Empty Attributes in LDAP request can cause it to be rejected

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 7.0.X, 7.1.X, Master
• Fix Version/s: 7.0.0 DXP FP73, 7.0.10.11 DXP SP11, 7.0.X, 7.1.10 DXP FP7, 7.1.10.2 SP2, 7.1.3 CE GA4, 7.1.X, Master
• Component/s: Application Security > LDAP
• Labels:
  • ee-ts
  • liferay-dxp-70-sp11
  • liferay-dxp-71-sp2
  • liferay-fixpack-de-73-7010
  • liferay-fixpack-dxp-7-7110
• Branch Version/s:
  7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Story Points: 3
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/67019

The Wireshark data revealed that Liferay was sending LDAP requests with empty Attributes. Some Red Hat Directory LDAP servers have patches which rejected LDAP requests with more than 1 empty Attribute, this causes Liferay LDAP requests to fail. See this. Removing empty attributes from the request allows it to succeed again.

Steps to Reproduce:

1. Setup an LDAP server and connect Liferay to it. I used these steps.
2. Setup wireshark to monitor traffic to the LDAP server
3. Sign out of Liferay, clear the wireshark data, then sign in and stop collecting wireshark data
4. In the wireshark captured data, find the first LDAP request which includes AttributeDescriptions in it's LDAProtocol.
   Actual Result: Empty AttributeDescriptions exist - with the above setup only 13 of 19 are filled. See
   Expected Result: No empty AttributeDescriptions are sent in request.