diff options
| author | Michael Klishin <michael@novemberain.com> | 2018-01-09 16:57:23 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-01-09 16:57:23 +0300 |
| commit | 3e6ae43b40f1704f7e4a2f29197b59e3811329e0 (patch) | |
| tree | 7955b6b532d9e2014dc16a1727949095aab3ca27 /src | |
| parent | d1e52956bb415fd79ee19347504a10640213d829 (diff) | |
| parent | ce827cf68fcbfa845677d1ba0f2c4e0150e1f3bb (diff) | |
| download | rabbitmq-server-git-3e6ae43b40f1704f7e4a2f29197b59e3811329e0.tar.gz | |
Merge pull request #1467 from rabbitmq/rabbitmq-server-story-153435857-master
Internal authN backend: make it impossible to successfully log in with a blank password (master)
Diffstat (limited to 'src')
| -rw-r--r-- | src/rabbit_auth_backend_internal.erl | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/rabbit_auth_backend_internal.erl b/src/rabbit_auth_backend_internal.erl index bd0acd1360..166732e523 100644 --- a/src/rabbit_auth_backend_internal.erl +++ b/src/rabbit_auth_backend_internal.erl @@ -98,6 +98,11 @@ hashing_module_for_user(#internal_user{ hashing_algorithm = ModOrUndefined}) -> rabbit_password:hashing_mod(ModOrUndefined). +-define(BLANK_PASSWORD_REJECTION_MESSAGE, + "user '~s' attempted to log in with a blank password, which is prohibited by the internal authN backend. " + "To use TLS/x509 certificate-based authentication, see the rabbitmq_auth_mechanism_ssl plugin and configure the client to use the EXTERNAL authentication mechanism. " + "Alternatively change the password for the user to be non-blank."). + %% For cases when we do not have a set of credentials, %% namely when x509 (TLS) certificates are used. This should only be %% possible when the EXTERNAL authentication mechanism is used, see @@ -108,6 +113,12 @@ user_login_authentication(Username, []) -> %% performs initial validation. user_login_authentication(Username, AuthProps) -> case lists:keyfind(password, 1, AuthProps) of + {password, <<"">>} -> + {refused, ?BLANK_PASSWORD_REJECTION_MESSAGE, + [Username]}; + {password, ""} -> + {refused, ?BLANK_PASSWORD_REJECTION_MESSAGE, + [Username]}; {password, Cleartext} -> internal_check_user_login( Username, |