UniStuttgart-VISUS/Visus.LdapAuthentication

Incorrect use of username/password on LdapOptionsExtensions.Connect for Visus.DirectoryAuthentication

Maxhy opened this issue · 2 comments

Maxhy commented

Affected library

  • Visus.LdapAuthentication
  • Visus.DirectoryAuthentication

Environment

  • Library version 0.8.0
  • OS: Windows 11
  • .NET: 8
  • LDAP Server: OpenLDAP

Summary
The use of username/password from method parameters or LdapOptions is inconsistent on Visus.DirectoryAuthentication implementation. On Visus.LdapAuthentication the code is using authentication information passed in parameters where here

Visus.LdapAuthentication/Visus.DirectoryAuthentication/LdapOptionsExtensions.cs

Line 91 in e558e1f

if ((that.User == null) && (that.Password == null)) {
and

Visus.LdapAuthentication/Visus.DirectoryAuthentication/LdapOptionsExtensions.cs

Line 97 in e558e1f

retval.Bind(new NetworkCredential(that.User, that.Password));
it is coded to use information from LdapOptions. It doesn't looks right to me.

crowbar27 commented

Thanks for pointing that out. That is actually critical.

crowbar27 commented

Fixed in 0.9.0

  • 👍1