spring-projects / spring-projects/spring-security
InetOrgPerson uid should not be a mandatory field - may cause regression as of version 7.1.0
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
- CTOR
org.springframework.security.ldap.userdetails.InetOrgPerson.Essence.Essence(DirContextOperations)with attribute "uid" null, throwsIllegalArgumentExceptionwith "uid cannot be null". org.springframework.security.ldap.userdetails.InetOrgPerson.getUid()while uid is null throwsNullPointerExceptionwith "uid cannot be null".
The source code contradicts itself in these lines
private @Nullable String uid;
public String getUid() {
return Objects.requireNonNull(this.uid, "uid cannot be null");
}
Came with this commit:
https://github.com/spring-projects/spring-security/commit/c5632ccd838fcb2753a978918561081cff037510
To Reproduce
divert from https://github.com/spring-projects/spring-security/blob/ed7ae7969ed2452e6ab76c505bdc6afb9bb957ac/ldap/src/test/java/org/springframework/security/ldap/userdetails/InetOrgPersonTests.java#L120 with uid null
Expected behavior
"uid" should be nullable throughout (to my knowledge and according to LDAP Schema, it's not a mandatory field).
To my knowledge, this was also the behaviour before 7.1.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with org.springframework.security.ldap.userdetails.InetOrgPerson.Essence and InetOrgPerson.getUid(), then inspect ldap/src/test/java/org/springframework/security/ldap/userdetails/InetOrgPersonTests.java around the referenced test. Reproduce the case with a null uid and verify that construction and uid access remain nullable without the reported exceptions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100