From 10a820f2a2155e443c85036eab238f15dd92355b Mon Sep 17 00:00:00 2001
From: Valentin Tolmer <valentin@tolmer.fr>
Date: Wed, 11 Sep 2024 22:15:06 +0200
Subject: [PATCH] server: detect anonymous binds and return a correct error

---
 server/src/infra/ldap_handler.rs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server/src/infra/ldap_handler.rs b/server/src/infra/ldap_handler.rs
index f2729a7..f9f2ea1 100644
--- a/server/src/infra/ldap_handler.rs
+++ b/server/src/infra/ldap_handler.rs
@@ -263,6 +263,12 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
 
     #[instrument(skip_all, level = "debug", fields(dn = %request.dn))]
     pub async fn do_bind(&mut self, request: &LdapBindRequest) -> (LdapResultCode, String) {
+        if request.dn.is_empty() {
+            return (
+                LdapResultCode::InappropriateAuthentication,
+                "Anonymous bind not allowed".to_string(),
+            );
+        }
         let user_id = match get_user_id_from_distinguished_name(
             &request.dn.to_ascii_lowercase(),
             &self.ldap_info.base_dn,