From b40098d3b3b0571ad7053d483d7ed58b10700045 Mon Sep 17 00:00:00 2001 From: Rajani Karuturi Date: Fri, 10 Feb 2017 00:13:13 +0530 Subject: [PATCH] Bug-ID:CLOUDSTACK-9369 Fixed Ldap regression Ldap auto creation of accounts is broken due to the security fix for CLOUDSTACK-9369. There was an explicit check to not allow login incase the user doesnt exist. removed the same. --- .../src/com/cloud/api/auth/DefaultLoginAPIAuthenticatorCmd.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/src/com/cloud/api/auth/DefaultLoginAPIAuthenticatorCmd.java b/server/src/com/cloud/api/auth/DefaultLoginAPIAuthenticatorCmd.java index c83e7080edc..249be78e0bf 100644 --- a/server/src/com/cloud/api/auth/DefaultLoginAPIAuthenticatorCmd.java +++ b/server/src/com/cloud/api/auth/DefaultLoginAPIAuthenticatorCmd.java @@ -166,7 +166,7 @@ public class DefaultLoginAPIAuthenticatorCmd extends BaseCmd implements APIAuthe throw new CloudAuthenticationException("Unable to find the domain from the path " + domain); } final UserAccount userAccount = _accountService.getActiveUserAccount(username[0], domainId); - if (userAccount == null || !(User.Source.UNKNOWN.equals(userAccount.getSource()) || User.Source.LDAP.equals(userAccount.getSource()))) { + if (userAccount != null && User.Source.SAML2 == userAccount.getSource()) { throw new CloudAuthenticationException("User is not allowed CloudStack login"); } return ApiResponseSerializer.toSerializedString(_apiServer.loginUser(session, username[0], pwd, domainId, domain, remoteAddress, params),