mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-19 06:31:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

In LDAP, do not log username until we know the user exists.

Browse Source 
This prevents accidentally logging a password if the user enters it into the username field by mistake.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
This commit is contained in:
Matt Moyer
2021-05-28 16:57:48 -05:00
parent 854903c4ed
commit 7ee1f8c441
3 changed files with 22 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/ldap_client_test.go
+4 -4
View File
@@ -348,7 +348,7 @@ func TestLDAPSearch(t *testing.T) {
username: "pinny",
password: pinnyPassword,
provider: upstreamldap.New(*providerConfig(func(p *upstreamldap.ProviderConfig) { p.UserSearch.Filter = "*" })),
wantError: `error searching for user "pinny": LDAP Result Code 201 "Filter Compile Error": ldap: error parsing filter`,
wantError: `error searching for user: LDAP Result Code 201 "Filter Compile Error": ldap: error parsing filter`,
},
{
name: "when the group search filter does not compile",
@@ -364,7 +364,7 @@ func TestLDAPSearch(t *testing.T) {
provider: upstreamldap.New(*providerConfig(func(p *upstreamldap.ProviderConfig) {
p.UserSearch.Filter = "objectClass=*" // overly broad search filter
})),
wantError: `error searching for user "pinny": LDAP Result Code 4 "Size Limit Exceeded": `,
wantError: `error searching for user: LDAP Result Code 4 "Size Limit Exceeded": `,
},
{
name: "when the server is unreachable with TLS",
@@ -536,7 +536,7 @@ func TestLDAPSearch(t *testing.T) {
username: "pinny",
password: pinnyPassword,
provider: upstreamldap.New(*providerConfig(func(p *upstreamldap.ProviderConfig) { p.UserSearch.Base = "invalid-base" })),
wantError: `error searching for user "pinny": LDAP Result Code 34 "Invalid DN Syntax": invalid DN`,
wantError: `error searching for user: LDAP Result Code 34 "Invalid DN Syntax": invalid DN`,
},
{
name: "when the group search base is invalid",
@@ -550,7 +550,7 @@ func TestLDAPSearch(t *testing.T) {
username: "pinny",
password: pinnyPassword,
provider: upstreamldap.New(*providerConfig(func(p *upstreamldap.ProviderConfig) { p.UserSearch.Base = "ou=does-not-exist,dc=pinniped,dc=dev" })),
wantError: `error searching for user "pinny": LDAP Result Code 32 "No Such Object": `,
wantError: `error searching for user: LDAP Result Code 32 "No Such Object": `,
},
{
name: "when the group search base does not exist",