diff options
| author | Michael Klishin <mklishin@pivotal.io> | 2018-01-05 16:22:43 +0300 |
|---|---|---|
| committer | Michael Klishin <mklishin@pivotal.io> | 2018-01-06 14:05:52 +0300 |
| commit | 1aa3065cf8ad1c7ddbd870e3d362b649a652028b (patch) | |
| tree | 0412d77774356ab1a63665040026f2cacd771220 /src | |
| parent | d1e52956bb415fd79ee19347504a10640213d829 (diff) | |
| download | rabbitmq-server-git-1aa3065cf8ad1c7ddbd870e3d362b649a652028b.tar.gz | |
Prevent internal authN backend from accepting blank passwords
Passwordless users were never meant to be used this way. Since
the EXTERNAL authentication mechanism won't use this backend at all,
this is a reasonable safeguard to put in place.
[#153435857]
(cherry picked from commit bd40475057446c841c9531515d452df532841ec0)
Diffstat (limited to 'src')
| -rw-r--r-- | src/rabbit_auth_backend_internal.erl | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/rabbit_auth_backend_internal.erl b/src/rabbit_auth_backend_internal.erl index bd0acd1360..42360a5833 100644 --- a/src/rabbit_auth_backend_internal.erl +++ b/src/rabbit_auth_backend_internal.erl @@ -98,6 +98,11 @@ hashing_module_for_user(#internal_user{ hashing_algorithm = ModOrUndefined}) -> rabbit_password:hashing_mod(ModOrUndefined). +-define(BLANK_PASSWORD_REJECTION_MESSAGE, + "user '~s' attempted to log in with a blank password, which is prohibited by the internal authN backend. " + "To use TLS/x509 certificate-based autentication, set the rabbitmq_auth_mechanism_ssl plugin and configure the client to use the EXTERNAL authentication mechanism. " + "Alternatively change the password for the user to be non-blank."). + %% For cases when we do not have a set of credentials, %% namely when x509 (TLS) certificates are used. This should only be %% possible when the EXTERNAL authentication mechanism is used, see @@ -108,6 +113,12 @@ user_login_authentication(Username, []) -> %% performs initial validation. user_login_authentication(Username, AuthProps) -> case lists:keyfind(password, 1, AuthProps) of + {password, <<"">>} -> + {refused, ?BLANK_PASSWORD_REJECTION_MESSAGE, + [Username]}; + {password, ""} -> + {refused, ?BLANK_PASSWORD_REJECTION_MESSAGE, + [Username]}; {password, Cleartext} -> internal_check_user_login( Username, |