Non-domain NTLM Authentication - User can login in portal entering wrong password.

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 5.1.2
• Fix Version/s: None
• Component/s: Authentication
• Labels: None
• Environment: tomcat6, vista, windows2003 R2 server domain
• Similar Issues: Show 5 results ; ;

  LPS-7254	User can login in portal entering wrong password thru NTLM
  LPS-625	Problem with NTLM Authentication
  LPS-30274	Add NTLM Authentication to Sharepoint Repository
  LPS-6069	NTLM authentication will not allow users to log in when using multiple browsers
  LPS-3595	ntlmautologin.java only verify username not password

User can login in portal entering wrong password.

I enable NTLM autentication,
and LDAP importing users from my AD.

Open browser (firefox, safari) outside domain
click on sign in and the browser asks for username and password
via browser standard form
now insert a correct username and a wrong password
portal recognize me without checking password

I think this is a big security problem.

How can I force password checking keeping NTLM authentication active?
Am I missing something?

Final note: AD keeps password encripted
and disabling NTLM i cannot login in portal, so i need NTLM.

Regards,
Luca
found was already in forum but cannot find solutions
http://www.liferay.com/web/guest/community/forums/-/message_boards/message/310580

[cometta]

same as LPS-3595

[cometta]

i post the solution at http://www.liferay.com/web/guest/community/forums/-/message_boards/message/3256505 . pls check is that correct, if ok. please check in to liferay svn

[Roman Kuchvarskyy]

Have anybody look on this problem?

[Mika Koivisto]

I believe this issue has been resolved by LPS-5065