mirror of
https://github.com/apache/doris.git
synced 2026-11-04 07:31:17 +00:00
d715350c96
### What problem does this PR solve? This PR adds new configuration property **ldap_allow_empty_pass** to prohibit option for existing user to login into LDAP with empty password. It doesn't impact new approach from #60407 , because since 4.1.x new LDAP plugin explicitly prohibits login with empty pass. But in legacy version - 3.1.x and 4.0.x such option is still available. If **ldap_allow_empty_pass** in ldap.conf is not specified or specified as **false** - user can't login with empty pass (new behavior, aligned with newly introduced plugin authentication). If **ldap_allow_empty_pass** specified as **true** - login attempt with empty password will be possible as legacy behavior. **Could you please include this PR into 4.x branch, please!** Issue Number: close #60353 Related PR: #xxx Problem Summary: Currently for existing user it is possible to login into LDAP with empty password. New configuration property disables such option, but user is still able to activate legacy behavior and allow login without specified password. ### Release note New **ldap_allow_empty_pass** property for legacy authentication approach was introduced into ldap.conf to prohibit login with empty LDAP password as it is allowed by LDAP protocol by default. ### Check List (For Author) - Test <!-- At least one of them must be included. --> - [ ] Regression test - [x] Unit Test - [ ] Manual test (add detailed scripts or steps below) - [ ] No need to test or manual test. Explain why: - [ ] This is a refactor/code format and no logic has been changed. - [ ] Previous test can cover this change. - [ ] No code files have been changed. - [ ] Other reason <!-- Add your reason? --> - Behavior changed: - [ ] No. - [x] Yes. <!-- Explain the behavior change --> 1. ldap.conf and LdapConfig.java - new configuration **ldap_allow_empty_pass** property with default value **false** to disable login with empty LDAP password as in latest plugin implementation. 2. LdapManager.java - added logic to prohibit login with empty LDAP password and placed it into separate method, which is invoked from already existing checkUserPasswd 3.1 user has specified empty password 3.2 property **ldap_allow_empty_pass** is **false** and doesn't allow to login with empty password If both conditions met - authentication is failed and false is returning, as by other check in checkUserPassword 4. LdapManagerTest.java - introduced set of test methods to validate for existing behavior (with **ldap_allow_empty_pass** = true) and new one (with **ldap_allow_empty_pass** property is not specified or specified to false) to check that login is still successful in first case and failed in the second one. - Does this need documentation? - [ ] No. - [x] Yes. [apache/doris-website/pull/3403] ### Check List (For Reviewer who merge this PR) - [ ] Confirm the release note - [ ] Confirm test cases - [ ] Confirm document - [ ] Add branch pick label <!-- Add branch pick label that this PR should merge into --> --------- Co-authored-by: morningman <yunyou@selectdb.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
77 lines
3.7 KiB
Plaintext
77 lines
3.7 KiB
Plaintext
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
#####################################################################
|
|
## To see all LDAP configurations,
|
|
## see fe/src/org/apache/doris/common/LdapConfig.java
|
|
#####################################################################
|
|
|
|
# LDAP server configuration
|
|
# If you want to enable LDAP authentication, you should:
|
|
## step1: Configure the following parameters:
|
|
# ldap_authentication_enabled - Flag to enable LDAP authentication. Specify 'true' to enable ldap authentication.
|
|
# ldap_host - LDAP server ip.
|
|
# ldap_port - LDAP server port.
|
|
# ldap_admin_name - The DN to bind as connection, this admin DN will be used to lookup information about other users.
|
|
# ldap_user_basedn - Search base for users.
|
|
# ldap_user_filter - User lookup filter, the placeholder {login} will be replaced by the user supplied login.
|
|
# ldap_group_basedn - Search base for groups.
|
|
# ldap_group_filter - Group lookup filter, the placeholder {login} will be replaced by the user supplied login. example : "(&(memberUid={login}))"
|
|
# ldap_default_roles - Comma-separated Doris roles granted to every LDAP-authenticated user.
|
|
# Online updates of ldap_default_roles refresh the LDAP user cache automatically.
|
|
## step2: Restart fe, and use root or admin account to log in to doris.
|
|
## step3: Execute sql statement to set ldap admin password:
|
|
# set ldap_admin_password = 'password';
|
|
ldap_authentication_enabled = false
|
|
ldap_host = 127.0.0.1
|
|
ldap_port = 389
|
|
ldap_admin_name = cn=admin,dc=domain,dc=com
|
|
ldap_user_basedn = ou=people,dc=domain,dc=com
|
|
ldap_user_filter = (&(uid={login}))
|
|
ldap_group_basedn = ou=group,dc=domain,dc=com
|
|
# ldap_default_roles = ldap_default_role
|
|
|
|
# ldap_user_cache_timeout_s = 5 * 60;
|
|
|
|
## ldap_use_ssl - use secured connection to LDAP server if required (disabled by default). Note: When enabling SSL, ensure ldap_port is set appropriately (typically 636 for LDAPS instead of 389 for LDAP).
|
|
# ldap_use_ssl = false
|
|
|
|
## ldap_allow_empty_pass - allow LDAP users to log in with an empty password. Disabled by default.
|
|
##
|
|
## LDAP treats a bind with a non-empty DN and an empty password as an unauthenticated bind and
|
|
## normally reports it as successful, so with this enabled anyone who knows a valid LDAP user
|
|
## name can log in to Doris without a password. Keep it false unless you must restore the
|
|
## legacy behaviour; setting it to true reopens that hole.
|
|
##
|
|
## Changing this requires an FE restart (the config is not runtime-mutable).
|
|
##
|
|
## This setting applies to the legacy LDAP authentication path only. The plugin-based LDAP
|
|
## authentication (the fe-authentication LDAP plugin) always rejects empty passwords.
|
|
# ldap_allow_empty_pass = false
|
|
|
|
# LDAP pool configuration
|
|
# https://docs.spring.io/spring-ldap/docs/2.3.3.RELEASE/reference/#pool-configuration
|
|
# ldap_pool_max_active = 8
|
|
# ldap_pool_max_total = -1
|
|
# ldap_pool_max_idle = 8
|
|
# ldap_pool_min_idle = 0
|
|
# ldap_pool_max_wait = -1
|
|
# ldap_pool_when_exhausted = 1
|
|
# ldap_pool_test_on_borrow = true
|
|
# ldap_pool_test_on_return = true
|
|
# ldap_pool_test_while_idle = true
|