Skip to content

[enhance](auth) introduction of configuration property to prohibit login with empty LDAP password#61440

Draft
iaorekhov-1980 wants to merge 6 commits intoapache:masterfrom
iaorekhov-1980:feat/disable_ldap_empty_pass
Draft

[enhance](auth) introduction of configuration property to prohibit login with empty LDAP password#61440
iaorekhov-1980 wants to merge 6 commits intoapache:masterfrom
iaorekhov-1980:feat/disable_ldap_empty_pass

Conversation

@iaorekhov-1980
Copy link
Contributor

What problem does this PR solve?

This PR adds new configuration property ldap_allow_empty_pass to prohibit option for existing user to login into LDAP with empty password.
If ldap_allow_empty_pass in ldap.conf is not specified or specified as true - user can login with empty pass (existing behavior).
If ldap_allow_empty_pass specified as false - login attempt with empty password will be rejected with corresponding error message.

Could you please include this PR into 4.x and 3.1.x branches, please!

Issue Number: close #60353

Related PR: #xxx

Problem Summary:

Currently for existing user it is possible to login into LDAP with empty password.
New configuration property disables such option, but default behavior still allows to login without specified password.

Release note

None

Check List (For Author)

  • Test

    • Regression test
    • Unit Test
    • Manual test (add detailed scripts or steps below)
    • No need to test or manual test. Explain why:
      • This is a refactor/code format and no logic has been changed.
      • Previous test can cover this change.
      • No code files have been changed.
      • Other reason
  • Behavior changed:

    • No.
    • Yes.
  1. ldap.conf and LdapConfig.java - new configuration ldap_allow_empty_pass property with default value true to keep existing behavior as default
  2. ErrorCode.java - specific error message for case with empty password was added
  3. LdapAuthenticator.java and Auth.java - additional check was added to validate two conditions
    3.1 user has specified empty password
    3.2 property ldap_allow_empty_pass is false and doesn't allow to login with empty password
    If both conditions met - authentication is failed and new error is returned.
  4. LdapAuthenticatorTest.java - introduced new test method to validate existing behavior (without specified ldap_allow_empty_pass property or true) and new one (with ldap_use_ssl property specified to false) to check that login is still successful in first case and failed in the second one.

Check List (For Reviewer who merge this PR)

  • Confirm the release note
  • Confirm test cases
  • Confirm document
  • Add branch pick label

@Thearas
Copy link
Contributor

Thearas commented Mar 17, 2026

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

  1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
  2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
  3. What features were added. Why was this function added?
  4. Which code was refactored and why was this part of the code refactored?
  5. Which functions were optimized and what is the difference before and after the optimization?

@iaorekhov-1980 iaorekhov-1980 changed the title [enhance] (auth) add option to disable login with empty pass [enhance](auth) introduction of configuration property to prohibit login with empty LDAP password Mar 17, 2026
@iaorekhov-1980
Copy link
Contributor Author

run buildall

@doris-robot
Copy link

TPC-H: Total hot run time: 27089 ms
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 8fa563330bafb91c2f9f69f841d845f183198ca7, data reload: false

------ Round 1 ----------------------------------
orders	Doris	NULL	NULL	0	0	0	NULL	0	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL	
============================================
q1	17617	4514	4315	4315
q2	q3	10635	811	516	516
q4	4671	362	254	254
q5	7560	1209	1013	1013
q6	181	174	147	147
q7	795	873	655	655
q8	9299	1508	1367	1367
q9	4915	4761	4719	4719
q10	6238	1901	1664	1664
q11	496	260	253	253
q12	700	589	469	469
q13	18029	2944	2187	2187
q14	237	239	223	223
q15	q16	755	735	685	685
q17	743	873	453	453
q18	6148	5442	5311	5311
q19	1113	1002	633	633
q20	549	507	393	393
q21	4439	1862	1507	1507
q22	491	388	325	325
Total cold run time: 95611 ms
Total hot run time: 27089 ms

----- Round 2, with runtime_filter_mode=off -----
orders	Doris	NULL	NULL	150000000	42	6422171781	NULL	22778155	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL	
============================================
q1	4776	4670	4657	4657
q2	q3	3893	4344	3815	3815
q4	884	1216	789	789
q5	4096	4446	4339	4339
q6	196	187	148	148
q7	1785	1705	1555	1555
q8	2490	2734	2797	2734
q9	7523	7464	7308	7308
q10	3870	4087	3624	3624
q11	500	432	426	426
q12	505	597	455	455
q13	2810	3129	2330	2330
q14	281	315	277	277
q15	q16	715	765	726	726
q17	1185	1414	1404	1404
q18	7024	6758	6686	6686
q19	987	1004	1013	1004
q20	2067	2158	2028	2028
q21	4208	3590	3351	3351
q22	466	447	389	389
Total cold run time: 50261 ms
Total hot run time: 48045 ms

@hello-stephen
Copy link
Contributor

FE UT Coverage Report

Increment line coverage 71.43% (5/7) 🎉
Increment coverage report
Complete coverage report

@doris-robot
Copy link

TPC-DS: Total hot run time: 169028 ms
machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 8fa563330bafb91c2f9f69f841d845f183198ca7, data reload: false

query5	4320	660	523	523
query6	339	223	202	202
query7	4220	476	283	283
query8	358	245	231	231
query9	8748	2760	2725	2725
query10	536	392	358	358
query11	7003	5120	4916	4916
query12	185	129	121	121
query13	1270	470	341	341
query14	5632	3713	3543	3543
query14_1	2867	2822	2795	2795
query15	207	193	176	176
query16	968	475	462	462
query17	891	740	609	609
query18	2445	445	342	342
query19	215	210	182	182
query20	139	136	127	127
query21	215	138	114	114
query22	13255	14148	14701	14148
query23	16283	15861	15542	15542
query23_1	15902	15612	15359	15359
query24	7301	1646	1234	1234
query24_1	1251	1234	1255	1234
query25	551	472	434	434
query26	1251	262	156	156
query27	2779	492	318	318
query28	4499	1856	1875	1856
query29	881	589	487	487
query30	296	226	193	193
query31	1017	946	901	901
query32	90	72	69	69
query33	512	333	290	290
query34	903	907	530	530
query35	645	702	617	617
query36	1080	1112	983	983
query37	139	99	88	88
query38	2972	2883	2891	2883
query39	879	843	825	825
query39_1	797	802	804	802
query40	237	154	134	134
query41	64	65	59	59
query42	262	261	260	260
query43	244	249	223	223
query44	
query45	198	194	188	188
query46	891	983	605	605
query47	2846	2135	2071	2071
query48	317	328	231	231
query49	639	455	390	390
query50	715	279	215	215
query51	4124	4205	4003	4003
query52	267	269	265	265
query53	290	339	288	288
query54	309	279	288	279
query55	94	91	88	88
query56	321	330	326	326
query57	1937	1928	1656	1656
query58	308	289	276	276
query59	2835	2963	2789	2789
query60	382	361	352	352
query61	183	183	178	178
query62	639	595	557	557
query63	319	288	283	283
query64	5288	1416	1128	1128
query65	
query66	1496	490	375	375
query67	24307	24379	24302	24302
query68	
query69	427	335	299	299
query70	1009	987	936	936
query71	351	329	321	321
query72	3033	2826	2462	2462
query73	554	561	315	315
query74	9665	9589	9396	9396
query75	2893	2764	2488	2488
query76	2296	1051	683	683
query77	371	378	316	316
query78	10954	11189	10452	10452
query79	1104	843	578	578
query80	1333	649	551	551
query81	553	267	230	230
query82	998	159	126	126
query83	340	266	249	249
query84	298	129	106	106
query85	949	517	458	458
query86	443	308	300	300
query87	3144	3166	3039	3039
query88	3566	2663	2603	2603
query89	430	371	348	348
query90	2034	189	185	185
query91	180	165	142	142
query92	79	76	74	74
query93	983	904	517	517
query94	651	323	307	307
query95	609	402	326	326
query96	663	539	237	237
query97	2488	2460	2410	2410
query98	240	221	222	221
query99	1001	1012	919	919
Total cold run time: 251426 ms
Total hot run time: 169028 ms

@iaorekhov-1980
Copy link
Contributor Author

run external

@iaorekhov-1980
Copy link
Contributor Author

run nonConcurrent

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Enhancement] (auth) add configuration to support disable of login with empty LDAP password

4 participants