{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2214","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2214/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2214/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2214/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/2214","id":154071518,"number":2214,"title":"Authentication form let's users login without entering a password","user":{"login":"eorochena","id":6799455,"avatar_url":"https://avatars.githubusercontent.com/u/6799455?v=3","gravatar_id":"","url":"https://api.github.com/users/eorochena","html_url":"https://github.com/eorochena","followers_url":"https://api.github.com/users/eorochena/followers","following_url":"https://api.github.com/users/eorochena/following{/other_user}","gists_url":"https://api.github.com/users/eorochena/gists{/gist_id}","starred_url":"https://api.github.com/users/eorochena/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eorochena/subscriptions","organizations_url":"https://api.github.com/users/eorochena/orgs","repos_url":"https://api.github.com/users/eorochena/repos","events_url":"https://api.github.com/users/eorochena/events{/privacy}","received_events_url":"https://api.github.com/users/eorochena/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Graylog2/graylog2-server/labels/needs-input","name":"needs-input","color":"006b75"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-05-10T18:12:32Z","updated_at":"2016-05-11T15:35:16Z","closed_at":null,"body":"### Problem description\r\nWeb Application - Authentication form let's users login without entering a password as long as the account is \"valid\" in previous versions under graylog-web it used to display \"Please fill out all fields.\" message\r\n\r\n### Steps to reproduce the problem\r\n1. Login with any valid user id with empty/no password.\r\n\r\n\r\n### Environment\r\n\r\n* Graylog Version: 2.0\r\n* Elasticsearch Version: 2.3.2-1\r\n* MongoDB Version: 2.4.14-1\r\n* Operating System: CentOS 6 and CentOS 7\r\n* Browser version: Google Chrome  48.0.2564.109 (64-bit) and Mozilla Firefox 44.0.2\r\n"},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/comments/218497375","html_url":"https://github.com/Graylog2/graylog2-server/issues/2214#issuecomment-218497375","issue_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2214","id":218497375,"user":{"login":"edmundoa","id":716185,"avatar_url":"https://avatars.githubusercontent.com/u/716185?v=3","gravatar_id":"","url":"https://api.github.com/users/edmundoa","html_url":"https://github.com/edmundoa","followers_url":"https://api.github.com/users/edmundoa/followers","following_url":"https://api.github.com/users/edmundoa/following{/other_user}","gists_url":"https://api.github.com/users/edmundoa/gists{/gist_id}","starred_url":"https://api.github.com/users/edmundoa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edmundoa/subscriptions","organizations_url":"https://api.github.com/users/edmundoa/orgs","repos_url":"https://api.github.com/users/edmundoa/repos","events_url":"https://api.github.com/users/edmundoa/events{/privacy}","received_events_url":"https://api.github.com/users/edmundoa/received_events","type":"User","site_admin":false},"created_at":"2016-05-11T15:35:15Z","updated_at":"2016-05-11T15:35:15Z","body":"@eorochena I was trying to reproduce the main issue, but I couldn't get to log in with a LDAP user if I didn't provide a password. Could it be a misconfiguration in your LDAP server? Specially verify that you cannot bind to the server without a password.\r\n\r\nRegarding the second issue, the code is not bypassed, it changed and we don't check that the username and password are given, we rely on the authentication layer to do that instead."}}