f4 is described below
commit b403239b3f4df47732ef23e90276b400e7b7951f
Author: iaorekhov-1980 <[email protected]>
AuthorDate: Thu Sep 17 11:44:38 2026 +0300
[enhance](auth) introduction of configuration property to prohibit login
with empty LDAP password (#3403)
This PR adds documentation for the option to disable login with empty
LDAP password introduced in code PR #60372.
Changes:
Added documentation for the new ldap_allow_empty_pass configuration
property in ldap.conf.
Updated the configuration examples in the relevant documentation files.
Documentation version coverage: The changes have been applied to
mentioned directories to cover the requested branches:
docs/ (latest),
versioned_docs/version-4.0/
Related PR: https://github.com/apache/doris/pull/61440
Issue: close https://github.com/apache/doris/issues/60353
## Versions
- [X] dev
- [X] 4.x
- [ ] 3.x
- [ ] 2.1
## Languages
- [ ] Chinese
- [X] English
## Docs Checklist
- [ ] Checked by AI
- [ ] Test Cases Built
---------
Co-authored-by: morningman <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
docs/admin-manual/auth/authentication/ldap.md | 49 +++++++++++++++++++++-
.../admin-manual/auth/authentication/ldap.md | 49 +++++++++++++++++++++-
.../admin-manual/auth/authentication/ldap.md | 49 +++++++++++++++++++++-
.../admin-manual/auth/authentication/ldap.md | 49 +++++++++++++++++++++-
4 files changed, 188 insertions(+), 8 deletions(-)
diff --git a/docs/admin-manual/auth/authentication/ldap.md
b/docs/admin-manual/auth/authentication/ldap.md
index 6ef9469f89a..5b5749da0c8 100644
--- a/docs/admin-manual/auth/authentication/ldap.md
+++ b/docs/admin-manual/auth/authentication/ldap.md
@@ -11,13 +11,15 @@
"unified authentication",
"ldap.conf configuration",
"ldap_default_roles",
+ "ldap_allow_empty_pass",
"MysqlClearPasswordPlugin",
"ldap_admin_password",
"ldap_use_ssl",
"SSLHandshakeException",
"PKIX path building failed",
"cleartext password plugin",
- "cleartext plugin"
+ "cleartext plugin",
+ "empty password login"
]
}
---
@@ -132,6 +134,7 @@ The configuration items are explained below:
| `ldap_user_filter` | User match filter. `{login}` is replaced with the login
user name |
| `ldap_group_basedn` | The base `dn` for group search, used for group
authorization |
| `ldap_default_roles` | Optional. Comma-separated Doris roles granted to
every LDAP-authenticated user. These roles are added in addition to LDAP group
roles (Supported since version 4.0.7 and 4.1.3) |
+| `ldap_allow_empty_pass` | Optional. Whether users that exist in LDAP may log
in with an empty password. Default `false`: Doris rejects empty-password logins
directly. Changing it requires an FE restart. See [Empty Password
Login](#empty-password-login) (Supported since version 4.1.5) |
:::tip
To enable LDAPS (encrypted connection to the LDAP server), see the [LDAPS
(Encrypted Connection)](#ldaps-encrypted-connection) section below.
@@ -236,6 +239,7 @@ After LDAP is enabled, the login behavior under different
user states is as foll
| Exists | Exists | Doris password | Failure | - |
| Does not exist | Exists | Doris password | Success | Doris user |
| Exists | Does not exist | LDAP password | Success | LDAP temporary user |
+| Exists | Any | Empty password | Failure by default (`ldap_allow_empty_pass =
false`) | - |
:::info About temporary users
@@ -246,6 +250,31 @@ After LDAP is enabled, the login behavior under different
user states is as foll
:::
+### Empty Password Login
+
+:::info Supported since version 4.1.5
+:::
+
+By default (`ldap_allow_empty_pass = false`), when a user that exists in LDAP
tries to log in with an empty password, Doris rejects the login directly with
an access-denied error and does not attempt to bind to the LDAP server with
that password. FE records a warning such as `Rejected LDAP login with empty
password, user=jack` in `fe.log`.
+
+The reason for this default is that the LDAP protocol treats a bind request
that carries a `dn` but an empty password as an *unauthenticated bind*, and
some directory servers (Active Directory, for example) accept such a bind and
report success. If Doris forwarded the empty password as is, anyone who knows a
valid LDAP user name could log in to Doris without a password. In versions
earlier than 4.1.5, Doris always forwarded the empty password to the LDAP
server, so whether such a login s [...]
+
+If you must keep the previous behavior, set the following in
`fe/conf/ldap.conf` and restart FE:
+
+```text
+ldap_allow_empty_pass = true
+```
+
+After that, Doris no longer checks for an empty password itself and forwards
the bind request to the LDAP server. Whether the login succeeds then depends on
whether the LDAP server accepts unauthenticated binds.
+
+:::caution
+
+- Enabling `ldap_allow_empty_pass` reopens the security risk described above.
Keep the default `false` in production environments.
+- `ldap_allow_empty_pass` cannot be modified online with `ADMIN SET FRONTEND
CONFIG`. Changing it requires an FE restart.
+- This configuration only affects users that exist in LDAP. Users that exist
only in Doris are still verified by the Doris local password.
+
+:::
+
### Login Examples
The following examples assume that LDAP authentication is enabled,
`ldap_user_filter = (&(uid={login}))` is configured, and the client has
`LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1` set.
@@ -287,6 +316,16 @@ The user does not exist in LDAP, so it falls back to Doris
local authentication.
mysql -hDoris_HOST -PDoris_PORT -ujack -p 123456
```
+**Scenario 4: An LDAP user logs in with an empty password**
+
+- LDAP user attributes: `uid: jack`, password: `abcdef`
+
+Log in without entering a password. With the default `ldap_allow_empty_pass =
false`, Doris rejects the login directly (see [Empty Password
Login](#empty-password-login)):
+
+```sql
+mysql -hDoris_HOST -PDoris_PORT -ujack
+```
+
## Group Authorization
<!-- Knowledge type: Behavior description -->
@@ -461,7 +500,7 @@ You can refresh the cache with the `refresh ldap`
statement. For details, see [R
## Frequently Asked Questions
<!-- Knowledge type: Troubleshooting -->
-<!-- Applicable scenario: Login failure / missing roles / LDAPS handshake
failure -->
+<!-- Applicable scenario: Login failure / empty-password login rejected /
missing roles / LDAPS handshake failure -->
### Q: How do I view which roles an LDAP user has in Doris?
@@ -479,6 +518,12 @@ Check the following items one by one:
4. Check whether the `member` attribute of the expected `group` contains the
`dn` of the current user.
5. If the missing role is configured in `ldap_default_roles`, check whether
the role name is spelled correctly and whether the role exists in Doris.
+### Q: An LDAP user could log in with an empty password before, but the login
fails after upgrading. Why?
+
+Starting from version 4.1.5, Doris rejects empty-password logins from users
that exist in LDAP by default (`ldap_allow_empty_pass = false`), because some
LDAP servers treat a bind with an empty password as a successful
unauthenticated bind. Such attempts are recorded in `fe.log` as `Rejected LDAP
login with empty password`.
+
+Ask the user to log in with the LDAP password. If you must keep the previous
behavior, set `ldap_allow_empty_pass = true` in `fe/conf/ldap.conf` and restart
FE. This is not recommended for production environments. For details, see
[Empty Password Login](#empty-password-login).
+
### Q: LDAPS connection fails. How do I troubleshoot?
Check the following items one by one:
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authentication/ldap.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authentication/ldap.md
index 177123e464b..c522ee75981 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authentication/ldap.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/current/admin-manual/auth/authentication/ldap.md
@@ -11,13 +11,15 @@
"统一身份验证",
"ldap.conf 配置",
"ldap_default_roles",
+ "ldap_allow_empty_pass",
"MysqlClearPasswordPlugin",
"ldap_admin_password",
"ldap_use_ssl",
"SSLHandshakeException",
"PKIX path building failed",
"明文密码插件",
- "cleartext plugin"
+ "cleartext plugin",
+ "空密码登录"
]
}
---
@@ -132,6 +134,7 @@ ldap_default_roles = ldap_readonly,ldap_query_user
| `ldap_user_filter` | 用户匹配过滤器，`{login}` 会被替换为登录用户名 |
| `ldap_group_basedn` | 组搜索的基准 `dn`，用于组授权 |
| `ldap_default_roles` | 可选。为所有 LDAP 认证用户授予的 Doris 角色，多个角色用逗号分隔。这些角色会在 LDAP
组角色之外额外授予（自 4.0.7、4.1.3 版本开始支持） |
+| `ldap_allow_empty_pass` | 可选。是否允许 LDAP 中存在的用户使用空密码登录。默认为 `false`，即 Doris
直接拒绝空密码登录。修改后需要重启 FE 才能生效，详见[空密码登录](#空密码登录)（自 4.1.5 版本开始支持） |
:::tip
如需启用 LDAPS（加密连接至 LDAP 服务器），请参阅下文 [LDAPS（加密连接）](#ldaps加密连接) 章节。
@@ -236,6 +239,7 @@ LDAP 验证登录是指通过 LDAP 服务进行密码验证，以补充 Doris
| 存在 | 存在 | Doris 密码 | 失败 | - |
| 不存在 | 存在 | Doris 密码 | 成功 | Doris 用户 |
| 存在 | 不存在 | LDAP 密码 | 成功 | LDAP 临时用户 |
+| 存在 | 任意 | 空密码 | 默认失败（`ldap_allow_empty_pass = false`） | - |
:::info 关于临时用户
@@ -246,6 +250,31 @@ LDAP 验证登录是指通过 LDAP 服务进行密码验证，以补充 Doris
:::
+### 空密码登录
+
+:::info 自 4.1.5 版本开始支持
+:::
+
+默认情况下（`ldap_allow_empty_pass = false`），当 LDAP 中存在的用户使用空密码登录时，Doris
会直接拒绝本次登录并返回 Access denied 错误，不会再使用该密码向 LDAP 服务器发起绑定请求。FE 会在 `fe.log` 中记录类似
`Rejected LDAP login with empty password, user=jack` 的 warning 日志。
+
+之所以默认拒绝，是因为 LDAP 协议会将携带 `dn` 但密码为空的绑定请求视为未认证绑定（unauthenticated
bind），部分目录服务器（例如 Active Directory）会接受这类请求并返回成功。如果 Doris 将空密码原样转发给 LDAP
服务器，任何知道有效 LDAP 用户名的人都可以不输入密码登录 Doris。在 4.1.5 之前的版本中，Doris 总是将空密码原样转发给 LDAP
服务器，此时能否登录完全取决于 LDAP 服务器的配置。
+
+如果必须保留之前的行为，可以在 `fe/conf/ldap.conf` 中设置以下配置并重启 FE：
+
+```text
+ldap_allow_empty_pass = true
+```
+
+此时 Doris 不再自行检查空密码，而是将绑定请求转发给 LDAP 服务器，登录能否成功取决于 LDAP 服务器是否接受未认证绑定。
+
+:::caution
+
+- 开启 `ldap_allow_empty_pass` 会重新引入上述安全风险，生产环境请保持默认值 `false`。
+- `ldap_allow_empty_pass` 不支持通过 `ADMIN SET FRONTEND CONFIG` 在线修改，修改后必须重启 FE
才能生效。
+- 该配置只影响 LDAP 中存在的用户。仅在 Doris 中存在的用户仍然使用 Doris 本地密码验证。
+
+:::
+
### 登录示例
以下示例假设已开启 LDAP 认证，配置 `ldap_user_filter = (&(uid={login}))`，且客户端已设置
`LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1`。
@@ -287,6 +316,16 @@ LDAP 中不存在该用户，回退到 Doris 本地认证，使用 Doris 密码
mysql -hDoris_HOST -PDoris_PORT -ujack -p 123456
```
+**场景四：LDAP 用户使用空密码登录**
+
+- LDAP 用户属性：`uid: jack`，密码：`abcdef`
+
+不输入密码直接登录。在默认配置 `ldap_allow_empty_pass = false` 下，Doris
直接拒绝登录（详见[空密码登录](#空密码登录)）：
+
+```sql
+mysql -hDoris_HOST -PDoris_PORT -ujack
+```
+
## 组授权
<!-- 知识类型: 行为说明 -->
@@ -461,7 +500,7 @@ JAVA_OPTS_FOR_JDK_17 =
"-Djavax.net.ssl.trustStore=/path/to/your/cacerts -Djavax
## 常见问题
<!-- 知识类型: 故障排查 -->
-<!-- 适用场景: 登录失败 / 角色缺失 / LDAPS 握手失败 -->
+<!-- 适用场景: 登录失败 / 空密码登录被拒绝 / 角色缺失 / LDAPS 握手失败 -->
### Q: 如何查看 LDAP 用户在 Doris 中拥有哪些角色？
@@ -479,6 +518,12 @@ JAVA_OPTS_FOR_JDK_17 =
"-Djavax.net.ssl.trustStore=/path/to/your/cacerts -Djavax
4. 检查预期 `group` 的 `member` 属性中是否包含当前用户的 `dn`。
5. 如果缺少的是 `ldap_default_roles` 中配置的角色，检查角色名是否拼写正确，以及该角色是否已经在 Doris 中创建。
+### Q: LDAP 用户之前可以使用空密码登录，升级后登录失败，为什么？
+
+自 4.1.5 版本起，Doris 默认拒绝 LDAP 中存在的用户使用空密码登录（`ldap_allow_empty_pass =
false`），因为部分 LDAP 服务器会将空密码绑定视为成功的未认证绑定。此类登录尝试会在 `fe.log` 中记录 `Rejected LDAP
login with empty password`。
+
+请让用户使用 LDAP 密码登录。如果必须保留之前的行为，可以在 `fe/conf/ldap.conf` 中设置
`ldap_allow_empty_pass = true` 并重启 FE，但不建议在生产环境中这样做。详见[空密码登录](#空密码登录)。
+
### Q: LDAPS 连接失败，如何排查？
按以下步骤逐项检查：
diff --git
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-4.x/admin-manual/auth/authentication/ldap.md
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-4.x/admin-manual/auth/authentication/ldap.md
index 177123e464b..c522ee75981 100644
---
a/i18n/zh-CN/docusaurus-plugin-content-docs/version-4.x/admin-manual/auth/authentication/ldap.md
+++
b/i18n/zh-CN/docusaurus-plugin-content-docs/version-4.x/admin-manual/auth/authentication/ldap.md
@@ -11,13 +11,15 @@
"统一身份验证",
"ldap.conf 配置",
"ldap_default_roles",
+ "ldap_allow_empty_pass",
"MysqlClearPasswordPlugin",
"ldap_admin_password",
"ldap_use_ssl",
"SSLHandshakeException",
"PKIX path building failed",
"明文密码插件",
- "cleartext plugin"
+ "cleartext plugin",
+ "空密码登录"
]
}
---
@@ -132,6 +134,7 @@ ldap_default_roles = ldap_readonly,ldap_query_user
| `ldap_user_filter` | 用户匹配过滤器，`{login}` 会被替换为登录用户名 |
| `ldap_group_basedn` | 组搜索的基准 `dn`，用于组授权 |
| `ldap_default_roles` | 可选。为所有 LDAP 认证用户授予的 Doris 角色，多个角色用逗号分隔。这些角色会在 LDAP
组角色之外额外授予（自 4.0.7、4.1.3 版本开始支持） |
+| `ldap_allow_empty_pass` | 可选。是否允许 LDAP 中存在的用户使用空密码登录。默认为 `false`，即 Doris
直接拒绝空密码登录。修改后需要重启 FE 才能生效，详见[空密码登录](#空密码登录)（自 4.1.5 版本开始支持） |
:::tip
如需启用 LDAPS（加密连接至 LDAP 服务器），请参阅下文 [LDAPS（加密连接）](#ldaps加密连接) 章节。
@@ -236,6 +239,7 @@ LDAP 验证登录是指通过 LDAP 服务进行密码验证，以补充 Doris
| 存在 | 存在 | Doris 密码 | 失败 | - |
| 不存在 | 存在 | Doris 密码 | 成功 | Doris 用户 |
| 存在 | 不存在 | LDAP 密码 | 成功 | LDAP 临时用户 |
+| 存在 | 任意 | 空密码 | 默认失败（`ldap_allow_empty_pass = false`） | - |
:::info 关于临时用户
@@ -246,6 +250,31 @@ LDAP 验证登录是指通过 LDAP 服务进行密码验证，以补充 Doris
:::
+### 空密码登录
+
+:::info 自 4.1.5 版本开始支持
+:::
+
+默认情况下（`ldap_allow_empty_pass = false`），当 LDAP 中存在的用户使用空密码登录时，Doris
会直接拒绝本次登录并返回 Access denied 错误，不会再使用该密码向 LDAP 服务器发起绑定请求。FE 会在 `fe.log` 中记录类似
`Rejected LDAP login with empty password, user=jack` 的 warning 日志。
+
+之所以默认拒绝，是因为 LDAP 协议会将携带 `dn` 但密码为空的绑定请求视为未认证绑定（unauthenticated
bind），部分目录服务器（例如 Active Directory）会接受这类请求并返回成功。如果 Doris 将空密码原样转发给 LDAP
服务器，任何知道有效 LDAP 用户名的人都可以不输入密码登录 Doris。在 4.1.5 之前的版本中，Doris 总是将空密码原样转发给 LDAP
服务器，此时能否登录完全取决于 LDAP 服务器的配置。
+
+如果必须保留之前的行为，可以在 `fe/conf/ldap.conf` 中设置以下配置并重启 FE：
+
+```text
+ldap_allow_empty_pass = true
+```
+
+此时 Doris 不再自行检查空密码，而是将绑定请求转发给 LDAP 服务器，登录能否成功取决于 LDAP 服务器是否接受未认证绑定。
+
+:::caution
+
+- 开启 `ldap_allow_empty_pass` 会重新引入上述安全风险，生产环境请保持默认值 `false`。
+- `ldap_allow_empty_pass` 不支持通过 `ADMIN SET FRONTEND CONFIG` 在线修改，修改后必须重启 FE
才能生效。
+- 该配置只影响 LDAP 中存在的用户。仅在 Doris 中存在的用户仍然使用 Doris 本地密码验证。
+
+:::
+
### 登录示例
以下示例假设已开启 LDAP 认证，配置 `ldap_user_filter = (&(uid={login}))`，且客户端已设置
`LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1`。
@@ -287,6 +316,16 @@ LDAP 中不存在该用户，回退到 Doris 本地认证，使用 Doris 密码
mysql -hDoris_HOST -PDoris_PORT -ujack -p 123456
```
+**场景四：LDAP 用户使用空密码登录**
+
+- LDAP 用户属性：`uid: jack`，密码：`abcdef`
+
+不输入密码直接登录。在默认配置 `ldap_allow_empty_pass = false` 下，Doris
直接拒绝登录（详见[空密码登录](#空密码登录)）：
+
+```sql
+mysql -hDoris_HOST -PDoris_PORT -ujack
+```
+
## 组授权
<!-- 知识类型: 行为说明 -->
@@ -461,7 +500,7 @@ JAVA_OPTS_FOR_JDK_17 =
"-Djavax.net.ssl.trustStore=/path/to/your/cacerts -Djavax
## 常见问题
<!-- 知识类型: 故障排查 -->
-<!-- 适用场景: 登录失败 / 角色缺失 / LDAPS 握手失败 -->
+<!-- 适用场景: 登录失败 / 空密码登录被拒绝 / 角色缺失 / LDAPS 握手失败 -->
### Q: 如何查看 LDAP 用户在 Doris 中拥有哪些角色？
@@ -479,6 +518,12 @@ JAVA_OPTS_FOR_JDK_17 =
"-Djavax.net.ssl.trustStore=/path/to/your/cacerts -Djavax
4. 检查预期 `group` 的 `member` 属性中是否包含当前用户的 `dn`。
5. 如果缺少的是 `ldap_default_roles` 中配置的角色，检查角色名是否拼写正确，以及该角色是否已经在 Doris 中创建。
+### Q: LDAP 用户之前可以使用空密码登录，升级后登录失败，为什么？
+
+自 4.1.5 版本起，Doris 默认拒绝 LDAP 中存在的用户使用空密码登录（`ldap_allow_empty_pass =
false`），因为部分 LDAP 服务器会将空密码绑定视为成功的未认证绑定。此类登录尝试会在 `fe.log` 中记录 `Rejected LDAP
login with empty password`。
+
+请让用户使用 LDAP 密码登录。如果必须保留之前的行为，可以在 `fe/conf/ldap.conf` 中设置
`ldap_allow_empty_pass = true` 并重启 FE，但不建议在生产环境中这样做。详见[空密码登录](#空密码登录)。
+
### Q: LDAPS 连接失败，如何排查？
按以下步骤逐项检查：
diff --git
a/versioned_docs/version-4.x/admin-manual/auth/authentication/ldap.md
b/versioned_docs/version-4.x/admin-manual/auth/authentication/ldap.md
index 6ef9469f89a..5b5749da0c8 100644
--- a/versioned_docs/version-4.x/admin-manual/auth/authentication/ldap.md
+++ b/versioned_docs/version-4.x/admin-manual/auth/authentication/ldap.md
@@ -11,13 +11,15 @@
"unified authentication",
"ldap.conf configuration",
"ldap_default_roles",
+ "ldap_allow_empty_pass",
"MysqlClearPasswordPlugin",
"ldap_admin_password",
"ldap_use_ssl",
"SSLHandshakeException",
"PKIX path building failed",
"cleartext password plugin",
- "cleartext plugin"
+ "cleartext plugin",
+ "empty password login"
]
}
---
@@ -132,6 +134,7 @@ The configuration items are explained below:
| `ldap_user_filter` | User match filter. `{login}` is replaced with the login
user name |
| `ldap_group_basedn` | The base `dn` for group search, used for group
authorization |
| `ldap_default_roles` | Optional. Comma-separated Doris roles granted to
every LDAP-authenticated user. These roles are added in addition to LDAP group
roles (Supported since version 4.0.7 and 4.1.3) |
+| `ldap_allow_empty_pass` | Optional. Whether users that exist in LDAP may log
in with an empty password. Default `false`: Doris rejects empty-password logins
directly. Changing it requires an FE restart. See [Empty Password
Login](#empty-password-login) (Supported since version 4.1.5) |
:::tip
To enable LDAPS (encrypted connection to the LDAP server), see the [LDAPS
(Encrypted Connection)](#ldaps-encrypted-connection) section below.
@@ -236,6 +239,7 @@ After LDAP is enabled, the login behavior under different
user states is as foll
| Exists | Exists | Doris password | Failure | - |
| Does not exist | Exists | Doris password | Success | Doris user |
| Exists | Does not exist | LDAP password | Success | LDAP temporary user |
+| Exists | Any | Empty password | Failure by default (`ldap_allow_empty_pass =
false`) | - |
:::info About temporary users
@@ -246,6 +250,31 @@ After LDAP is enabled, the login behavior under different
user states is as foll
:::
+### Empty Password Login
+
+:::info Supported since version 4.1.5
+:::
+
+By default (`ldap_allow_empty_pass = false`), when a user that exists in LDAP
tries to log in with an empty password, Doris rejects the login directly with
an access-denied error and does not attempt to bind to the LDAP server with
that password. FE records a warning such as `Rejected LDAP login with empty
password, user=jack` in `fe.log`.
+
+The reason for this default is that the LDAP protocol treats a bind request
that carries a `dn` but an empty password as an *unauthenticated bind*, and
some directory servers (Active Directory, for example) accept such a bind and
report success. If Doris forwarded the empty password as is, anyone who knows a
valid LDAP user name could log in to Doris without a password. In versions
earlier than 4.1.5, Doris always forwarded the empty password to the LDAP
server, so whether such a login s [...]
+
+If you must keep the previous behavior, set the following in
`fe/conf/ldap.conf` and restart FE:
+
+```text
+ldap_allow_empty_pass = true
+```
+
+After that, Doris no longer checks for an empty password itself and forwards
the bind request to the LDAP server. Whether the login succeeds then depends on
whether the LDAP server accepts unauthenticated binds.
+
+:::caution
+
+- Enabling `ldap_allow_empty_pass` reopens the security risk described above.
Keep the default `false` in production environments.
+- `ldap_allow_empty_pass` cannot be modified online with `ADMIN SET FRONTEND
CONFIG`. Changing it requires an FE restart.
+- This configuration only affects users that exist in LDAP. Users that exist
only in Doris are still verified by the Doris local password.
+
+:::
+
### Login Examples
The following examples assume that LDAP authentication is enabled,
`ldap_user_filter = (&(uid={login}))` is configured, and the client has
`LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1` set.
@@ -287,6 +316,16 @@ The user does not exist in LDAP, so it falls back to Doris
local authentication.
mysql -hDoris_HOST -PDoris_PORT -ujack -p 123456
```
+**Scenario 4: An LDAP user logs in with an empty password**
+
+- LDAP user attributes: `uid: jack`, password: `abcdef`
+
+Log in without entering a password. With the default `ldap_allow_empty_pass =
false`, Doris rejects the login directly (see [Empty Password
Login](#empty-password-login)):
+
+```sql
+mysql -hDoris_HOST -PDoris_PORT -ujack
+```
+
## Group Authorization
<!-- Knowledge type: Behavior description -->
@@ -461,7 +500,7 @@ You can refresh the cache with the `refresh ldap`
statement. For details, see [R
## Frequently Asked Questions
<!-- Knowledge type: Troubleshooting -->
-<!-- Applicable scenario: Login failure / missing roles / LDAPS handshake
failure -->
+<!-- Applicable scenario: Login failure / empty-password login rejected /
missing roles / LDAPS handshake failure -->
### Q: How do I view which roles an LDAP user has in Doris?
@@ -479,6 +518,12 @@ Check the following items one by one:
4. Check whether the `member` attribute of the expected `group` contains the
`dn` of the current user.
5. If the missing role is configured in `ldap_default_roles`, check whether
the role name is spelled correctly and whether the role exists in Doris.
+### Q: An LDAP user could log in with an empty password before, but the login
fails after upgrading. Why?
+
+Starting from version 4.1.5, Doris rejects empty-password logins from users
that exist in LDAP by default (`ldap_allow_empty_pass = false`), because some
LDAP servers treat a bind with an empty password as a successful
unauthenticated bind. Such attempts are recorded in `fe.log` as `Rejected LDAP
login with empty password`.
+
+Ask the user to log in with the LDAP password. If you must keep the previous
behavior, set `ldap_allow_empty_pass = true` in `fe/conf/ldap.conf` and restart
FE. This is not recommended for production environments. For details, see
[Empty Password Login](#empty-password-login).
+
### Q: LDAPS connection fails. How do I troubleshoot?
Check the following items one by one:
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
