[L1] LDAP uses anonymous (unauthenticated) bind

[pradeepto]

Severity: Low

Category

Authentication (OWASP A07)

Files

pkg/clients/ldap/client.go:54

Description

The LDAP connection uses UnauthenticatedBind("") (anonymous bind). This works for read-only access to public directory attributes but it means the LDAP server must be configured to restrict what anonymous clients can see. If the LDAP server ACLs are misconfigured more data than intended could be accessible to the operator.

Fix

Consider using authenticated bind with service account credentials if the LDAP server supports it. If anonymous bind is intentional document the design decision and ensure LDAP server ACLs are reviewed.

[vinamra28]

yes you are right, this requires changes in the appconfig as well which can accept service account credentials for the authentication bind. We should also handle this gracefully so that if service account details aren't provided, a warning is logged and should proceed with unauthenticated bind.