Skip to content

Commit 23acfe9

Browse files
iaorekhov-1980iaorekhov-1980
committed
add docs for allow_empty_pass option for 3.x and 4.x versions
1 parent 8f467f1 commit 23acfe9

2 files changed

Lines changed: 40 additions & 0 deletions

File tree

  • versioned_docs
    • version-3.x/admin-manual/auth/authentication
    • version-4.x/admin-manual/auth/authentication

‎versioned_docs/version-3.x/admin-manual/auth/authentication/ldap.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ In LDAP, data is organized in a tree structure. Here's an example of a typical L
5757
ldap_group_basedn = ou=group,o=emr
5858
# specify ldap_use_ssl to true to use to secured LDAPS protocol, specify false or comment property to use default behavior with plain LDAP
5959
ldap_use_ssl = true
60+
# specify ldap_allow_empty_pass to false to prohibit login with non specified LDAP password, specify true or comment property to use default behavior and allow login with empty LDAP password
61+
ldap_allow_empty_pass = false
6062
```
6163
6264
> To enable LDAPS (encrypted connection to the LDAP server), see the [LDAPS (Encrypted Connection)](#ldaps-encrypted-connection) section below.
@@ -136,6 +138,12 @@ LDAP authentication means password verification through LDAP service to suppleme
136138
2. If the user doesn't exist in LDAP, it falls back to Doris local password verification.
137139
3. If the LDAP password is correct but there's no corresponding account in Doris, a temporary user is created for login.
138140
141+
> Note on Empty Passwords:
142+
>
143+
> By default, Doris allows login with an empty password if the user exists in LDAP (`ldap_allow_empty_pass = true`).
144+
> This behavior can be disabled by setting `ldap_allow_empty_pass = false` in `ldap.conf`.
145+
> With such setting Doris will reject all login attempts with empty password and return an error message.
146+
139147
### Login Behavior Overview
140148
141149
After enabling LDAP, login behaviors under different user states are as follows:
@@ -144,8 +152,10 @@ After enabling LDAP, login behaviors under different user states are as follows:
144152
| --------- | ---------- | ------------- | ------------ | -------------- |
145153
| Exists | Exists | LDAP password | Success | Doris user |
146154
| Exists | Exists | Doris password | Failed | - |
155+
| Exists | Exists | Empty password | Success if `ldap_allow_empty_pass = true`, otherwise Failed | Doris user (if allowed) |
147156
| Not exists | Exists | Doris password | Success | Doris user |
148157
| Exists | Not exists | LDAP password | Success | LDAP temporary user |
158+
| Exists | Not exists | Empty password | Success if `ldap_allow_empty_pass = true`, otherwise Failed | LDAP temporary user (if allowed) |
149159
150160
> **About Temporary Users:**
151161
>
@@ -154,6 +164,12 @@ After enabling LDAP, login behaviors under different user states are as follows:
154164
> - Temporary user permissions are determined by LDAP group authorization (see "Group Authorization" section below).
155165
> - If temporary users have no corresponding group permissions, they default to `select_priv` on `information_schema`.
156166
167+
> **About Empty Password Security:**
168+
>
169+
> The `ldap_allow_empty_pass` configuration provides additional security control:
170+
> - When `true` (default): Users can accidentally or intentionally log in without a password, which might be convenient for development environments but poses security risks in production.
171+
> - When `false`: Empty passwords are strictly rejected, ensuring all users must provide valid credentials. This is recommended for production environments to prevent unauthorized access.
172+
157173
### Login Examples
158174
159175
The following examples assume LDAP authentication is enabled, configured with `ldap_user_filter = (&(uid={login}))`, and the client has set `LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1`.
@@ -303,6 +319,7 @@ You can refresh the cache with the `refresh ldap` statement. See [REFRESH-LDAP](
303319

304320
- Doris's LDAP functionality only supports cleartext password verification for the client-to-FE segment, meaning that when users log in, passwords are transmitted in plaintext between `client` and `fe`. SSL/TLS encryption between the client and Doris FE must be configured separately (see [Client Connection](#step-2-client-connection)).
305321
- For the FE-to-LDAP segment, the connection is unencrypted by default (`ldap_use_ssl = false`). To encrypt this segment, set `ldap_use_ssl = true` to use LDAPS (see [LDAPS (Encrypted Connection)](#ldaps-encrypted-connection)).
322+
- Empty password behavior: By default, Doris allows login with an empty password if the user exists in LDAP (`ldap_allow_empty_pass = true`). This can be disabled by setting `ldap_allow_empty_pass = false` in `ldap.conf`.
306323

307324
## FAQ
308325

‎versioned_docs/version-4.x/admin-manual/auth/authentication/ldap.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ In LDAP, data is organized in a tree structure. Here's an example of a typical L
5757
ldap_group_basedn = ou=group,o=emr
5858
# specify ldap_use_ssl to true to use to secured LDAPS protocol, specify false or comment property to use default behavior with plain LDAP
5959
ldap_use_ssl = true
60+
# specify ldap_allow_empty_pass to false to prohibit login with non specified LDAP password, specify true or comment property to use default behavior and allow login with empty LDAP password
61+
ldap_allow_empty_pass = false
6062
```
6163
6264
> To enable LDAPS (encrypted connection to the LDAP server), see the [LDAPS (Encrypted Connection)](#ldaps-encrypted-connection) section below.
@@ -135,6 +137,12 @@ LDAP authentication means password verification through LDAP service to suppleme
135137
2. If the user doesn't exist in LDAP, it falls back to Doris local password verification.
136138
3. If the LDAP password is correct but there's no corresponding account in Doris, a temporary user is created for login.
137139
140+
> Note on Empty Passwords:
141+
>
142+
> By default, Doris allows login with an empty password if the user exists in LDAP (`ldap_allow_empty_pass = true`).
143+
> This behavior can be disabled by setting `ldap_allow_empty_pass = false` in `ldap.conf`.
144+
> With such setting Doris will reject all login attempts with empty password and return an error message.
145+
138146
### Login Behavior Overview
139147
140148
After enabling LDAP, login behaviors under different user states are as follows:
@@ -143,8 +151,10 @@ After enabling LDAP, login behaviors under different user states are as follows:
143151
| --------- | ---------- | ------------- | ------------ | -------------- |
144152
| Exists | Exists | LDAP password | Success | Doris user |
145153
| Exists | Exists | Doris password | Failed | - |
154+
| Exists | Exists | Empty password | Success if `ldap_allow_empty_pass = true`, otherwise Failed | Doris user (if allowed) |
146155
| Not exists | Exists | Doris password | Success | Doris user |
147156
| Exists | Not exists | LDAP password | Success | LDAP temporary user |
157+
| Exists | Not exists | Empty password | Success if `ldap_allow_empty_pass = true`, otherwise Failed | LDAP temporary user (if allowed) |
148158
149159
> **About Temporary Users:**
150160
>
@@ -153,6 +163,12 @@ After enabling LDAP, login behaviors under different user states are as follows:
153163
> - Temporary user permissions are determined by LDAP group authorization (see "Group Authorization" section below).
154164
> - If temporary users have no corresponding group permissions, they default to `select_priv` on `information_schema`.
155165
166+
> **About Empty Password Security:**
167+
>
168+
> The `ldap_allow_empty_pass` configuration provides additional security control:
169+
> - When `true` (default): Users can accidentally or intentionally log in without a password, which might be convenient for development environments but poses security risks in production.
170+
> - When `false`: Empty passwords are strictly rejected, ensuring all users must provide valid credentials. This is recommended for production environments to prevent unauthorized access.
171+
156172
### Login Examples
157173
158174
The following examples assume LDAP authentication is enabled, configured with `ldap_user_filter = (&(uid={login}))`, and the client has set `LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1`.
@@ -300,8 +316,15 @@ You can refresh the cache with the `refresh ldap` statement. See [REFRESH-LDAP](
300316

301317
## Known Limitations
302318

319+
<<<<<<< HEAD
303320
- Doris's LDAP functionality only supports cleartext password verification for the client-to-FE segment, meaning that when users log in, passwords are transmitted in plaintext between `client` and `fe`. SSL/TLS encryption between the client and Doris FE must be configured separately (see [Client Connection](#step-2-client-connection)).
304321
- For the FE-to-LDAP segment, the connection is unencrypted by default (`ldap_use_ssl = false`). To encrypt this segment, set `ldap_use_ssl = true` to use LDAPS (see [LDAPS (Encrypted Connection)](#ldaps-encrypted-connection)).
322+
=======
323+
- Currently, Doris's LDAP functionality only supports cleartext password verification, meaning that when users log in, passwords are transmitted in plaintext between `client` and `fe`, but connection between `fe` and LDAP service can be secured optionally.
324+
- **For `ldap_use_ssl = false` (default behavior)**: Passwords are transmitted in plain text between the Doris FE and the LDAP server.
325+
- **To secure the connection**: Set `ldap_use_ssl = true` to encrypt traffic between Doris FE and the LDAP server. Note that SSL/TLS encryption between the **client and Doris FE** must be configured separately.
326+
- **Empty password behavior:** By default, Doris allows login with an empty password if the user exists in LDAP (`ldap_allow_empty_pass = true`). This can be disabled by setting `ldap_allow_empty_pass = false` in `ldap.conf`.
327+
>>>>>>> a2a830554a (add docs for allow_empty_pass option for 3.x and 4.x versions)
305328
306329
## FAQ
307330

0 commit comments

Comments
 (0)