⚠️ Authentication Succeeds with Empty Password in kube-ldap v2.0.1

[dabruh]

Description:

When using gyselroth/kube-ldap:v2.0.1, authentication succeeds if a valid username is provided, even when the password is empty. This behavior can allow unauthorized access depending on the LDAP server's configuration.

---

Steps to Reproduce:

1. Deploy and configure kube-ldap to authenticate against an LDAP server.
2. Send a Basic Auth request with a valid username and an empty password:

   curl -u "validUser:" -X GET https://kube-ldap.../auth

3. Observe that the request returns a valid Kubernetes token instead of rejecting authentication.

---

Expected Behavior:

• Authentication should fail if the password is empty.
• kube-ldap should reject empty passwords before binding to LDAP.

Actual Behavior:

• kube-ldap looks up the DN for the provided username.
• It attempts to bind using an empty password.
• If the LDAP server allows anonymous binds, authentication succeeds, leading to potential unauthorized access.

---

Root Cause Analysis:

• In src/ldap/client.js, the function bind() does not check for empty passwords before calling client.bind(dn, password).

• LDAP servers may allow empty passwords (unauthenticated bind behavior).

• Related Code:

  /**
  * Perform LDAP bind operation
  * @param {string} dn - DN to bind.
  * @param {string} password - Password to bind.
  * @return {Promise<boolean>}
  */
  async bind(dn: string, password: string): Promise<boolean> {
    let client = this.clientFactory();
    let authenticated = false;
    try {
      await client.bind(dn, password, []);
      authenticated = true;
    } catch (error) {
      authenticated = false;
    } finally {
      await client.unbind();
    }
    return authenticated;
  }

---

Suggested Fix:

Add an explicit password check before binding in client.js:

  * @return {Promise<boolean>}
  */
 async bind(dn: string, password: string): Promise<boolean> {
+  if (!password) {
+    return false;
+  }
   let client = this.clientFactory();
   let authenticated = false;
   try {

... alternatively make this behavior configurable via environment

---

Environment:

• Container Version: gyselroth/kube-ldap:v2.0.1
• LDAP Server: MS AD 2019

---

Additional Context:

• The issue occurs if the LDAP server allows unauthenticated binds with empty passwords.
• This could be a potential security vulnerability, allowing unauthorized users to gain access.
• The fix should ensure that kube-ldap explicitly prevents empty passwords before binding.

---

Can you confirm if this is an expected behavior or if a fix can be implemented in a future release? 🚀