NET::LDAP.bind returns true when user password is empty

[edmundoa]

Hello,

I am using net-ldap-0.3.1 on a Rails application to perform user authentication against our LDAP server. When the user types in the form an existing username but leaves the password field empty, calling bind method will return true instead of false, as one would think reading method's documentation (http://net-ldap.rubyforge.org/Net/LDAP.html#method-i-bind).

I am not sure if it's a problem with the gem or with our LDAP server, but I have seen there is an old thread with this issue [1] and I think it would make sense at least to write a little warning in the documentation regarding this problem.

Thank you.

Best regards

[1] http://rubyforge.org/forum/forum.php?thread_id=15539&forum_id=586

[jzinn]

It's a feature of LDAP called Unauthenticated Authentication. See RFC 4513 sections 5.1.2 and 6.3.1.

[Ajedi32]

Duplicate of #5

[mtodd]

Closing in favor of #5.