opencadc/ac

Error message returned from ac service on account request leaks user information

Closed this issue · 1 comments

Currently when processing an account request and cadc-access-control-server finds a duplicate for the requested account, it returns an error message with specific account information. This results in user information leak. The following are examples of the returned error message:

user dn15985618998881 found in ou=userRequests,ou=ds,dc=canfar,dc=net

email address dn115985619007211@canada.ca for user dn215985619007211 found in ou=userRequests,ou=ds,dc=canfar,dc=net

Brian Major commented: No longer relevant.