[enhance](auth) introduction of configuration property to prohibit login with empty LDAP password by iaorekhov-1980 · Pull Request #61440 · apache/doris

iaorekhov-1980 · 2026-03-17T12:47:54Z

What problem does this PR solve?

This PR adds new configuration property ldap_allow_empty_pass to prohibit option for existing user to login into LDAP with empty password.
It doesn't impact new approach from #60407 , because since 4.1.x new LDAP plugin explicitly prohibits login with empty pass.
But in legacy version - 3.1.x and 4.0.x such option is still available.
If ldap_allow_empty_pass in ldap.conf is not specified or specified as false - user can't login with empty pass (new behavior, aligned with newly introduced plugin authentication).
If ldap_allow_empty_pass specified as true - login attempt with empty password will be possible as legacy behavior.

Could you please include this PR into 4.x branch, please!

Issue Number: close#60353

Related PR: #xxx

Problem Summary:

Currently for existing user it is possible to login into LDAP with empty password.
New configuration property disables such option, but user is still able to activate legacy behavior and allow login without specified password.

Release note

New ldap_allow_empty_pass property for legacy authentication approach was introduced into ldap.conf to prohibit login with empty LDAP password as it is allowed by LDAP protocol by default.

Check List (For Author)

Test
- Regression test
- Unit Test
- Manual test (add detailed scripts or steps below)
- No need to test or manual test. Explain why:
  - This is a refactor/code format and no logic has been changed.
  - Previous test can cover this change.
  - No code files have been changed.
  - Other reason
Behavior changed:
- No.
- Yes.

ldap.conf and LdapConfig.java - new configuration ldap_allow_empty_pass property with default value false to disable login with empty LDAP password as in latest plugin implementation.
LdapManager.java - added logic to prohibit login with empty LDAP password and placed it into separate method, which is invoked from already existing checkUserPasswd
3.1 user has specified empty password
3.2 property ldap_allow_empty_pass is false and doesn't allow to login with empty password
If both conditions met - authentication is failed and false is returning, as by other check in checkUserPassword
LdapManagerTest.java - introduced set of test methods to validate for existing behavior (with ldap_allow_empty_pass = true) and new one (with ldap_allow_empty_pass property is not specified or specified to false) to check that login is still successful in first case and failed in the second one.

Does this need documentation?
- No.
- Yes. [[enhance](auth) introduction of configuration property to prohibit login with empty LDAP password doris-website#3403]

Check List (For Reviewer who merge this PR)

Confirm the release note
Confirm test cases
Confirm document
Add branch pick label

Thearas · 2026-03-17T12:48:09Z

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

What problem was fixed (it's best to include specific error reporting information). How it was fixed.
Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
What features were added. Why was this function added?
Which code was refactored and why was this part of the code refactored?
Which functions were optimized and what is the difference before and after the optimization?

iaorekhov-1980 · 2026-03-17T13:01:31Z

run buildall

doris-robot · 2026-03-17T14:05:23Z

TPC-H: Total hot run time: 27089 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 8fa563330bafb91c2f9f69f841d845f183198ca7, data reload: false
------ Round 1 ----------------------------------
orders	Doris	NULL	NULL	0	0	0	NULL	0	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL ============================================
q1	17617	4514	4315	4315
q2	q3	10635	811	516	516
q4	4671	362	254	254
q5	7560	1209	1013	1013
q6	181	174	147	147
q7	795	873	655	655
q8	9299	1508	1367	1367
q9	4915	4761	4719	4719
q10	6238	1901	1664	1664
q11	496	260	253	253
q12	700	589	469	469
q13	18029	2944	2187	2187
q14	237	239	223	223
q15	q16	755	735	685	685
q17	743	873	453	453
q18	6148	5442	5311	5311
q19	1113	1002	633	633
q20	549	507	393	393
q21	4439	1862	1507	1507
q22	491	388	325	325
Total cold run time: 95611 ms
Total hot run time: 27089 ms
----- Round 2, with runtime_filter_mode=off -----
orders	Doris	NULL	NULL	150000000	42	6422171781	NULL	22778155	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL ============================================
q1	4776	4670	4657	4657
q2	q3	3893	4344	3815	3815
q4	884	1216	789	789
q5	4096	4446	4339	4339
q6	196	187	148	148
q7	1785	1705	1555	1555
q8	2490	2734	2797	2734
q9	7523	7464	7308	7308
q10	3870	4087	3624	3624
q11	500	432	426	426
q12	505	597	455	455
q13	2810	3129	2330	2330
q14	281	315	277	277
q15	q16	715	765	726	726
q17	1185	1414	1404	1404
q18	7024	6758	6686	6686
q19	987	1004	1013	1004
q20	2067	2158	2028	2028
q21	4208	3590	3351	3351
q22	466	447	389	389
Total cold run time: 50261 ms
Total hot run time: 48045 ms

hello-stephen · 2026-03-17T14:14:34Z

FE UT Coverage Report

Increment line coverage 71.43% (5/7) 🎉
Increment coverage report
Complete coverage report

doris-robot · 2026-03-17T14:16:12Z

TPC-DS: Total hot run time: 169028 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 8fa563330bafb91c2f9f69f841d845f183198ca7, data reload: false
query5	4320	660	523	523
query6	339	223	202	202
query7	4220	476	283	283
query8	358	245	231	231
query9	8748	2760	2725	2725
query10	536	392	358	358
query11	7003	5120	4916	4916
query12	185	129	121	121
query13	1270	470	341	341
query14	5632	3713	3543	3543
query14_1	2867	2822	2795	2795
query15	207	193	176	176
query16	968	475	462	462
query17	891	740	609	609
query18	2445	445	342	342
query19	215	210	182	182
query20	139	136	127	127
query21	215	138	114	114
query22	13255	14148	14701	14148
query23	16283	15861	15542	15542
query23_1	15902	15612	15359	15359
query24	7301	1646	1234	1234
query24_1	1251	1234	1255	1234
query25	551	472	434	434
query26	1251	262	156	156
query27	2779	492	318	318
query28	4499	1856	1875	1856
query29	881	589	487	487
query30	296	226	193	193
query31	1017	946	901	901
query32	90	72	69	69
query33	512	333	290	290
query34	903	907	530	530
query35	645	702	617	617
query36	1080	1112	983	983
query37	139	99	88	88
query38	2972	2883	2891	2883
query39	879	843	825	825
query39_1	797	802	804	802
query40	237	154	134	134
query41	64	65	59	59
query42	262	261	260	260
query43	244	249	223	223
query44 query45	198	194	188	188
query46	891	983	605	605
query47	2846	2135	2071	2071
query48	317	328	231	231
query49	639	455	390	390
query50	715	279	215	215
query51	4124	4205	4003	4003
query52	267	269	265	265
query53	290	339	288	288
query54	309	279	288	279
query55	94	91	88	88
query56	321	330	326	326
query57	1937	1928	1656	1656
query58	308	289	276	276
query59	2835	2963	2789	2789
query60	382	361	352	352
query61	183	183	178	178
query62	639	595	557	557
query63	319	288	283	283
query64	5288	1416	1128	1128
query65 query66	1496	490	375	375
query67	24307	24379	24302	24302
query68 query69	427	335	299	299
query70	1009	987	936	936
query71	351	329	321	321
query72	3033	2826	2462	2462
query73	554	561	315	315
query74	9665	9589	9396	9396
query75	2893	2764	2488	2488
query76	2296	1051	683	683
query77	371	378	316	316
query78	10954	11189	10452	10452
query79	1104	843	578	578
query80	1333	649	551	551
query81	553	267	230	230
query82	998	159	126	126
query83	340	266	249	249
query84	298	129	106	106
query85	949	517	458	458
query86	443	308	300	300
query87	3144	3166	3039	3039
query88	3566	2663	2603	2603
query89	430	371	348	348
query90	2034	189	185	185
query91	180	165	142	142
query92	79	76	74	74
query93	983	904	517	517
query94	651	323	307	307
query95	609	402	326	326
query96	663	539	237	237
query97	2488	2460	2410	2410
query98	240	221	222	221
query99	1001	1012	919	919
Total cold run time: 251426 ms
Total hot run time: 169028 ms

iaorekhov-1980 · 2026-03-18T07:12:40Z

run external

iaorekhov-1980 · 2026-03-18T07:18:15Z

run nonConcurrent

iaorekhov-1980 · 2026-03-23T08:22:58Z

run buildall

doris-robot · 2026-03-23T08:48:41Z

TPC-H: Total hot run time: 26705 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 629cab0bfbfbc28cf613d29f5a7c6acb9bdc9ba7, data reload: false
------ Round 1 ----------------------------------
orders	Doris	NULL	NULL	0	0	0	NULL	0	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL ============================================
q1	17654	4511	4276	4276
q2	q3	10671	758	506	506
q4	4687	366	258	258
q5	7555	1211	1018	1018
q6	173	172	145	145
q7	768	840	670	670
q8	9437	1468	1312	1312
q9	4896	4753	4694	4694
q10	6321	1922	1656	1656
q11	443	260	237	237
q12	751	582	465	465
q13	18070	2915	2195	2195
q14	227	223	213	213
q15	q16	761	758	677	677
q17	713	879	415	415
q18	5929	5335	5229	5229
q19	1101	964	578	578
q20	523	482	377	377
q21	4511	1824	1393	1393
q22	343	391	407	391
Total cold run time: 95534 ms
Total hot run time: 26705 ms
----- Round 2, with runtime_filter_mode=off -----
orders	Doris	NULL	NULL	150000000	42	6422171781	NULL	22778155	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL ============================================
q1	4791	4663	4715	4663
q2	q3	3869	4322	3842	3842
q4	860	1210	799	799
q5	4036	4308	4336	4308
q6	189	176	141	141
q7	1750	1694	1573	1573
q8	2524	2730	2594	2594
q9	7541	7380	7370	7370
q10	3801	3972	3585	3585
q11	525	453	430	430
q12	496	627	457	457
q13	2685	3236	2759	2759
q14	304	312	289	289
q15	q16	734	802	726	726
q17	1169	1363	1356	1356
q18	7168	6915	6629	6629
q19	892	939	955	939
q20	2080	2185	1970	1970
q21	3947	3517	3322	3322
q22	472	430	378	378
Total cold run time: 49833 ms
Total hot run time: 48130 ms

doris-robot · 2026-03-23T08:59:25Z

TPC-DS: Total hot run time: 167913 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 629cab0bfbfbc28cf613d29f5a7c6acb9bdc9ba7, data reload: false
query5	4320	612	511	511
query6	334	232	202	202
query7	4216	456	260	260
query8	365	252	230	230
query9	8718	2726	2707	2707
query10	538	372	337	337
query11	6957	5106	4859	4859
query12	179	129	128	128
query13	1279	454	351	351
query14	5719	3754	3445	3445
query14_1	2880	2826	2877	2826
query15	205	195	177	177
query16	1008	483	461	461
query17	1024	723	638	638
query18	2455	453	355	355
query19	215	224	186	186
query20	133	135	129	129
query21	217	136	115	115
query22	13233	13983	14951	13983
query23	16351	15787	15481	15481
query23_1	15642	15629	16108	15629
query24	7331	1629	1239	1239
query24_1	1239	1237	1245	1237
query25	631	486	409	409
query26	1263	267	151	151
query27	2763	472	295	295
query28	4471	1830	1845	1830
query29	872	578	494	494
query30	304	230	201	201
query31	1063	952	884	884
query32	78	70	73	70
query33	501	337	277	277
query34	880	888	539	539
query35	689	687	593	593
query36	1102	1160	987	987
query37	133	93	83	83
query38	2958	2896	2886	2886
query39	860	821	805	805
query39_1	789	793	792	792
query40	237	152	136	136
query41	63	98	58	58
query42	255	256	252	252
query43	239	256	214	214
query44 query45	198	187	190	187
query46	873	988	606	606
query47	2069	2157	2063	2063
query48	299	326	224	224
query49	626	472	369	369
query50	678	278	208	208
query51	4054	4030	3959	3959
query52	262	263	250	250
query53	295	336	287	287
query54	304	273	265	265
query55	91	88	85	85
query56	313	332	311	311
query57	1914	1855	1630	1630
query58	283	278	267	267
query59	2820	2967	2731	2731
query60	337	342	329	329
query61	154	157	155	155
query62	625	591	524	524
query63	317	286	279	279
query64	5142	1256	1004	1004
query65 query66	1477	464	351	351
query67	24254	24310	24148	24148
query68 query69	411	311	291	291
query70	979	953	967	953
query71	338	310	311	310
query72	2842	2638	2469	2469
query73	533	550	322	322
query74	9633	9603	9401	9401
query75	2873	2771	2451	2451
query76	2274	1038	670	670
query77	354	409	306	306
query78	11021	11084	10438	10438
query79	1115	765	568	568
query80	792	633	569	569
query81	513	260	220	220
query82	1353	152	117	117
query83	336	261	249	249
query84	280	122	100	100
query85	879	506	461	461
query86	372	306	294	294
query87	3219	3103	3016	3016
query88	3563	2622	2662	2622
query89	427	370	347	347
query90	1952	174	178	174
query91	171	171	148	148
query92	74	73	72	72
query93	918	840	492	492
query94	455	313	286	286
query95	595	403	322	322
query96	646	515	231	231
query97	2481	2505	2389	2389
query98	238	228	219	219
query99	1033	1010	906	906
Total cold run time: 249268 ms
Total hot run time: 167913 ms

hello-stephen · 2026-03-23T09:41:12Z

FE UT Coverage Report

Increment line coverage 71.43% (5/7) 🎉
Increment coverage report
Complete coverage report

iaorekhov-1980 · 2026-03-23T12:24:26Z

run external

iaorekhov-1980 · 2026-03-23T15:35:52Z

run external

morningman · 2026-03-25T19:56:35Z

/review

github-actions

Code Review Summary for PR #61440

PR Goal: Add ldap_allow_empty_pass config to prohibit LDAP login with empty passwords.

Critical Checkpoint Conclusions

1. Does the code accomplish its goal? Is there a test that proves it?
Yes. The check is correctly placed in both independent LDAP authentication paths (LdapAuthenticator.internalAuthenticate for MySQL wire protocol and Auth.checkPlainPassword for Thrift/HTTP/Arrow Flight). Tests cover the LdapAuthenticator path. However, there is no test for the Auth.checkPlainPassword path.

2. Is the modification as small, clear, and focused as possible?
Yes. The change is minimal and well-scoped.

3. Concurrency concerns?
The config ldap_allow_empty_pass is a static boolean read without synchronization. This is acceptable for a config flag — worst case is a brief window of stale reads during config reload, which is tolerable for this use case.

4. Configuration items added — should it allow dynamic changes?
Yes — see inline comment. The config should be mutable = true so it can be toggled at runtime without FE restart. This is a pure runtime policy check with no initialization dependency, unlike connection/pool configs.

5. Functionally parallel code paths?
Both independent LDAP auth paths are covered. No parallel paths are missed.

6. Error message quality?
The error message "Access with empty password is prohibited for user %s because of current mode" is vague — "current mode" doesn't explain what mode. See inline comment for suggested improvement.

7. Test coverage?

Unit test covers the LdapAuthenticator path with empty password allowed/denied scenarios. Good.
Missing: test for Auth.checkPlainPassword path (the Thrift/HTTP entry point).
Missing: test with null password (not just empty string "").

8. Incompatible changes / rolling upgrade?
No incompatible changes. Default value true preserves backward compatibility.

9. Observability?
LOG.info is adequate for rejected login attempts.

10. Transaction/persistence?
Not applicable.

11. Performance?
No concerns — the check is a simple boolean comparison on a non-hot path.

12. Other issues?

The LdapManager.checkUserPasswd at line 106 already rejects null passwords (Objects.isNull(passwd) returns false) but does NOT reject empty strings — it will proceed to ldapClient.checkPassword() with an empty string, which typically results in an LDAP "unauthenticated bind" (silently succeeds). This confirms the PR addresses a real security issue.
The PR description mentions ldap_use_ssl in section 3.2 but means ldap_allow_empty_pass — this is a typo in the PR description only (not in code).
The Release note section says "None" but this is a user-visible behavior change (new config property). It should have a release note.

iaorekhov-1980 · 2026-03-26T12:04:08Z

run feut

iaorekhov-1980 · 2026-03-26T12:34:59Z

run feut

iaorekhov-1980 · 2026-03-26T13:40:50Z

run feut

iaorekhov-1980 · 2026-03-26T15:32:10Z

run feut

iaorekhov-1980 · 2026-03-26T15:48:03Z

run feut

iaorekhov-1980 · 2026-03-26T17:30:32Z

run feut

iaorekhov-1980 · 2026-03-26T18:46:59Z

run feut

iaorekhov-1980 · 2026-03-27T09:04:28Z

run feut

iaorekhov-1980 · 2026-03-27T09:38:41Z

run feut

iaorekhov-1980 · 2026-08-14T17:59:23Z

run feut

iaorekhov-1980 · 2026-08-14T18:07:19Z

run feut

hello-stephen · 2026-08-14T19:43:03Z

FE UT Coverage Report

Increment line coverage 100.00% (6/6) 🎉
Increment coverage report
Complete coverage report

iaorekhov-1980 · 2026-08-14T19:59:00Z

run buildall

hello-stephen · 2026-08-14T20:14:14Z

TPC-H: Total hot run time: 17494 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 74b527d36cc6b803046e18e31e11f33551ef2222, data reload: false
------ Round 1 ----------------------------------
============================================
q1	17611	3069	3041	3041
q2	1946	232	154	154
q3	10416	862	533	533
q4	4667	249	197	197
q5	7681	599	398	398
q6	136	114	91	91
q7	530	532	393	393
q8	9238	895	909	895
q9	3449	2370	2368	2368
q10	6501	864	673	673
q11	435	257	243	243
q12	686	383	328	328
q13	17884	1857	1559	1559
q14	162	152	141	141
q15	q16	438	401	369	369
q17	786	727	673	673
q18	3166	2296	2284	2284
q19	1272	862	806	806
q20	623	544	450	450
q21	5689	1659	1899	1659
q22	340	282	239	239
Total cold run time: 93656 ms
Total hot run time: 17494 ms
----- Round 2, with runtime_filter_mode=off -----
============================================
q1	3445	3391	3341	3341
q2	213	203	160	160
q3	2247	2629	2278	2278
q4	1180	1179	901	901
q5	2222	2134	2134	2134
q6	176	121	90	90
q7	1063	928	891	891
q8	1604	1420	1415	1415
q9	3093	3086	3087	3086
q10	1926	1818	1648	1648
q11	349	264	249	249
q12	463	439	341	341
q13	1841	1859	1566	1566
q14	193	169	171	169
q15	q16	393	395	356	356
q17	1044	1028	1023	1023
q18	4985	4446	4789	4446
q19	871	899	875	875
q20	974	946	824	824
q21	3876	3168	3314	3168
q22	411	346	334	334
Total cold run time: 32569 ms
Total hot run time: 29295 ms

hello-stephen · 2026-08-14T20:20:51Z

TPC-DS: Total hot run time: 85501 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 74b527d36cc6b803046e18e31e11f33551ef2222, data reload: false
query5	4220	405	331	331
query6	390	155	149	149
query7	4918	431	273	273
query8	308	118	115	115
query9	8663	2903	2912	2903
query10	416	264	222	222
query11	5377	1050	933	933
query12	120	74	69	69
query13	1198	462	341	341
query14	5949	2034	1885	1885
query14_1	1792	1785	1787	1785
query15	179	120	114	114
query16	921	403	391	391
query17	807	474	378	378
query18	2345	326	257	257
query19	171	143	113	113
query20	71	70	69	69
query21	231	120	100	100
query22	5316	5320	5198	5198
query23	7270	6828	6455	6455
query23_1	6736	6696	6661	6661
query24	7287	1088	772	772
query24_1	774	782	804	782
query25	408	279	236	236
query26	1248	255	170	170
query27	2725	450	278	278
query28	4628	1517	1510	1510
query29	915	438	346	346
query30	268	181	147	147
query31	970	661	615	615
query32	96	49	48	48
query33	458	203	177	177
query34	992	816	483	483
query35	406	383	341	341
query36	565	550	520	520
query37	120	85	69	69
query38	1002	848	837	837
query39	523	513	516	513
query39_1	525	530	532	530
query40	222	125	114	114
query41	53	52	54	52
query42	74	73	73	73
query43	242	252	215	215
query44	1021	573	593	573
query45	110	106	97	97
query46	770	873	510	510
query47	988	955	951	951
query48	296	309	233	233
query49	540	245	182	182
query50	841	338	263	263
query51	8188	8127	8011	8011
query52	67	76	60	60
query53	211	220	162	162
query54	236	177	169	169
query55	72	57	53	53
query56	228	209	206	206
query57	653	644	607	607
query58	231	189	193	189
query59	1106	1064	1011	1011
query60	257	217	206	206
query61	154	159	156	156
query62	365	206	173	173
query63	195	171	156	156
query64	2738	726	536	536
query65	1647	1525	1504	1504
query66	1796	290	234	234
query67	9820	9823	9758	9758
query68	3091	1233	750	750
query69	360	217	219	217
query70	647	582	570	570
query71	299	247	243	243
query72	2330	1770	1613	1613
query73	635	594	342	342
query74	2002	1232	1154	1154
query75	1237	1163	1009	1009
query76	2361	748	547	547
query77	252	243	199	199
query78	5098	4841	4509	4509
query79	1151	852	568	568
query80	1169	379	346	346
query81	469	197	166	166
query82	658	131	111	111
query83	352	250	233	233
query84	300	121	113	113
query85	841	436	370	370
query86	395	183	168	168
query87	975	999	918	918
query88	2796	2121	2136	2121
query89	311	228	206	206
query90	1926	141	146	141
query91	152	149	125	125
query92	51	45	45	45
query93	1361	1181	770	770
query94	633	251	227	227
query95	637	438	337	337
query96	856	580	307	307
query97	1075	1040	1005	1005
query98	149	139	133	133
query99	409	346	299	299
Total cold run time: 178879 ms
Total hot run time: 85501 ms

hello-stephen · 2026-08-14T20:25:15Z

ClickBench: Total hot run time: 14.86 s

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit 74b527d36cc6b803046e18e31e11f33551ef2222, data reload: false
query1	0.00	0.00	0.01
query2	0.08	0.04	0.04
query3	0.25	0.11	0.11
query4	1.61	0.10	0.11
query5	0.17	0.17	0.15
query6	1.26	0.67	0.67
query7	0.04	0.01	0.00
query8	0.05	0.03	0.04
query9	0.28	0.20	0.20
query10	0.37	0.35	0.35
query11	0.16	0.12	0.12
query12	0.14	0.11	0.12
query13	0.32	0.31	0.31
query14	0.46	0.48	0.47
query15	0.36	0.35	0.34
query16	0.23	0.24	0.23
query17	0.69	0.70	0.66
query18	0.19	0.16	0.17
query19	1.28	1.21	1.16
query20	0.02	0.01	0.01
query21	15.44	0.15	0.11
query22	5.08	0.05	0.04
query23	16.18	0.25	0.10
query24	3.17	0.31	0.25
query25	0.12	0.04	0.04
query26	0.72	0.17	0.13
query27	0.03	0.02	0.03
query28	3.61	0.53	0.26
query29	12.46	3.16	2.67
query30	0.27	0.11	0.12
query31	2.78	0.38	0.17
query32	3.53	0.33	0.23
query33	1.47	1.44	1.57
query34	15.44	2.31	1.82
query35	1.77	1.76	1.74
query36	0.46	0.31	0.29
query37	0.07	0.04	0.04
query38	0.05	0.03	0.02
query39	0.03	0.02	0.02
query40	0.11	0.08	0.07
query41	0.09	0.02	0.03
query42	0.03	0.02	0.02
query43	0.04	0.03	0.03
Total cold run time: 90.91 s
Total hot run time: 14.86 s

iaorekhov-1980 · 2026-08-16T17:33:12Z

Hello, @morningman
Thanks for your prompt response and precise and easily addressed review.
I've aligned the implementation of PR with requested changes, so could you please take a look and proceed?
Thanks in advance!

iaorekhov-1980 · 2026-08-17T07:20:53Z

run buildall

iaorekhov-1980 · 2026-08-17T10:21:26Z

run compile

…w one

Address the review findings on the empty-password LDAP guard: conf/ldap.conf: the commented-out line declared `ldap_allow_empty_pass = true` while the shipped default is `false`, and the surrounding text still described the abandoned "default true" design. In a Doris conf file the commented `# key = value` line *is* the declaration of the default, so an operator locked out after the upgrade would read the one document that explains this switch and be told the hole is already open. Rewrite it to match the code, state that the config is not runtime-mutable, and name the mechanism instead of the "4.1" version tag, which cannot be verified in-tree and would be wrong once this change is picked to branch-4.0 / branch-3.1. LdapConfig: expand the javadoc so it says the same thing as conf/ldap.conf. LdapManager: the comment above the guard had the condition backwards - it said login is disabled "in case when specific property is true", while the rejection actually happens when the property is false. Replace it with an explanation of why the check has to run before the cached-password comparison and the LDAP bind. Inline isEmptyPasswordLoginAllowed(): it returned true for any non-empty password, so the predicate did not describe its own contract, and its Strings.isNullOrEmpty() re-tested a null that checkUserPasswd() has already rejected a few lines above. LdapManagerTest: testCachedEmptyPasswordIsRejectedAfterFlagDisabled neither disabled the flag nor asserted any rejection - it re-ran the "allowed" scenario under a name that claimed otherwise, and the comment belonging to its second half was left stranded outside any method body. Complete it. Add testEmptyPasswordIsRejectedBeforeCacheLookup to pin the ordering invariant the whole fix rests on: the cached-password comparison returns true on plain string equality without consulting the flag, so the guard is the only barrier between a cached empty password and a successful login, and nothing was asserting that getUserInfo() is not reached first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

morningman · 2026-08-17T15:19:14Z

Local pipeline review — ✅ PASS

schema: doris-repo-review/v1status: PASSpr: apache/doris#61440commit: 3ee24dfcc664baf0ff8ee470ad2e2d93c8098241base: 168d07778338761de5da5f0e97c36eee1e265b4breviewed_at: 2026-08-17T23:19+08:00reviewer: morningmanmodel: claude-opus-5[1m]effort: maxfindings: {blocker: 0, major: 0, minor: 2, nit: 4}rounds: 2converged: false

Notes for maintainers

fe/fe-core/src/main/java/org/apache/doris/mysql/authenticate/ldap/LdapManager.java:137 — this WARN is the only server-side record of the rejection: ErrorReport.report in LdapAuthenticator writes no log, AuthenticatorManager's IP-carrying WARN is suppressed because LdapAuthenticator returns the null-failureSummaryfailedResponse singleton, and AuditEvent.EventType.CONNECTION is never constructed. Worth adding the client IP; also the message spells the key ldapAllowEmptyPass, which occurs nowhere else in the tree (the snake_case ldap_allow_empty_pass occurs ten times), so it is not greppable from the name in ldap.conf.
fe/fe-common/src/main/java/org/apache/doris/common/LdapConfig.java:209-210 — the absence of mutable = true is now a documented security contract, but no test fails if it is added back, and an earlier automated review on this PR did argue for adding it. ConfigTest.testSecurityPathConfigsAreNotRuntimeMutable is the precedent; note that appending the key to that array would fail with "does not exist" rather than "is not mutable", because ldapConfFields is unpopulated in a unit-test JVM — assert on the annotation instead.
conf/ldap.conf:55-56 — "normally reports it as successful" is server-dependent rather than universal (RFC 4513 §5.1.2 says servers SHOULD reject unauthenticated binds; AD accepts, default OpenLDAP does not). Nothing in the tree establishes either outcome. The case for the false default is stronger when stated accurately.
Chokepoint completeness was verified rather than assumed: fe/fe-core/src/main/java/org/apache/doris/mysql/authenticate/ldap/LdapClient.java:175 is the only end-user LDAP bind in fe-core and its only caller sits below the gate; MySQL, HTTP, Arrow Flight, stream load and the FrontendServiceImpl Thrift RPCs all funnel through LdapAuthenticator or Auth.checkPlainPassword. root/admin are excluded twice and cannot be locked out. The conf/ldap.conf claim that the fe-authentication plugin always rejects empty passwords is true.
converged: false is reported honestly rather than as a problem: round 1 closed the correctness, configuration, compatibility and coverage ground; round 2 re-attacked it without result but did add three new Nit candidates (naming and comment wording), so the loop was stopped at 2 of a maximum 3 rounds without reaching a clean zero-new-candidate state. No Blocker or Major was found in either round.

_{Reviewed locally with the doris-repo-review pipeline (a local port of .github/workflows/code-review-runner.yml). This is not a CI status check.}

morningman · 2026-08-18T03:13:43Z

run buildall

hello-stephen · 2026-08-18T04:44:57Z

FE UT Coverage Report

Increment line coverage 100.00% (3/3) 🎉
Increment coverage report
Complete coverage report

hello-stephen · 2026-08-18T05:28:19Z

TPC-H: Total hot run time: 17025 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 3ee24dfcc664baf0ff8ee470ad2e2d93c8098241, data reload: false
------ Round 1 ----------------------------------
orders	Doris	NULL	NULL	0	0	0	NULL	0	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL ============================================
q1	17560	3081	3027	3027
q2	q3	10858	895	511	511
q4	4677	255	214	214
q5	7660	581	394	394
q6	142	121	95	95
q7	541	513	398	398
q8	9253	869	859	859
q9	3470	2389	2384	2384
q10	6531	873	720	720
q11	448	259	247	247
q12	686	398	338	338
q13	17861	1533	1163	1163
q14	157	148	138	138
q15	q16	474	393	376	376
q17	722	797	816	797
q18	3157	2261	2278	2261
q19	1128	924	774	774
q20	720	525	471	471
q21	5317	1625	1827	1625
q22	326	281	233	233
Total cold run time: 91688 ms
Total hot run time: 17025 ms
----- Round 2, with runtime_filter_mode=off -----
orders	Doris	NULL	NULL	150000000	42	6422171781	NULL	22778155	NULL	NULL	2023-12-26 18:27:23	2023-12-26 18:42:55	NULL	utf-8	NULL	NULL ============================================
q1	3441	3368	3332	3332
q2	q3	2222	2335	2197	2197
q4	1191	1168	891	891
q5	2177	2137	2090	2090
q6	173	122	94	94
q7	1052	946	868	868
q8	1603	1413	1422	1413
q9	3150	3117	3096	3096
q10	1841	1788	1640	1640
q11	367	274	261	261
q12	449	431	344	344
q13	1495	1541	1174	1174
q14	176	169	169	169
q15	q16	396	387	365	365
q17	1036	1028	1033	1028
q18	4993	4377	4721	4377
q19	855	843	843	843
q20	959	962	814	814
q21	3513	3338	3261	3261
q22	405	341	328	328
Total cold run time: 31494 ms
Total hot run time: 28585 ms

hello-stephen · 2026-08-18T05:34:49Z

TPC-DS: Total hot run time: 80940 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 3ee24dfcc664baf0ff8ee470ad2e2d93c8098241, data reload: false
query5	4273	439	355	355
query6	429	163	150	150
query7	4826	436	265	265
query8	298	129	119	119
query9	8700	2904	2913	2904
query10	416	279	231	231
query11	5386	1056	920	920
query12	119	70	71	70
query13	1193	468	336	336
query14	6091	2217	2123	2123
query14_1	2018	1993	1995	1993
query15	173	123	115	115
query16	908	376	357	357
query17	799	448	388	388
query18	2318	323	230	230
query19	163	134	110	110
query20	72	69	68	68
query21	209	115	100	100
query22	5521	5379	5267	5267
query23	6716	6096	6085	6085
query23_1	6202	6168	6116	6116
query24	7253	1067	762	762
query24_1	785	789	805	789
query25	414	302	241	241
query26	1251	281	166	166
query27	2708	448	283	283
query28	4598	1494	1492	1492
query29	932	430	340	340
query30	283	178	153	153
query31	863	439	354	354
query32	94	48	48	48
query33	476	213	177	177
query34	991	821	477	477
query35	440	396	335	335
query36	567	546	525	525
query37	118	80	66	66
query38	985	838	799	799
query39	512	465	505	465
query39_1	456	449	446	446
query40	209	136	113	113
query41	55	49	54	49
query42	81	75	78	75
query43	241	245	228	228
query44 query45	116	106	100	100
query46	800	856	528	528
query47	764	737	706	706
query48	319	307	238	238
query49	535	237	183	183
query50	854	325	264	264
query51	8149	8014	8191	8014
query52	74	78	79	78
query53	207	211	165	165
query54	229	212	196	196
query55	78	69	73	69
query56	323	246	228	228
query57	686	687	651	651
query58	230	207	206	206
query59	1222	1241	1110	1110
query60	262	238	210	210
query61	140	143	142	142
query62	372	211	187	187
query63	191	162	160	160
query64	2909	803	627	627
query65 query66	1909	307	255	255
query67	9933	9986	9845	9845
query68 query69	403	219	211	211
query70	634	639	606	606
query71	288	249	234	234
query72	2425	1775	1642	1642
query73	660	604	339	339
query74	1632	1246	1170	1170
query75	1253	1152	1022	1022
query76	2350	749	564	564
query77	258	247	212	212
query78	3892	3618	3177	3177
query79	3021	785	574	574
query80	1581	412	344	344
query81	508	195	175	175
query82	623	126	107	107
query83	314	251	234	234
query84 query85	852	456	385	385
query86	477	174	163	163
query87	986	977	902	902
query88	4124	2155	2177	2155
query89	305	230	211	211
query90	2103	149	145	145
query91	157	143	126	126
query92	67	48	44	44
query93	3043	1120	755	755
query94	651	249	227	227
query95	616	372	335	335
query96	807	587	273	273
query97	1065	1039	1016	1016
query98	180	138	133	133
query99	407	340	315	315
Total cold run time: 176500 ms
Total hot run time: 80940 ms

dismiss

iaorekhov-1980 changed the title ~~[enhance] (auth) add option to disable login with empty pass~~[enhance](auth) introduction of configuration property to prohibit login with empty LDAP passwordMar 17, 2026

iaorekhov-1980 marked this pull request as ready for review March 18, 2026 09:15

iaorekhov-1980 force-pushed the feat/disable_ldap_empty_pass branch from 8fa5633 to 629cab0Compare March 23, 2026 07:38

morningman self-assigned this Mar 25, 2026

github-actionsBot reviewed Mar 25, 2026
View reviewed changes

Comment threadfe/fe-common/src/main/java/org/apache/doris/common/LdapConfig.java Outdated
Comment threadfe/fe-common/src/main/java/org/apache/doris/common/ErrorCode.java
Comment threadfe/fe-core/src/main/java/org/apache/doris/mysql/authenticate/ldap/LdapAuthenticator.java

iaorekhov-1980 force-pushed the feat/disable_ldap_empty_pass branch 2 times, most recently from aaa284b to 267c2e3Compare March 26, 2026 11:17

iaorekhov-1980 force-pushed the feat/disable_ldap_empty_pass branch from 47d78e1 to aea784fCompare August 14, 2026 18:07

iaorekhov-1980 force-pushed the feat/disable_ldap_empty_pass branch from aea784f to 74b527dCompare August 14, 2026 19:58

iaorekhov-1980 force-pushed the feat/disable_ldap_empty_pass branch from 74b527d to 804326aCompare August 17, 2026 07:16

iaorekhov-1980and others added 8 commits August 17, 2026 22:27

feat: disable LDAP empty password authentication
8d41404

covering comments from morningman's review
a345db2

covering comments from copilot's review
ae4884e

review: align error code with mysql
f82d2e4

refactor: move empty-password check to LdapManager.checkUserPasswd
01da1bd

implement comments from copilot's - return common error instead of ne…
55e0eb4
…w one

align implementation with last review from maintainer
db2100b

morningman force-pushed the feat/disable_ldap_empty_pass branch from 00a6a24 to 3ee24dfCompare August 17, 2026 14:30

morningman approved these changes Aug 18, 2026
View reviewed changes

iaorekhov-1980 mentioned this pull request Aug 19, 2026
[enhance](auth) introduction of configuration property to prohibit login with empty LDAP password apache/doris-website#3403
Open
8 tasks

Uh oh!

Conversation

iaorekhov-1980 commented Mar 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What problem does this PR solve?

Release note

Check List (For Author)

Check List (For Reviewer who merge this PR)

Uh oh!

Thearas commented Mar 17, 2026

Uh oh!

iaorekhov-1980 commented Mar 17, 2026

Uh oh!

doris-robot commented Mar 17, 2026

Uh oh!

hello-stephen commented Mar 17, 2026

FE UT Coverage Report

Uh oh!

doris-robot commented Mar 17, 2026

Uh oh!

iaorekhov-1980 commented Mar 18, 2026

Uh oh!

iaorekhov-1980 commented Mar 18, 2026

Uh oh!

iaorekhov-1980 commented Mar 23, 2026

Uh oh!

doris-robot commented Mar 23, 2026

Uh oh!

doris-robot commented Mar 23, 2026

Uh oh!

hello-stephen commented Mar 23, 2026

FE UT Coverage Report

Uh oh!

iaorekhov-1980 commented Mar 23, 2026

Uh oh!

iaorekhov-1980 commented Mar 23, 2026

Uh oh!

morningman commented Mar 25, 2026

Uh oh!

github-actionsBot left a comment

Choose a reason for hiding this comment

Code Review Summary for PR #61440

Critical Checkpoint Conclusions

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iaorekhov-1980 commented Mar 26, 2026

Uh oh!

iaorekhov-1980 commented Mar 26, 2026

Uh oh!

iaorekhov-1980 commented Mar 26, 2026

Uh oh!

iaorekhov-1980 commented Mar 26, 2026

Uh oh!

iaorekhov-1980 commented Mar 26, 2026

Uh oh!

iaorekhov-1980 commented Mar 26, 2026

Uh oh!

iaorekhov-1980 commented Mar 26, 2026

Uh oh!

iaorekhov-1980 commented Mar 27, 2026

Uh oh!

iaorekhov-1980 commented Mar 27, 2026

Uh oh!

iaorekhov-1980 commented Aug 14, 2026

Uh oh!

iaorekhov-1980 commented Aug 14, 2026

Uh oh!

hello-stephen commented Aug 14, 2026

FE UT Coverage Report

Uh oh!

iaorekhov-1980 commented Aug 14, 2026

Uh oh!

hello-stephen commented Aug 14, 2026

Uh oh!

hello-stephen commented Aug 14, 2026

Uh oh!

hello-stephen commented Aug 14, 2026

Uh oh!

iaorekhov-1980 commented Mar 17, 2026•
edited
Loading