Passwords are handled differently in the MCB than in the default IdP code

[Mark McCoy]

(FYI, I’ve created an issue in Github but I wanted to make sure any others who have implemented the MCB recently are aware of this.)

We have had reports from several users who are unable to login to our Shibboleth server after implementing the MCB plugin to the IdP. After severals days of troubleshooting, I lucked into the solution when one of our help desk staff (against policy but I’m glad they did!) added the user's password to their support ticket. The password has a space at the end, which is allowed by our password policy (it's actually a passphrase policy, which allows spaces). I replicated the conditions for this user by taking a test account and attempting to login with a passphrase that has no whitespace at either end and again after changing to a passphrase with a space character at the end. The second test failed, which led me to look at the source for both the IdP and the MCB.

The default behavior of the IdP is to pass the user's password as-is to the authentication source, but the MCB runs it through the DatatypeHelper.safeTrimOrNullString() method first, which strips whitespace off of the beginning or end of the password.

Luckily we are in the middle of the Summer, but as the Fall starts we will probably run into many more users with this issue.

Thanks,
Mark

---
Mark McCoy
Identity Management
The University of Texas at San Antonio
210-458-5871

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150716/8bcdde2d/attachment.html>