我有这段代码根据 LDAP 目录对我的用户进行身份验证。当密码不正确时，它返回 false，但如果密码留空，它仍然会对用户进行身份验证。有什么想法可能会发生这种情况吗？
if (@ldap_bind($ds, $user_dn, $password) || sha1($password) == '484h84h4hf4Ffwj49393393j93j')
{
$valid = true;
}
else $valid = false;
如果您提供空密码，则表明目录服务器您正在执行匿名简单绑定。 RFC 2251 第 4.2.2 节描述了此行为：
If no authentication is to be performed, then the simple
authentication option MUST be chosen, and the password be of zero
length. (This is often done by LDAPv2 clients.) Typically the DN is
also of zero length.
这可能是 LDAP 客户端中一个非常常见的安全漏洞，因为如果他们不验证用户是否提供了非空密码，而是尝试使用非空 DN 和空密码进行绑定，那么当服务器不绑定为所提供的 DN 指定的用户，而是匿名绑定。由于这是 LDAP 客户端中常见的安全问题，因此某些服务器会拒绝具有非空 DN 但空密码的绑定请求，并且最新的 LDAPv3 规范鼓励这种行为，如 RFC 4513 第 5.1.2 节中所示：
An LDAP client may use the unauthenticated authentication mechanism
of the simple Bind method to establish an anonymous authorization
state by sending a Bind request with a name value (a distinguished
name in LDAP string form [RFC4514] of non-zero length) and specifying
the simple authentication choice containing a password value of zero
length.
The distinguished name value provided by the client is intended to be
used for trace (e.g., logging) purposes only. The value is not to be
authenticated or otherwise validated (including verification that the
DN refers to an existing directory object). The value is not to be
used (directly or indirectly) for authorization purposes.
Unauthenticated Bind operations can have significant security issues
(see Section 6.3.1). In particular, users intending to perform
Name/Password Authentication may inadvertently provide an empty
password and thus cause poorly implemented clients to request
Unauthenticated access. Clients SHOULD be implemented to require
user selection of the Unauthenticated Authentication Mechanism by
means other than user input of an empty password. Clients SHOULD
disallow an empty password input to a Name/Password Authentication
user interface. Additionally, Servers SHOULD by default fail
Unauthenticated Bind requests with a resultCode of
unwillingToPerform.
听起来你的服务器没有这样做。如果它有这样做的选项，那么我强烈建议将其打开。但无论如何，一个设计良好的 LDAP 客户端使用简单的绑定操作来验证用户凭据，在尝试使用它绑定到服务器之前绝对应该验证用户是否提供了一个非空字符串。
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系:hwhale#tublm.com(使用前将#替换为@)
