Question

LDAP server, PHP, and not allowing null passwords.

My code currently checks password for boolean true (yes, I will exclude some values that might be valid non-null LDAP passwords, such as "0") to avoid allowing blank password logins with LDAP. But is this enough?

Is it possible to create a value that PHP will consider non-null but will be treated as a blank password by LDAP? perhaps a string with 0x0 (empty C-string) or some other such hackerish monstrosity?

using ldap_bind()

Answer 1

There are three possibilities covered by the LDAP standard regarding simple BIND operations and one possibility not addressed by the standard:

1. null DN and null password. No authentication takes place. This is commonly known as “anonymous” and is the initial state of a connection.
2. DN and null password. No authentication takes place.
3. DN and password. Authentication takes place and either fails or succeeds. If authentication succeeds, a zero (0) result code is returned in the BIND response. Otherwise a non-zero result code is returned in the BIND response.

And lastly, not addressed by the LDAP standard:

1. no DN and a non-null password. No authentication takes place. The directory server should reject this BIND operation.

What the server does for the first two depends on the configuration of the server but since no authentication takes place the BIND operation should be rejected if the server is properly configured.