LDAP Bind似乎返回true，密码为空

Question

我有此代码针对LDAP目录验证用户身份。密码错误时返回false，但是如果密码为空，则无论如何都会对用户进行身份验证。有什么想法可能会发生吗？

if (@ldap_bind($ds, $user_dn, $password) || sha1($password) == '484h84h4hf4Ffwj49393393j93j') 
{
    $valid = true;
}
else $valid = false;

Answer 1

如果您提供一个空密码，那么它将向目录服务器指示您正在执行匿名简单绑定。RFC 2251第4.2.2节中描述了此行为：

 If no authentication is to be performed, then the simple
 authentication option MUST be chosen, and the password be of zero
 length.  (This is often done by LDAPv2 clients.)  Typically the DN is
 also of zero length.

这在LDAP客户端中可能是一个非常常见的安全漏洞，因为如果他们不验证用户是否提供了非空密码，而是尝试使用非空DN和空密码进行绑定，则当它们服务器未按照提供的DN指定的用户身份进行绑定，而是匿名绑定。由于这是LDAP客户端中的常见安全问题，因此某些服务器会拒绝具有非空DN但密码为空的绑定请求，并且最新的LDAPv3规范鼓励这种行为，如RFC 4513第5.1.2节所述：

 An LDAP client may use the unauthenticated authentication mechanism
 of the simple Bind method to establish an anonymous authorization
 state by sending a Bind request with a name value (a distinguished
 name in LDAP string form [RFC4514] of non-zero length) and specifying
 the simple authentication choice containing a password value of zero
 length.

 The distinguished name value provided by the client is intended to be
 used for trace (e.g., logging) purposes only.  The value is not to be
 authenticated or otherwise validated (including verification that the
 DN refers to an existing directory object).  The value is not to be
 used (directly or indirectly) for authorization purposes.

 Unauthenticated Bind operations can have significant security issues
 (see Section 6.3.1).  In particular, users intending to perform
 Name/Password Authentication may inadvertently provide an empty
 password and thus cause poorly implemented clients to request
 Unauthenticated access.  Clients SHOULD be implemented to require
 user selection of the Unauthenticated Authentication Mechanism by
 means other than user input of an empty password.  Clients SHOULD
 disallow an empty password input to a Name/Password Authentication
 user interface.  Additionally, Servers SHOULD by default fail
 Unauthenticated Bind requests with a resultCode of
 unwillingToPerform.

听起来您的服务器没有执行此操作。如果可以选择这样做，那么我强烈建议将其打开。但是无论如何，一个设计良好的LDAP客户端使用简单的绑定操作来验证用户凭据，在尝试使用它来绑定到服务器之前，应该绝对验证用户是否提供了一个非空字符串。