Here is a little more detail.
ESAPI for Java has two encoding functions for LDAP injection protection. http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Encoder.html
* Encode data for use in LDAP queries.
* @param input the text to encode for LDAP
* @return input encoded for use in LDAP
The following points are worth considering in any attempt to leverage this, though I don't believe anything except attempts at denial of service would work.
Where LDAP URLs are used, these do not support in-band credentials in the URL, as the (now deprecated) method that HTTP URLs used "http://user:password@host/". There should be no way to inject ...
I can infer from your question that you are using a SPNEGO LDAP Web Server Delegation Authentication scenario.
This means you shouldn't be allowing anonymous authentication in IIS, since you're delegating into IIS to authenticate the user you have no choice on your app but to accept whatever answer IIS gives you. If you have anonymous authentication it ...