{"record":{"id":"a4a2ce2b4ed23352","repo":"flowable/flowable-engine","slug":"null-or-empty-passwords-are-not-allowed","errorCode":null,"errorMessage":"Null or empty passwords are not allowed!","messagePattern":"Null or empty passwords are not allowed!","errorType":"exception","errorClass":"FlowableException","httpStatus":null,"severity":"error","filePath":"modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java","lineNumber":144,"sourceCode":"    @Override\n    public NativeGroupQuery createNativeGroupQuery() {\n        throw new FlowableException(\"LDAP identity service doesn't support native querying\");\n    }\n\n    @Override\n    public void saveGroup(Group group) {\n        throw new FlowableException(\"LDAP identity service doesn't support saving a group\");\n    }\n\n    @Override\n    public void deleteGroup(String groupId) {\n        throw new FlowableException(\"LDAP identity service doesn't support deleting a group\");\n    }\n\n    protected boolean executeCheckPassword(final String userId, final String password) {\n        // Extra password check, see http://forums.activiti.org/comment/22312\n        if (password == null || password.length() == 0) {\n            throw new FlowableException(\"Null or empty passwords are not allowed!\");\n        }\n\n        try {\n            LDAPTemplate ldapTemplate = new LDAPTemplate(ldapConfigurator);\n            return ldapTemplate.execute(new LDAPCallBack<Boolean>() {\n\n                @Override\n                public Boolean executeInContext(InitialDirContext initialDirContext) {\n\n                    if (initialDirContext == null) {\n                        return false;\n                    }\n\n                    // Do the actual search for the user\n                    String userDn = null;\n                    try {\n\n                        String searchExpression = ldapConfigurator.getLdapQueryBuilder().buildQueryByUserId(ldapConfigurator, userId);","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-ldap/src/main/java/org/flowable/ldap/LDAPIdentityServiceImpl.java#L126-L162","documentation":"Flowable's LDAP identity service refuses to attempt an LDAP bind with a null or empty password. A blank bind would either fail or, worse, succeed as an anonymous bind on misconfigured servers, silently authenticating a user without a real password check. The library therefore fails fast with this FlowableException in executeCheckPassword before any LDAP communication.","triggerScenarios":"Calling LDAPIdentityServiceImpl.checkPassword(userId, password) with a null or zero-length password string, typically when the password field of a login form was never filled or the credentials object was only partially populated.","commonSituations":"Login forms that submit empty password fields; code that reads passwords from a config/property file where the entry is missing; frameworks or custom code paths that pass null credentials for 'anonymous' or SSO-style flows into Flowable's identity check.","solutions":["Ensure a non-empty password is supplied before calling checkPassword; validate the input at the application layer and reject empty logins early.","If the password comes from configuration or environment, fix the missing value (e.g. check ldap password property) and redeploy.","If the use case is genuinely anonymous/unauthenticated access, do not route it through checkPassword; implement the flow outside the LDAP identity service."],"exampleFix":"// before\nboolean ok = identityService.checkPassword(userId, request.getParameter(\"password\"));\n\n// after\nString password = request.getParameter(\"password\");\nif (password == null || password.isEmpty()) {\n    throw new BadRequestException(\"Password is required\");\n}\nboolean ok = identityService.checkPassword(userId, password);","handlingStrategy":"validation","validationCode":"if (password == null || password.isEmpty()) { throw new IllegalArgumentException(\"password must be non-empty\"); }","typeGuard":null,"tryCatchPattern":"try { return identityService.checkPassword(userId, password); } catch (FlowableException e) { log.warn(\"LDAP password check failed\", e); return false; }","preventionTips":["Never submit login forms with empty password fields; validate client- and server-side.","Check configuration files for missing password properties at startup.","Keep anonymous authentication flows separate from checkPassword."],"tags":["ldap","authentication","empty-password","input-validation"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}