nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Anyone can connect on LDAP, no user's password verification

potitius

Hello all,
I finally succeed to integrate Activiti with Ldap but unfortunately, when doing a random test I knew that anyone who know just the usersID can log in successfully by inserting a random password.

Why Activiti / LDAP is not checking the passwords ?

How can I fix this please ?

Thank you for your answers.
Best Regards.

Find more posts tagged with

Comments

potitius

Got some other bad news,

inserting just a random password without a username will lead to a successful authentification.

vasile_dirla

could you provide your LDAP settings ?

potitius

Attached you will find my LDAP Config.
Thank you.

ldapConfig.txt.zip

vasile_dirla

Just tested and I get this:
<code>
javax.naming.AuthenticationException: [LDAP: error code 49 - INVALID_CREDENTIALS: Bind failed: Cannot authenticate user …]
</code>
try adding a breakpoint here:
LDAPConnectionUtil.java
<code>
public static InitialDirContext createDirectoryContext(LDAPConfigurator ldapConfigurator, String principal, String credentials) {…}
</code>
and with the debugger you'll see step by step what's happening when bind operation is done.

And now the most important part

just check your ldap server configuration (maybe is not secured and just allow anyone to access it):
http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-BindPW.html