To reproduce:

1) Create a local drupal user that could authenticate with LDAP if they tried. do not login with the user yet.
2) enable LDAP with the following settings:
* "only LDAP authenticaiton is allowed except for user 1"
3) visit example.com/user/password
4) request new password for user created in 1
5) click on the password reset link that the user received via email, verify that it works (!!)
...
6) login normally with user created in 1. verify LDAP authentication works
7) repeat step 3, verify that the user is no longer able to generate a one time login link by visiting user/password (as expected)

Comments

joelcollinsdc’s picture

joelcollinsdc commented
Issue summary: View changes

make instructions more clear

slashack’s picture

slashack commented
Issue summary: View changes

Can confirm this. Totally anoying while migrating a site since a non-ldap user can login.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Status: Active » Closed (outdated)

no update for > 12 months - closing

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented

Unpublished because security issue

drumm’s picture

drumm
he/him
Location NY, US
commented
Component: Security » Code

Publishing since this was fixed with https://www.drupal.org/project/ldap/releases/7.x-2.0-beta12. This did not affect a stable release, so there was no advisory.

Please report potential security issues confidentially in the future.