finish off sprint advisories and sprints

src/Authority/StellaOps.Authority/StellaOps.Authority.Plugin.Ldap/Credentials/LdapCredentialStore.cs

@@ -115,6 +115,21 @@ internal sealed class LdapCredentialStore : IUserCredentialStore
                     auditProperties: auditProperties);
             }
 
+            // Validate DN is not empty/malformed
+            if (string.IsNullOrWhiteSpace(userEntry.DistinguishedName))
+            {
+                logger.LogWarning("LDAP plugin {Plugin} found user {Username} but DN is empty/malformed.", pluginName, normalizedUsername);
+                auditProperties.Add(new AuthEventProperty
+                {
+                    Name = "ldap.failure",
+                    Value = ClassifiedString.Public("malformed_dn")
+                });
+                return AuthorityCredentialVerificationResult.Failure(
+                    AuthorityCredentialFailureCode.InvalidCredentials,
+                    "Invalid credentials.",
+                    auditProperties: auditProperties);
+            }
+
             auditProperties.Add(new AuthEventProperty
             {
                 Name = "ldap.entry_dn",