8000 fix: LDAP password-policy response control parser — warning/error tag dispatch and zero-length error element by 0xCcSec · Pull Request #52403 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

fix: LDAP password-policy response control parser — warning/error tag dispatch and zero-length error element #52403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahus1 merged 1 commit into from
Sep 9, 2026
Merged

fix: LDAP password-policy response control parser — warning/error tag dispatch and zero-length error element #52403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/BERDecoder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ public class BERDecoder {

// Tag forms.
public static final int TAG_FORM_PRIMITIVE = 0x00;
public static final int TAG_FORM_CONSTRUCTED = 0x20;

private ByteBuffer encoded;

Expand Down
6 changes: 3 additions & 3 deletions ...src/main/java/org/keycloak/storage/ldap/idm/store/ldap/control/PasswordPolicyControl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,16 +68,16 @@ public class PasswordPolicyControl implements Control {

try {
ber.startSequence(); // PasswordPolicyResponseValue ::= SEQUENCE
if (ber.isNextTag(BERDecoder.TAG_CLASS_CONTEXT_SPECIFIC, BERDecoder.TAG_FORM_PRIMITIVE, 0)) { // warning [0] CHOICE
if (ber.isNextTag(BERDecoder.TAG_CLASS_CONTEXT_SPECIFIC, BERDecoder.TAG_FORM_CONSTRUCTED, 0)) { // warning [0] CHOICE
ber.skipElement();
}
if (ber.isNextTag(BERDecoder.TAG_CLASS_CONTEXT_SPECIFIC, BERDecoder.TAG_FORM_PRIMITIVE, 1)) { // error [1] ENUMERATED
int error = new BigInteger(ber.drainElementValue()).intValue();
this.changeAfterReset = error == ERROR_CHANGE_AFTER_RESET;
}

} catch (BERDecoder.DecodeException ignored) {
logger.errorf("Failed to parse PasswordPolicyResponseValue: %s", ignored.getMessage());
} catch (BERDecoder.DecodeException | NumberFormatException e) {
logger.errorf("Failed to parse PasswordPolicyResponseValue: %s", e.getMessage());
}
}

Expand Down
36 changes: 33 additions & 3 deletions ...test/java/org/keycloak/storage/ldap/idm/store/ldap/control/PasswordPolicyControlTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,8 @@ public void testDecodeResponseValue() {

@Test
public void testDecodeResponseValueWithWarningAndError() {
// SEQUENCE { warning timeBeforeExpiration(5), error changeAfterReset(2) }
// Note: we don't currently support warning, but at least make sure it doesn't break decoding.
PasswordPolicyControl control = new PasswordPolicyControl(new byte[] { 0x30, 0x07, (byte) 0x80, 0x02, 0x01, 0x05, (byte) 0x81, 0x01, 0x02 });
// SEQUENCE { warning [0] { timeBeforeExpiration(5) }, error changeAfterReset(2) }
PasswordPolicyControl control = new PasswordPolicyControl(new byte[] { 0x30, 0x08, (byte) 0xA0, 0x03, (byte) 0x80, 0x01, 0x05, (byte) 0x81, 0x01, 0x02 });
Assert.assertTrue(control.changeAfterReset());
}

Expand Down Expand Up @@ -97,5 +96,36 @@ public void testDecodeErrorWithOversizedShortFormBERLength() {
Assert.assertFalse(control.changeAfterReset());
}

@Test
public void testDecodeWrappedWarningGraceDoesNotForgeError() {
// SEQUENCE { warning [0] { graceAuthNsRemaining(2) } } — grace value must not be misread as error changeAfterReset(2).
PasswordPolicyControl control = new PasswordPolicyControl(
new byte[] { 0x30, 0x05, (byte) 0xA0, 0x03, (byte) 0x81, 0x01, 0x02 });
Assert.assertFalse(control.changeAfterReset());
}

@Test
public void testDecodeWrappedWarningTimeBeforeExpiration() {
// SEQUENCE { warning [0] { timeBeforeExpiration(42) } }
PasswordPolicyControl control = new PasswordPolicyControl(
new byte[] { 0x30, 0x05, (byte) 0xA0, 0x03, (byte) 0x80, 0x01, 0x2A });
Assert.assertFalse(control.changeAfterReset());
}

@Test
public void testDecodeWrappedWarningDoesNotSuppressError() {
// SEQUENCE { warning [0] { graceAuthNsRemaining(5) }, error changeAfterReset(2) }
PasswordPolicyControl control = new PasswordPolicyControl(
new byte[] { 0x30, 0x08, (byte) 0xA0, 0x03, (byte) 0x81, 0x01, 0x05, (byte) 0x81, 0x01, 0x02 });
Assert.assertTrue(control.changeAfterReset());
}

@Test
public void testDecodeZeroLengthErrorElement() {
// Zero-length error [1] value — treated as a decode failure, no uncaught NumberFormatException.
PasswordPolicyControl control = new PasswordPolicyControl(
new byte[] { 0x30, 0x02, (byte) 0x81, 0x00 });
Assert.assertFalse(control.changeAfterReset());
}

}
Loading
0