{"action":"closed","issue":{"url":"https://api.github.com/repos/cannatag/ldap3/issues/174","repository_url":"https://api.github.com/repos/cannatag/ldap3","labels_url":"https://api.github.com/repos/cannatag/ldap3/issues/174/labels{/name}","comments_url":"https://api.github.com/repos/cannatag/ldap3/issues/174/comments","events_url":"https://api.github.com/repos/cannatag/ldap3/issues/174/events","html_url":"https://github.com/cannatag/ldap3/issues/174","id":153572879,"number":174,"title":"connection switch silently to anonymous bind if password is empty, failing auth","user":{"login":"brianmay","id":112729,"avatar_url":"https://avatars.githubusercontent.com/u/112729?v=3","gravatar_id":"","url":"https://api.github.com/users/brianmay","html_url":"https://github.com/brianmay","followers_url":"https://api.github.com/users/brianmay/followers","following_url":"https://api.github.com/users/brianmay/following{/other_user}","gists_url":"https://api.github.com/users/brianmay/gists{/gist_id}","starred_url":"https://api.github.com/users/brianmay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brianmay/subscriptions","organizations_url":"https://api.github.com/users/brianmay/orgs","repos_url":"https://api.github.com/users/brianmay/repos","events_url":"https://api.github.com/users/brianmay/events{/privacy}","received_events_url":"https://api.github.com/users/brianmay/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-07T04:29:46Z","updated_at":"2016-05-07T07:05:17Z","closed_at":"2016-05-07T07:05:17Z","body":"Hello,\r\n\r\nThis bug was reported against the Debian package [here](http://bugs.debian.org/823488):\r\n\r\nWhen creating a connection with the Connection object the code defaults to \r\nAUTH_ANONYMOUS (doing so an anonymus bind) also when _only_ the password\r\nis empty (not, as said by documentation, when both user and password are \r\nempty). \r\n\r\nThese the lines of /usr/lib/python3/dist-packages/ldap3/core/connection.py\r\nwhere the problem is:\r\n\r\n```python\r\nself.user = user\r\nself.password = password\r\nif self.user and self.password and not authentication:\r\n    self.authentication = AUTH_SIMPLE\r\nelif not authentication:\r\n    self.authentication = AUTH_ANONYMOUS\r\nelif authentication in [AUTH_SIMPLE, AUTH_ANONYMOUS, AUTH_SASL]:\r\n    self.authentication = authentication\r\nelse:\r\n    self.last_error = 'unknown authentication method'\r\n    raise LDAPUnknownAuthenticationMethodError(self.last_error)\r\n```\r\n\r\nIf password is empty, according to default of None for authentication, the \r\nfirst if fails and then is selected the second elif.\r\n\r\nThat means that you will get a valid object with anonymous bind, \r\nthe user presence will be simply ignored but, and so when you use \r\nobject also to check autentication, looking if you get a connection \r\n(as it should be), you will got authentication for every user just \r\ngiving an empty password.\r\n\r\nThat's plain wrong, contrary to what is said in the documentation here:\r\n\r\nhttp://ldap3.readthedocs.io/connections.html\r\n\r\nand very dangerous (the more plain way to use the library will bring people \r\nto enable empty password access for any user). \r\n"}}