Why is this important?
Authentication is one of the most fundamental security requirements. Any issues with authentication can allow attackers to bypass business logic and impersonate users, or even access all data from other users.
Check out this video for a high-level explanation:
Fixing Insecure Authentication
Option A: Enable proper LDAP authentication
Without proper access control, executing an LDAP statement that contains a user-controlled value can allow an attacker to abuse poorly configured LDAP context. All LDAP queries executed against the context will be performed without authentication and access control. An attacker may be able to manipulate one of these queries in an unexpected way to gain access to records that would otherwise be protected by the directory's access control mechanism.
- Go through the issues that GuardRails identified in the PR.
- Identify the pattern that looks like this:
env.put(Context.SECURITY_AUTHENTICATION, "none"); DirContext ctx = new InitialDirContext(env);
- Replace them with:
env.put(Context.SECURITY_PROTOCOL, "ssl"); env.put(Context.SECURITY_AUTHENTICATION, "DIGEST-MD5 GSSAPI"); DirContext ctx = new InitialDirContext(env);
- Make sure that the LDAP server is configured correctly.
- Test it
- Ship it 🚢 and relax 🌴