[#SEC-960] DN Encoding in LDAPUserDetailsManager.changePassword() causes bind errors - Spring Projects Issue Tracker

Spring Security

DN Encoding in LDAPUserDetailsManager.changePassword() causes bind errors

Created: 20/Aug/08 02:25 PM Updated: 30/Sep/08 07:59 AM Resolved: 05/Sep/08 08:51 AM

Component/s:

LDAP

Affects Version/s:

2.0.3

Fix Version/s:

2.0.4

Time Tracking:

Not Specified

File Attachments:

mylyn-context.zip (1 kB)

Description

« Hide

Please see the write-up here:

http://forum.springframework.org/showthread.php?t=53118

This prevents changepassword operations by binding as the user. Normally, binding as the admin to change the password will work, but certain LDAP directory servers (such as Novell eDirectory) have a policy that sets the user's account to expire after some small time period whenever an admin user changes a password. However, this side-effect is undesirable when it's actually the user changing the password.

Sort Order:

[ Permalink | « Hide ]

Luke Taylor added a comment - 05/Sep/08 08:51 AM - edited

I was able to reproduce this by adding a space to the ou that the test users were stored under for LdapUserDetailsManagerTests. The issue is that the toUrl() adds the escaping to the spaces (which is the wrong type of encoding in this context). I've replaced the call with a toString() when setting up the principal for authentication.