This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 42827afa4d Always use a simple bind to validate a user and password
via a bind
42827afa4d is described below
commit 42827afa4d073ac3d9f8b3cc81b857aa455bf1e6
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Sep 28 14:13:13 2026 +0100
Always use a simple bind to validate a user and password via a bind
---
java/org/apache/catalina/realm/JNDIRealm.java | 9 ++++-----
webapps/docs/changelog.xml | 5 +++++
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/java/org/apache/catalina/realm/JNDIRealm.java
b/java/org/apache/catalina/realm/JNDIRealm.java
index 888ee1e75c..396552c747 100644
--- a/java/org/apache/catalina/realm/JNDIRealm.java
+++ b/java/org/apache/catalina/realm/JNDIRealm.java
@@ -146,6 +146,7 @@ public class JNDIRealm extends RealmBase {
private static final String NULL_USER_ROLE_ATTRIBUTE_PLACEHOLDER =
"tomcat-unset-ignore";
private static final String AUTHENTICATION_NAME_GSSAPI = "GSSAPI";
+ private static final String AUTHENTICATION_NAME_SIMPLE = "simple";
/**
@@ -1977,10 +1978,8 @@ public class JNDIRealm extends RealmBase {
// Elicit an LDAP bind operation using the provided user credentials
try {
userCredentialsAdd(context, dn, credentials);
- // Need to make sure GSSAPI SASL authentication is not used if
configured
- if
(AUTHENTICATION_NAME_GSSAPI.equals(preservedEnvironment.get(Context.SECURITY_AUTHENTICATION)))
{
- context.removeFromEnvironment(Context.SECURITY_AUTHENTICATION);
- }
+ // Check credentials by performing a simple bind
+ context.addToEnvironment(Context.SECURITY_AUTHENTICATION,
AUTHENTICATION_NAME_SIMPLE);
if (containerLog.isTraceEnabled()) {
containerLog.trace(" binding as " + dn);
}
@@ -1991,7 +1990,7 @@ public class JNDIRealm extends RealmBase {
containerLog.trace(" bind attempt failed", e);
}
} finally {
- // Restore GSSAPI SASL if previously configured
+ // Restore any previously configured authentication mechanism
restoreEnvironmentParameter(context,
Context.SECURITY_AUTHENTICATION, preservedEnvironment);
userCredentialsRemove(context);
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index aeec28388f..b87bfa87de 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -150,6 +150,11 @@
<code>AprLifecycleListener</code> and throw an Error when FIPS is
requested but not available. (markt)
</fix>
+ <fix>
+ Ensure that, as per the documentation, a simple bind is always used
when
+ the JNDI realm binds using the user provided name and password to
+ authenticate the user. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Coyote">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
