Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-5787

AdvancedLdapLoginModule does not handle loops in referrals

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Critical Critical
    • None
    • 10.0.0.CR4
    • Security
    • None
    • Hide

      1) Start two LDAP servers which use attached server1.ldif and server2.ldif
      2) Add following security domain to configuration:

      <security-domain name="ldapSecurityDomain">
    <authentication>
        <login-module code="AdvancedLdap" flag="required">
            <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
            <module-option name="java.naming.provider.url" value="ldap://localhost:10389"/>
            <module-option name="referralUserAttributeIDToCheck" value="member"/>
            <module-option name="roleFilter" value="(|(objectClass=referral)(member={1}))"/>
            <module-option name="roleAttributeID" value="cn"/>
            <module-option name="rolesCtxDN" value="ou=Roles,dc=jboss,dc=org"/>
            <module-option name="java.naming.security.authentication" value="simple"/>
            <module-option name="bindDN" value="uid=admin,ou=system"/>
            <module-option name="bindCredential" value="secret"/>
            <module-option name="baseCtxDN" value="ou=People,dc=jboss,dc=org"/>
            <module-option name="java.naming.referral" value="throw"/>
            <module-option name="throwValidateError" value="true"/>
            <module-option name="baseFilter" value="(uid={0})"/>
        </login-module>
    </authentication>
</security-domain>

      3) Deploy attached application app.war
      4) Run periodically

      curl -u jduke:Password1 http://localhost:8080/app/protected/printRoles?role=TheDuke&role=Admin

      -> java.lang.OutOfMemoryError on Wildfly server

      Show
      1) Start two LDAP servers which use attached server1.ldif and server2.ldif 2) Add following security domain to configuration: <security-domain name= "ldapSecurityDomain" > <authentication> <login-module code= "AdvancedLdap" flag= "required" > <module-option name= "java.naming.factory.initial" value= "com.sun.jndi.ldap.LdapCtxFactory" /> <module-option name= "java.naming.provider.url" value= "ldap://localhost:10389" /> <module-option name= "referralUserAttributeIDToCheck" value= "member" /> <module-option name= "roleFilter" value= "(|(objectClass=referral)(member={1}))" /> <module-option name= "roleAttributeID" value= "cn" /> <module-option name= "rolesCtxDN" value= "ou=Roles,dc=jboss,dc=org" /> <module-option name= "java.naming.security.authentication" value= "simple" /> <module-option name= "bindDN" value= "uid=admin,ou=system" /> <module-option name= "bindCredential" value= "secret" /> <module-option name= "baseCtxDN" value= "ou=People,dc=jboss,dc=org" /> <module-option name= "java.naming.referral" value= "throw" /> <module-option name= "throwValidateError" value= "true" /> <module-option name= "baseFilter" value= "(uid={0})" /> </login-module> </authentication> </security-domain> 3) Deploy attached application app.war 4) Run periodically curl -u jduke:Password1 http://localhost:8080/app/protected/printRoles?role=TheDuke&role=Admin -> java.lang.OutOfMemoryError on Wildfly server

      According to LDAP specification [1]: "Clients that follow referrals MUST ensure that they do not loop between servers. They MUST NOT repeatedly contact the same server for the same request with the same parameters.".

      When Wildfly server is configured to use AdvancedLdapLoginModule which uses referrals and LDAP servers contain loop then it leads to infinite cycle. It can results to java.lang.OutOfMemoryError on Wildfly server.

      [1] http://tools.ietf.org/html/rfc4511#section-4.1.10

        1. app.war
          4 kB
        2. server1.ldif
          0.7 kB
        3. server2.ldif
          0.4 kB

            darran.lofthouse@redhat.com Darran Lofthouse
            olukas Ondrej Lukas (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: