From bc7f84fff4bf70e7e3fc880d3113e823abc5aefc Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Wed, 28 Jul 2021 12:47:52 +0200 Subject: [PATCH] sources/ldap: improve ms-ad password complexity checking Signed-off-by: Jens Langhammer --- authentik/sources/ldap/password.py | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/authentik/sources/ldap/password.py b/authentik/sources/ldap/password.py index 24c064cfc..6a5d49601 100644 --- a/authentik/sources/ldap/password.py +++ b/authentik/sources/ldap/password.py @@ -105,15 +105,17 @@ class LDAPPasswordChanger: if len(user_attributes["sAMAccountName"]) >= 3: if password.lower() in user_attributes["sAMAccountName"].lower(): return False - display_name_tokens = split( - RE_DISPLAYNAME_SEPARATORS, user_attributes["displayName"] - ) - for token in display_name_tokens: - # Ignore tokens under 3 chars - if len(token) < 3: - continue - if token.lower() in password.lower(): - return False + # No display name set, can't check any further + if len(user_attributes["displayName"]) < 1: + return True + for display_name in user_attributes["displayName"]: + display_name_tokens = split(RE_DISPLAYNAME_SEPARATORS, display_name) + for token in display_name_tokens: + # Ignore tokens under 3 chars + if len(token) < 3: + continue + if token.lower() in password.lower(): + return False return True def ad_password_complexity(