Project

General

Profile

Actions

Bug #408

closed

Authentication is by-passed when a client follows an LDAP referral

Added by Chris Jones almost 23 years ago. Updated over 22 years ago.

Status:
Resolved
Priority:
Immediate
Assignee:
Category:
metacat
Target version:
Start date:
02/01/2002
Due date:
% Done:

0%

Estimated time:
Bugzilla-Id:
408

Description

The ldap.ecoinformatics.org LDAP database services the dc=ecoinformatics,dc=org
tree, but is extended by LDAP referral objects that point to external LDAP
servers (e.g. dc=lter,dc=ecoinformatics,dc=org and dc=piscoweb,dc=org). When a
client (Morpho or web client) attempts to authenticate against ldap (via
metacat), if the user exists in one of the referred trees, authentication will
succeed, whether the password is correct or not. If the user entry is within
the main dc=ecoinformatics,dc=org tree, authentication will correctly fail if
the password is incorrect.

Actions

Also available in: Atom PDF