libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Merge pull request #1144 from TFaga/master

Browse source 
[KEYCLOAK-1211] Fixed AD users authenticating without providing a password
This commit is contained in:
Bill Burke 2015-04-20 12:31:58 -04:00
commit af736a29f1
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java
View file

@ -601,7 +601,7 @@ public class AuthenticationManager {
credentials.add(UserCredentialModel.totp(totp));
}
if (password == null && passwordToken == null) {
if ((password == null || password.isEmpty()) && (passwordToken == null || passwordToken.isEmpty())) {
logger.debug("Password not provided");
return AuthenticationStatus.MISSING_PASSWORD;
}

8
testsuite/integration/src/test/java/org/keycloak/testsuite/federation/FederationProvidersIntegrationTest.java
View file

@ -202,6 +202,14 @@ public class FederationProvidersIntegrationTest {
Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
}
@Test
public void loginLdapWithoutPassword() {
loginPage.open();
loginPage.login("john@email.org", "");
Assert.assertEquals("Invalid username or password.", loginPage.getError());
}
@Test
public void passwordChangeLdap() throws Exception {
changePasswordPage.open();