| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| * |
| */ |
| |
| package org.apache.lenya.ac.ldap; |
| |
| import java.io.File; |
| import java.io.FileInputStream; |
| import java.io.IOException; |
| import java.util.Hashtable; |
| import java.util.Properties; |
| |
| import javax.naming.AuthenticationException; |
| import javax.naming.Context; |
| import javax.naming.NamingEnumeration; |
| import javax.naming.NamingException; |
| import javax.naming.directory.Attribute; |
| import javax.naming.directory.Attributes; |
| import javax.naming.directory.DirContext; |
| import javax.naming.directory.SearchControls; |
| import javax.naming.directory.SearchResult; |
| import javax.naming.ldap.InitialLdapContext; |
| |
| import org.apache.avalon.framework.configuration.Configuration; |
| import org.apache.avalon.framework.configuration.ConfigurationException; |
| import org.apache.avalon.framework.configuration.DefaultConfiguration; |
| import org.apache.avalon.framework.logger.Logger; |
| import org.apache.lenya.ac.AccessControlException; |
| import org.apache.lenya.ac.ItemManager; |
| import org.apache.lenya.ac.file.FileUser; |
| |
| import com.sun.jndi.ldap.LdapCtxFactory; |
| import com.sun.jndi.ldap.LdapURL; |
| |
| /** |
| * LDAP user. |
| * @version $Id$ |
| */ |
| public class LDAPUser extends FileUser { |
| /** |
| * |
| */ |
| private static final long serialVersionUID = 1L; |
| |
| private Properties defaultProperties = null; |
| |
| /** |
| * <code>LDAP_ID</code> The LDAP id |
| */ |
| public static final String LDAP_ID = "ldapid"; |
| private static String LDAP_PROPERTIES_FILE = "ldap.properties"; |
| private static String PROVIDER_URL_PROP = "provider-url"; |
| private static String MGR_DN_PROP = "mgr-dn"; |
| private static String MGR_PW_PROP = "mgr-pw"; |
| private static String KEY_STORE_PROP = "key-store"; |
| private static String SECURITY_PROTOCOL_PROP = "security-protocol"; |
| private static String SECURITY_AUTHENTICATION_PROP = "security-authentication"; |
| private static String USR_ATTR_PROP = "usr-attr"; |
| private static String USR_ATTR_DEFAULT = "uid"; |
| private static String USR_NAME_ATTR_PROP = "usr-name-attr"; |
| private static String USR_NAME_ATTR_DEFAULT = "gecos"; |
| private static String USR_BRANCH_PROP = "usr-branch"; |
| private static String USR_BRANCH_DEFAULT = "ou=People"; |
| private static String USR_AUTH_TYPE_PROP = "usr-authentication"; |
| private static String USR_AUTH_TYPE_DEFAULT = "simple"; |
| private static String BASE_DN_PROP = "base-dn"; |
| private static String DOMAIN_NAME_PROP = "domain-name"; |
| private static String HANDLE_REFERRALS_PROP = "handle-referrals"; |
| private static String HANDLE_REFERRALS_DEFAULT = "ignore"; |
| |
| private String ldapId; |
| private String ldapName; |
| |
| // deprecated: for backwards compatibility only ! |
| private static String PARTIAL_USER_DN_PROP = "partial-user-dn"; |
| |
| /** |
| * Creates a new LDAPUser object. |
| * @param itemManager The item manager. |
| * @param logger The logger. |
| */ |
| public LDAPUser(ItemManager itemManager, Logger logger) { |
| super(itemManager, logger); |
| } |
| |
| /** |
| * Create an LDAPUser |
| * @param itemManager The item manager. |
| * @param logger The logger. |
| * @param id user id of LDAPUser |
| * @param email of LDAPUser |
| * @param _ldapId of LDAPUser |
| * @param _logger The logger. |
| * @throws ConfigurationException if the properties could not be read |
| */ |
| public LDAPUser(ItemManager itemManager, Logger logger, String id, String email, |
| String _ldapId, Logger _logger) throws ConfigurationException { |
| super(itemManager, logger, id, null, email, null); |
| this.ldapId = _ldapId; |
| initialize(); |
| } |
| |
| /** |
| * Create a new LDAPUser from a configuration |
| * @param config the <code>Configuration</code> specifying the user |
| * details |
| * @throws ConfigurationException if the user could not be instantiated |
| */ |
| public void configure(Configuration config) throws ConfigurationException { |
| super.configure(config); |
| this.ldapId = config.getChild(LDAP_ID).getValue(); |
| |
| initialize(); |
| } |
| |
| /** |
| * Checks if a user exists. |
| * @param _ldapId The LDAP id. |
| * @return A boolean value indicating whether the user is found in the |
| * directory |
| * @throws AccessControlException when an error occurs. |
| */ |
| public boolean existsUser(String _ldapId) throws AccessControlException { |
| |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("existsUser() checking id " + _ldapId); |
| |
| boolean exists = false; |
| |
| try { |
| readProperties(); |
| SearchResult entry = getDirectoryEntry(_ldapId); |
| |
| exists = (entry != null); |
| } catch (final IOException e) { |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("existsUser() for id " + _ldapId + " got exception: " + e); |
| throw new AccessControlException("Exception during search: ", e); |
| } catch (final NamingException e) { |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("existsUser() for id " + _ldapId + " got exception: " + e); |
| throw new AccessControlException("Exception during search: ", e); |
| } |
| |
| return exists; |
| } |
| |
| /** |
| * Initializes this user. The current (already authenticated) ldapId is |
| * queried in the directory, in order to retrieve additional information, |
| * such as the user name. In current implementation, only the user name is |
| * actually retrieved, but other attributes may be used in the future (such |
| * as groups ?) TODO: should the code be changed to not throw an exception |
| * when something goes wrong ? After all, it's only used to get additional |
| * info for display? This is a design decision, I'm not sure what's best. |
| * @throws ConfigurationException when something went wrong. |
| */ |
| protected void initialize() throws ConfigurationException { |
| |
| try { |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("initialize() getting entry ..."); |
| |
| SearchResult entry = getDirectoryEntry(this.ldapId); |
| if (entry != null) { |
| StringBuffer name = new StringBuffer(); |
| /* users full name */ |
| String usrNameAttr = defaultProperties.getProperty(USR_NAME_ATTR_PROP, |
| USR_NAME_ATTR_DEFAULT); |
| |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug( |
| "initialize() got entry, going to look for attribute " + usrNameAttr |
| + " in entry, which is: " + entry); |
| |
| Attributes attributes = entry.getAttributes(); |
| if (attributes != null) { |
| Attribute userName = attributes.get(usrNameAttr); |
| if (userName != null) name.append((String) userName.get()); |
| } |
| |
| this.ldapName = name.toString(); |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("initialize() set name to " + this.ldapName); |
| } else { |
| this.ldapName = ""; |
| } |
| } catch (final NamingException e1) { |
| throw new ConfigurationException("Could not read properties", e1); |
| } catch (final IOException e1) { |
| throw new ConfigurationException("Could not read properties", e1); |
| } |
| } |
| |
| /** |
| * @see org.apache.lenya.ac.file.FileUser#createConfiguration() |
| */ |
| protected Configuration createConfiguration() { |
| DefaultConfiguration config = (DefaultConfiguration) super.createConfiguration(); |
| |
| // add ldap_id node |
| DefaultConfiguration child = new DefaultConfiguration(LDAP_ID); |
| child.setValue(this.ldapId); |
| config.addChild(child); |
| |
| return config; |
| } |
| |
| /** |
| * Get the ldap id |
| * @return the ldap id |
| */ |
| public String getLdapId() { |
| return this.ldapId; |
| } |
| |
| /** |
| * Set the ldap id |
| * @param string the new ldap id |
| */ |
| public void setLdapId(String string) { |
| this.ldapId = string; |
| } |
| |
| /** |
| * Authenticate a user against the directory. The principal to be |
| * authenticated is either constructed by use of the configured properties, |
| * or by lookup of this ID in the directory. This principal then attempts to |
| * authenticate against the directory with the provided password. |
| * @see org.apache.lenya.ac.User#authenticate(java.lang.String) |
| */ |
| public boolean authenticate(String password) { |
| |
| boolean authenticated = false; |
| String principal = ""; |
| Context ctx = null; |
| |
| try { |
| principal = getPrincipal(); |
| |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("Authenticating with principal [" + principal + "]"); |
| |
| ctx = bind(principal, password, defaultProperties.getProperty(USR_AUTH_TYPE_PROP, |
| USR_AUTH_TYPE_DEFAULT)); |
| authenticated = true; |
| close(ctx); |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("Context closed."); |
| } catch (IOException e) { |
| getLogger().warn("authenticate handling IOException, check your setup: " + e); |
| } catch (AuthenticationException e) { |
| getLogger().info("authenticate failed for principal " + principal + ", exception " + e); |
| } catch (NamingException e) { |
| // log this failure |
| if (getLogger().isInfoEnabled()) { |
| getLogger().info("Bind for user " + principal + " to Ldap server failed: ", e); |
| } |
| } |
| |
| return authenticated; |
| |
| } |
| |
| /** |
| * @see org.apache.lenya.ac.Item#getName() |
| */ |
| public String getName() { |
| return this.ldapName; |
| } |
| |
| /** |
| * LDAP Users fetch their name information from the LDAP server, so we don't |
| * store it locally. Since we only have read access we basically can't set |
| * the name, i.e. any request to change the name is ignored. |
| * @param string is ignored |
| */ |
| public void setName(String string) { |
| // we do not have write access to LDAP, so we ignore |
| // change request to the name. |
| } |
| |
| /** |
| * The LDAPUser doesn't store any passwords as they are handled by LDAP |
| * @param plainTextPassword is ignored |
| */ |
| public void setPassword(String plainTextPassword) { |
| setEncryptedPassword(null); |
| } |
| |
| /** |
| * The LDAPUser doesn't store any passwords as they are handled by LDAP |
| * @param encryptedPassword is ignored |
| */ |
| protected void setEncryptedPassword(String encryptedPassword) { |
| encryptedPassword = null; |
| } |
| |
| /** |
| * The LDAPUser doesn't change any passwords as they are handled by LDAP |
| * @return always returns false |
| */ |
| public boolean canChangePassword() { |
| return false; |
| } |
| |
| /** |
| * Connect to the LDAP server |
| * @param principal the principal string for the LDAP connection |
| * @param credentials the credentials for the LDAP connection |
| * @param authMethod the authentication method |
| * @return a <code>DirContext</code> |
| * @throws NamingException if there are problems establishing the Ldap |
| * connection |
| */ |
| private DirContext bind(String principal, String credentials, String authMethod) |
| throws NamingException { |
| |
| if (getLogger().isInfoEnabled()) |
| getLogger().info("Binding principal: [" + principal + "]"); |
| |
| Hashtable env = new Hashtable(); |
| |
| System.setProperty("javax.net.ssl.trustStore", getConfigurationDirectory() |
| .getAbsolutePath() |
| + File.separator + defaultProperties.getProperty(KEY_STORE_PROP)); |
| |
| env.put(Context.INITIAL_CONTEXT_FACTORY, LdapCtxFactory.class.getName()); |
| |
| String prop = defaultProperties.getProperty(PROVIDER_URL_PROP); |
| if (prop == null) |
| throw new RuntimeException("LDAP configuration error: property " + PROVIDER_URL_PROP |
| + " is not set in property file " + LDAP_PROPERTIES_FILE); |
| env.put(Context.PROVIDER_URL, prop); |
| |
| prop = defaultProperties.getProperty(SECURITY_PROTOCOL_PROP); |
| if (prop == null) |
| throw new RuntimeException("LDAP configuration error: property " |
| + SECURITY_PROTOCOL_PROP + " is not set in property file " |
| + LDAP_PROPERTIES_FILE); |
| env.put(Context.SECURITY_PROTOCOL, prop); |
| |
| env.put(Context.SECURITY_AUTHENTICATION, authMethod); |
| if (authMethod != null && !authMethod.equals("none")) { |
| env.put(Context.SECURITY_PRINCIPAL, principal); |
| env.put(Context.SECURITY_CREDENTIALS, credentials); |
| } |
| env.put(Context.REFERRAL, defaultProperties.getProperty(HANDLE_REFERRALS_PROP, HANDLE_REFERRALS_DEFAULT)); |
| |
| DirContext ctx = new InitialLdapContext(env, null); |
| |
| if (getLogger().isInfoEnabled()) |
| getLogger().info("Finished binding principal."); |
| |
| return ctx; |
| } |
| |
| /** |
| * Close the connection to the LDAP server |
| * @param ctx the context that was returned from the bind |
| * @throws NamingException if there is a problem communicating to the LDAP |
| * server |
| */ |
| private void close(Context ctx) throws NamingException { |
| if (ctx != null) |
| ctx.close(); |
| } |
| |
| /** |
| * Read the properties |
| * @throws IOException if the properties cannot be found. |
| */ |
| private void readProperties() throws IOException { |
| // create and load default properties |
| File propertiesFile = new File(getConfigurationDirectory(), LDAP_PROPERTIES_FILE); |
| |
| if (defaultProperties == null) { |
| defaultProperties = new Properties(); |
| |
| FileInputStream in = null; |
| try { |
| in = new FileInputStream(propertiesFile); |
| defaultProperties.load(in); |
| } finally { |
| if (in != null) { |
| in.close(); |
| } |
| } |
| } |
| } |
| |
| /** |
| * Wrapping of the decision whether a recursive search is wanted or not. |
| * Implementation: If the USR_BRANCH_PROP is present, this is the new style |
| * of configuration (starting Lenya 1.2.2); if it has a value, then a |
| * specific branch is wanted: no recursive search. If the property is |
| * present, but has no value, search recursively. |
| * @return Recursive search |
| */ |
| private boolean isSubtreeSearch() { |
| boolean recurse = false; |
| String usrBranchProp = defaultProperties.getProperty(USR_BRANCH_PROP); |
| if (usrBranchProp != null) |
| if (usrBranchProp.trim().length() == 0) |
| recurse = true; |
| |
| return recurse; |
| } |
| |
| private SearchResult getDirectoryEntry(String userId) throws NamingException, IOException { |
| DirContext context = null; |
| String searchFilter = ""; |
| String objectName = ""; |
| boolean recursiveSearch; |
| SearchResult result = null; |
| |
| try { |
| readProperties(); |
| |
| context = bind(defaultProperties.getProperty(MGR_DN_PROP), defaultProperties |
| .getProperty(MGR_PW_PROP), defaultProperties |
| .getProperty(SECURITY_AUTHENTICATION_PROP)); |
| |
| // Get search information and user attribute from properties |
| // provide defaults if not present (backward compatibility) |
| String userAttribute = defaultProperties.getProperty(USR_ATTR_PROP, USR_ATTR_DEFAULT); |
| searchFilter = "(" + userAttribute + "=" + userId + ")"; |
| SearchControls scope = new SearchControls(); |
| |
| recursiveSearch = isSubtreeSearch(); |
| if (recursiveSearch) { |
| scope.setSearchScope(SearchControls.SUBTREE_SCOPE); |
| objectName = defaultProperties.getProperty(PROVIDER_URL_PROP); |
| } else { |
| scope.setSearchScope(SearchControls.ONELEVEL_SCOPE); |
| objectName = defaultProperties.getProperty(USR_BRANCH_PROP, USR_BRANCH_DEFAULT); |
| } |
| |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug( |
| "searching object " + objectName + " filtering with " + searchFilter |
| + ", recursive search ? " + recursiveSearch); |
| |
| NamingEnumeration results = context.search(objectName, searchFilter, scope); |
| if (results != null && results.hasMore()) |
| result = (SearchResult) results.next(); |
| |
| // sanity check: if more than one entry is returned |
| // for a user-id, then the directory is probably flawed, |
| // so it would be nice to warn the administrator. |
| // |
| // This block is commented out for now, because of possible |
| // side-effects, such as unexpected exceptions. |
| // try { |
| // if (results.hasMore()) { |
| // getLogger().warn("Found more than one entry in the directory for |
| // user " + userId + ". You probably should deactivate recursive |
| // searches. The first entry was used as a work-around."); |
| // } |
| // } |
| // catch (javax.naming.PartialResultException e) { |
| // if (getLogger().isDebugEnabled()) |
| // getLogger().debug("Catching and ignoring PartialResultException, |
| // as this means LDAP server does not support our sanity check"); |
| // } |
| |
| } catch (NamingException e) { |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug( |
| "NamingException caught when searching on objectName = " + objectName |
| + " and searchFilter=" + searchFilter |
| + ", this exception will be propagated: " + e); |
| throw e; |
| } finally { |
| try { |
| if (context != null) { |
| close(context); |
| } |
| } catch (NamingException e) { |
| getLogger().warn("this should not happen: exception closing context " + e); |
| } |
| } |
| return result; |
| } |
| |
| /** |
| * Encapsulation of the creation of a principal: we need to distinguish |
| * three cases, in order to support different modes of using a directory. |
| * The first is the use of a domain-name (requirement of MS Active |
| * Directory): if this property is set, this is used to construct the |
| * principal. The second case is where a user-id is somewhere in a domain, |
| * but not in a specific branch: in this case, a subtree search is performed |
| * to retrieve the complete path. The third case is where a specific branch |
| * of the directory is to be used; this is the case where usr-branch is set |
| * to a value. In this case, this branch is used to construct the principal. |
| * @return The principal |
| * @throws IOException |
| * @throws NamingException |
| */ |
| private String getPrincipal() throws IOException, NamingException { |
| |
| String principal; |
| |
| // 1. Check if domain-name is to be supported |
| String domainProp = defaultProperties.getProperty(DOMAIN_NAME_PROP); |
| if (domainProp != null && domainProp.trim().length() > 0) { |
| principal = domainProp + "\\" + getLdapId(); |
| } else { |
| if (isSubtreeSearch()) { |
| // 2. Principal is constructed from directory entry |
| SearchResult entry = getDirectoryEntry(getLdapId()); |
| principal = entry.getName(); |
| if (entry.isRelative()){ |
| if (principal.length() > 0) |
| principal = principal + "," + defaultProperties.getProperty(BASE_DN_PROP); |
| } else { |
| // if the item is found following a referral an URL string is |
| // returned which can not be used as principal |
| LdapURL ldapurl = new LdapURL(principal); |
| principal = ldapurl.getDN(); |
| } |
| } else |
| // 3. Principal is constructed from properties |
| principal = constructPrincipal(getLdapId()); |
| } |
| |
| return principal; |
| } |
| |
| /** |
| * Construct the principal for a user, by using the given userId along with |
| * the configured properties. |
| * @param userId The user id |
| * @return The principal |
| */ |
| private String constructPrincipal(String userId) { |
| StringBuffer principal = new StringBuffer(); |
| principal.append(defaultProperties.getProperty(USR_ATTR_PROP, USR_ATTR_DEFAULT)) |
| .append("=").append(userId).append(","); |
| |
| String baseDn = defaultProperties.getProperty(BASE_DN_PROP); |
| if (baseDn != null && baseDn.length() > 0) { |
| // USR_BRANCH_PROP may be empty, so only append when not-empty |
| String usrBranch = defaultProperties.getProperty(USR_BRANCH_PROP); |
| if (usrBranch != null) { |
| if (usrBranch.trim().length() > 0) |
| principal.append(usrBranch).append(","); |
| } else |
| principal.append(USR_BRANCH_DEFAULT).append(","); |
| |
| principal.append(defaultProperties.getProperty(BASE_DN_PROP)); |
| } else { |
| // try for backwards compatibility of ldap properties |
| getLogger().warn( |
| "getPrincipal() read a deprecated format in ldap properties, please update"); |
| principal.append(defaultProperties.getProperty(PARTIAL_USER_DN_PROP)); |
| } |
| |
| if (getLogger().isDebugEnabled()) |
| getLogger().debug("getPrincipal() returning " + principal.toString()); |
| |
| return principal.toString(); |
| } |
| |
| } |
