[enhance](auth) introduction of configuration property to prohibit login with empty LDAP password#61440
Open
iaorekhov-1980 wants to merge 4 commits into
Open
Conversation
Contributor
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
iaorekhov-1980
changed the title
Contributor
Author
|
run buildall |
TPC-H: Total hot run time: 27089 ms |
Contributor
FE UT Coverage ReportIncrement line coverage |
TPC-DS: Total hot run time: 169028 ms |
Contributor
Author
|
run external |
Contributor
Author
|
run nonConcurrent |
iaorekhov-1980
force-pushed
the
feat/disable_ldap_empty_pass
branch
from
8fa5633 to
629cab0
Compare
Contributor
Author
|
run buildall |
TPC-H: Total hot run time: 26705 ms |
TPC-DS: Total hot run time: 167913 ms |
Contributor
FE UT Coverage ReportIncrement line coverage |
Contributor
Author
|
run external |
1 similar comment
Contributor
Author
|
run external |
Contributor
|
/review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review Summary for PR #61440
PR Goal: Add ldap_allow_empty_pass config to prohibit LDAP login with empty passwords.
Critical Checkpoint Conclusions
1. Does the code accomplish its goal? Is there a test that proves it?
Yes. The check is correctly placed in both independent LDAP authentication paths (LdapAuthenticator.internalAuthenticate for MySQL wire protocol and Auth.checkPlainPassword for Thrift/HTTP/Arrow Flight). Tests cover the LdapAuthenticator path. However, there is no test for the Auth.checkPlainPassword path.
2. Is the modification as small, clear, and focused as possible?
Yes. The change is minimal and well-scoped.
3. Concurrency concerns?
The config ldap_allow_empty_pass is a static boolean read without synchronization. This is acceptable for a config flag — worst case is a brief window of stale reads during config reload, which is tolerable for this use case.
4. Configuration items added — should it allow dynamic changes?
Yes — see inline comment. The config should be mutable = true so it can be toggled at runtime without FE restart. This is a pure runtime policy check with no initialization dependency, unlike connection/pool configs.
5. Functionally parallel code paths?
Both independent LDAP auth paths are covered. No parallel paths are missed.
6. Error message quality?
The error message "Access with empty password is prohibited for user %s because of current mode" is vague — "current mode" doesn't explain what mode. See inline comment for suggested improvement.
7. Test coverage?
- Unit test covers the
LdapAuthenticatorpath with empty password allowed/denied scenarios. Good. - Missing: test for
Auth.checkPlainPasswordpath (the Thrift/HTTP entry point). - Missing: test with
nullpassword (not just empty string"").
8. Incompatible changes / rolling upgrade?
No incompatible changes. Default value true preserves backward compatibility.
9. Observability?
LOG.info is adequate for rejected login attempts.
10. Transaction/persistence?
Not applicable.
11. Performance?
No concerns — the check is a simple boolean comparison on a non-hot path.
12. Other issues?
- The
LdapManager.checkUserPasswdat line 106 already rejectsnullpasswords (Objects.isNull(passwd)returns false) but does NOT reject empty strings — it will proceed toldapClient.checkPassword()with an empty string, which typically results in an LDAP "unauthenticated bind" (silently succeeds). This confirms the PR addresses a real security issue. - The PR description mentions
ldap_use_sslin section 3.2 but meansldap_allow_empty_pass— this is a typo in the PR description only (not in code). - The
Release notesection says "None" but this is a user-visible behavior change (new config property). It should have a release note.
iaorekhov-1980
force-pushed
the
feat/disable_ldap_empty_pass
branch
2 times, most recently
from
aaa284b to
267c2e3
Compare
Contributor
Author
|
run feut |
8 similar comments
Contributor
Author
|
run feut |
Contributor
Author
|
run feut |
Contributor
Author
|
run feut |
Contributor
Author
|
run feut |
Contributor
Author
|
run feut |
Contributor
Author
|
run feut |
Contributor
Author
|
run feut |
Contributor
Author
|
run feut |
Contributor
Author
|
Hello, @morningman / @CalvinKirs |
morrySnow
reviewed
Jun 11, 2026
iaorekhov-1980
force-pushed
the
feat/disable_ldap_empty_pass
branch
from
16ca876 to
67ee697
Compare
Contributor
Author
|
run buildall |
Contributor
TPC-H: Total hot run time: 28737 ms |
Contributor
TPC-DS: Total hot run time: 168116 ms |
Contributor
TPC-H: Total hot run time: 28755 ms |
Contributor
TPC-DS: Total hot run time: 167253 ms |
Contributor
FE UT Coverage ReportIncrement line coverage |
Contributor
FE Regression Coverage ReportIncrement line coverage |
Contributor
Author
|
Hello, @morningman / @morrySnow |
iaorekhov-1980
force-pushed
the
feat/disable_ldap_empty_pass
branch
from
fc2d02e to
3bc4bc9
Compare
Contributor
Author
|
run buildall |
Contributor
FE UT Coverage ReportIncrement line coverage |
Contributor
TPC-H: Total hot run time: 29791 ms |
Contributor
TPC-DS: Total hot run time: 173853 ms |
Contributor
ClickBench: Total hot run time: 25.25 s |
Contributor
FE Regression Coverage ReportIncrement line coverage |
Contributor
Author
|
run nonConcurrent |
Contributor
FE Regression Coverage ReportIncrement line coverage |
Contributor
Author
|
Hello, @morningman / @morrySnow |
Contributor
|
/review |
Contributor
There was a problem hiding this comment.
Review result: no new blocking issue found in the current PR state.
Critical checkpoints:
- Goal/test evidence: the PR adds a legacy LDAP switch to reject empty passwords when disabled. The legacy
Auth.checkPlainPassword()andLdapAuthenticatorpaths are both updated, with unit coverage for default/true/false values and plugin integration coverage that the plugin path still rejects empty credentials. - Scope/focus: the implementation is small and localized to LDAP config, legacy LDAP authentication checks, error reporting, and related tests.
- Concurrency/lifecycle: no new concurrent mutable structure or lifecycle-sensitive object was introduced. The static LDAP config is read at authentication time like adjacent LDAP config fields.
- Configuration:
ldap_allow_empty_passis non-mutable and documented inconf/ldap.conf, matching the current LDAP config load/persist behavior discussed in existing threads. - Compatibility/persistence: no FE-BE protocol, storage, EditLog, or rolling-upgrade compatibility impact was found.
- Parallel paths: both legacy LDAP entry points are covered; plugin behavior remains intentionally separate and always rejects empty credentials, as already discussed in the existing review context.
- Tests/results:
git diff --checkpassed. I could not run FE unit tests/build in this runner becausethirdparty/installed/bin/protocis missing, so the repository FE build instructions require stopping before build. - Observability/performance/security: the new check is lightweight and rejects before LDAP bind when disabled. Existing auth-chain fallback behavior remains as previously tested; no new security finding was identified under the repository threat model.
User focus: no additional user-provided review focus was supplied.
Subagent conclusions:
optimizer-rewrite: reviewed optimizer/rewrite and auth/session-adjacent paths; no optimizer, join, aggregate, or planner/session issue found.tests-session-config: reviewed tests, config propagation, plugin POM dependency, compatibility, and basic style; no new valuable finding found.- Convergence round 1 ended with both live subagents reporting
NO_NEW_VALUABLE_FINDINGSfor the same current ledger/comment set.
CalvinKirs
reviewed
Jun 23, 2026
| * Flag to enable login with empty pass. | ||
| */ | ||
| @ConfigBase.ConfField | ||
| public static boolean ldap_allow_empty_pass = true; |
Member
There was a problem hiding this comment.
Default should be false. Defaulting to true keeps the vulnerable behavior — insecure by default for a security fix. Both Spring Security and Doris reject empty passwords unconditionally. Suggest defaulting false with true as explicit opt-in; if it stays true, please flag the risk loudly in ldap.conf.
CalvinKirs
reviewed
Jun 23, 2026
Comment on lines
+111
to
+116
| if (Strings.isNullOrEmpty(password) && !LdapConfig.ldap_allow_empty_pass) { | ||
| LOG.info("User:{} login rejected: empty LDAP password is prohibited (ldap_allow_empty_pass=false)", | ||
| userName); | ||
| ErrorReport.report(ErrorCode.ERR_EMPTY_PASSWORD, qualifiedUser + "@" + remoteIp); | ||
| return AuthenticateResponse.failedResponse; | ||
| } |
Member
There was a problem hiding this comment.
Rather than duplicating, consider sinking the empty-password check into the single LDAP chokepoint LdapManager.checkUserPasswd. Keep it LDAP-scoped, not at the global auth entry
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this PR solve?
This PR adds new configuration property ldap_allow_empty_pass to prohibit option for existing user to login into LDAP with empty password for legacy approach.
It doesn't impact new approach from #60407 , because since 4.1.x new LDAP plugin explicitly prohibits login with empty pass.
But in legacy version - 3.1.x and 4.0.x such option is still available.
If ldap_allow_empty_pass in ldap.conf is not specified or specified as true - user can login with empty pass (existing behavior).
If ldap_allow_empty_pass specified as false - login attempt with empty password will be rejected with corresponding error message.
Could you please include this PR into 4.x and 3.1.x branches, please!
Issue Number: close #60353
Related PR: #xxx
Problem Summary:
Currently for existing user it is possible to login into LDAP with empty password.
New configuration property disables such option, but default behavior still allows to login without specified password.
Release note
New ldap_allow_empty_pass property for legacy authentication approach was introduced into ldap.conf to prohibit login with empty LDAP password as it is allowed by LDAP protocol by default.
Check List (For Author)
Test
Behavior changed:
3.1 user has specified empty password
3.2 property ldap_allow_empty_pass is false and doesn't allow to login with empty password
If both conditions met - authentication is failed and new error is reported.
Check List (For Reviewer who merge this PR)