Treat a zero-length password as a failuresssd-1_0_7

Some LDAP servers allow binding with blank passwords. We should
not allow a blank password to authenticate the SSSD.

1 files changed, 7 insertions, 0 deletions

diff --git a/server/providers/ldap/ldap_auth.c b/server/providers/ldap/ldap_auth.c
index 28b3240b3..5df4dbb43 100644
--- a/server/providers/ldap/ldap_auth.c
+++ b/server/providers/ldap/ldap_auth.c
@@ -458,6 +458,13 @@ static struct tevent_req *auth_send(TALLOC_CTX *memctx,
     req = tevent_req_create(memctx, &state, struct auth_state);
     if (!req) return NULL;
 
+    /* Treat a zero-length password as a failure */
+    if (password.length == 0) {
+        state->result = SDAP_AUTH_FAILED;
+        tevent_req_done(req);
+        return tevent_req_post(req, ev);
+    }
+
     state->ev = ev;
     state->ctx = ctx;
     state->username = username;