public class LdapLoginModule extends AbstractLoginModule
The jvm should be started with the following parameter:
-Djava.security.auth.login.config=etc/ldap-loginModule.confand an example of the ldap-loginModule.conf would be:
ldaploginmodule { org.eclipse.jetty.server.server.plus.jaas.spi.LdapLoginModule required debug="true" useLdaps="false" contextFactory="com.sun.jndi.ldap.LdapCtxFactory" hostname="ldap.example.com" port="389" bindDn="cn=Directory Manager" bindPassword="directory" authenticationMethod="simple" forceBindingLogin="false" userBaseDn="ou=people,dc=alcatel" userRdnAttribute="uid" userIdAttribute="uid" userPasswordAttribute="userPassword" userObjectClass="inetOrgPerson" roleBaseDn="ou=groups,dc=example,dc=com" roleNameAttribute="cn" roleMemberAttribute="uniqueMember" roleObjectClass="groupOfUniqueNames"; };
Modifier and Type | Class and Description |
---|---|
class |
LdapLoginModule.LDAPUserInfo |
AbstractLoginModule.JAASUserInfo
Modifier and Type | Field and Description |
---|---|
private java.lang.String |
_authenticationMethod
Context.SECURITY_AUTHENTICATION
|
private java.lang.String |
_bindDn
root DN used to connect to
|
private java.lang.String |
_bindPassword
password used to connect to the root ldap context
|
private java.lang.String |
_contextFactory
Context.INITIAL_CONTEXT_FACTORY
|
private boolean |
_debug |
private boolean |
_forceBindingLogin
if the getUserInfo can pull a password off of the user then
password comparison is an option for authn, to force binding
login checks, set this to true
|
private java.lang.String |
_hostname
hostname of the ldap server
|
private int |
_port
port of the ldap server
|
private java.lang.String |
_roleBaseDn
base DN where role membership is to be searched from
|
private java.lang.String |
_roleMemberAttribute
name of the attribute that a username would be under a role class
|
private java.lang.String |
_roleNameAttribute
the name of the attribute that a role would be stored under
|
private java.lang.String |
_roleObjectClass
object class of roles
|
private javax.naming.directory.DirContext |
_rootContext |
private boolean |
_useLdaps
When true changes the protocol to ldaps
|
private java.lang.String |
_userBaseDn
base DN where users are to be searched from
|
private java.lang.String |
_userIdAttribute
attribute that the principal is located
|
private java.lang.String |
_userObjectClass
object class of a user
|
private java.lang.String |
_userPasswordAttribute
name of the attribute that a users password is stored under
|
private java.lang.String |
_userRdnAttribute
attribute that the principal is located
|
private static Logger |
LOG |
Constructor and Description |
---|
LdapLoginModule() |
Modifier and Type | Method and Description |
---|---|
boolean |
abort() |
private static java.lang.String |
base64ToHex(java.lang.String src) |
boolean |
bindingLogin(java.lang.String username,
java.lang.Object password)
binding authentication check
This method of authentication works only if the user branch of the DIT (ldap tree)
has an ACI (access control instruction) that allow the access to any user or at least
for the user that logs in.
|
boolean |
commit() |
static java.lang.String |
convertCredentialLdapToJetty(java.lang.String encryptedPassword) |
protected boolean |
credentialLogin(java.lang.Object webCredential)
password supplied authentication check
|
protected java.lang.String |
doRFC2254Encoding(java.lang.String inputString) |
private javax.naming.directory.SearchResult |
findUser(javax.naming.directory.DirContext dirContext,
java.lang.String filter,
java.lang.Object[] filterArguments) |
private javax.naming.directory.SearchResult |
findUser(java.lang.String username) |
java.util.Hashtable<java.lang.Object,java.lang.Object> |
getEnvironment()
get the context for connection
|
private java.lang.String |
getOption(java.util.Map<java.lang.String,?> options,
java.lang.String key,
java.lang.String defaultValue) |
private javax.naming.directory.Attributes |
getUserAttributes(java.lang.String username)
attempts to get the users LDAP attributes from the users context
|
private java.lang.String |
getUserCredentials(javax.naming.directory.Attributes attributes) |
UserInfo |
getUserInfo(java.lang.String username)
get the available information about the user
|
private java.util.List<java.lang.String> |
getUserRoles(javax.naming.directory.DirContext dirContext,
java.lang.String username,
javax.naming.directory.Attributes attributes)
attempts to get the users roles from the root context
|
private java.util.List<java.lang.String> |
getUserRolesByDn(javax.naming.directory.DirContext dirContext,
java.lang.String userDn) |
private static java.lang.String |
hexToBase64(java.lang.String src) |
void |
initialize(javax.security.auth.Subject subject,
javax.security.auth.callback.CallbackHandler callbackHandler,
java.util.Map<java.lang.String,?> sharedState,
java.util.Map<java.lang.String,?> options)
Init LoginModule.
|
boolean |
login()
since ldap uses a context bind for valid authentication checking, we override login()
|
configureCallbacks, getCallbackHandler, getCurrentUser, getSubject, isAuthenticated, isCommitted, isIgnored, logout, setAuthenticated, setCallbackHandler, setCommitted, setCurrentUser, setSubject
private static final Logger LOG
private java.lang.String _hostname
private int _port
private java.lang.String _authenticationMethod
private java.lang.String _contextFactory
private java.lang.String _bindDn
private java.lang.String _bindPassword
private java.lang.String _userObjectClass
private java.lang.String _userRdnAttribute
private java.lang.String _userIdAttribute
private java.lang.String _userPasswordAttribute
NOTE: not always accessible, see force binding login
private java.lang.String _userBaseDn
private java.lang.String _roleBaseDn
private java.lang.String _roleObjectClass
private java.lang.String _roleMemberAttribute
private java.lang.String _roleNameAttribute
private boolean _debug
private boolean _forceBindingLogin
private boolean _useLdaps
private javax.naming.directory.DirContext _rootContext
public UserInfo getUserInfo(java.lang.String username) throws java.lang.Exception
for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario
roles are also an optional concept if required
getUserInfo
in class AbstractLoginModule
username
- the user namejava.lang.Exception
- if unable to get the user infoprotected java.lang.String doRFC2254Encoding(java.lang.String inputString)
private javax.naming.directory.Attributes getUserAttributes(java.lang.String username) throws javax.security.auth.login.LoginException
NOTE: this is not an user authenticated operation
username
- Attributes
from the userjavax.security.auth.login.LoginException
private java.lang.String getUserCredentials(javax.naming.directory.Attributes attributes) throws javax.security.auth.login.LoginException
javax.security.auth.login.LoginException
private java.util.List<java.lang.String> getUserRoles(javax.naming.directory.DirContext dirContext, java.lang.String username, javax.naming.directory.Attributes attributes) throws javax.security.auth.login.LoginException, javax.naming.NamingException
NOTE: this is not an user authenticated operation
dirContext
- username
- javax.security.auth.login.LoginException
javax.naming.NamingException
private java.util.List<java.lang.String> getUserRolesByDn(javax.naming.directory.DirContext dirContext, java.lang.String userDn) throws javax.naming.NamingException
javax.naming.NamingException
public boolean login() throws javax.security.auth.login.LoginException
if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic
login
in interface javax.security.auth.spi.LoginModule
login
in class AbstractLoginModule
javax.security.auth.login.LoginException
- if unable to loginLoginModule.login()
protected boolean credentialLogin(java.lang.Object webCredential) throws javax.security.auth.login.LoginException
webCredential
- the web credentialjavax.security.auth.login.LoginException
- if unable to loginpublic boolean bindingLogin(java.lang.String username, java.lang.Object password) throws javax.security.auth.login.LoginException
username
- the user namepassword
- the passwordjavax.security.auth.login.LoginException
- if unable to bind the loginprivate javax.naming.directory.SearchResult findUser(java.lang.String username) throws javax.security.auth.login.LoginException
javax.security.auth.login.LoginException
private javax.naming.directory.SearchResult findUser(javax.naming.directory.DirContext dirContext, java.lang.String filter, java.lang.Object[] filterArguments) throws javax.security.auth.login.LoginException
javax.security.auth.login.LoginException
public void initialize(javax.security.auth.Subject subject, javax.security.auth.callback.CallbackHandler callbackHandler, java.util.Map<java.lang.String,?> sharedState, java.util.Map<java.lang.String,?> options)
Called once by JAAS after new instance is created.
initialize
in interface javax.security.auth.spi.LoginModule
initialize
in class AbstractLoginModule
subject
- the subectcallbackHandler
- the callback handlersharedState
- the shared state mapoptions
- the option mapLoginModule.initialize(javax.security.auth.Subject, javax.security.auth.callback.CallbackHandler, java.util.Map, java.util.Map)
public boolean commit() throws javax.security.auth.login.LoginException
commit
in interface javax.security.auth.spi.LoginModule
commit
in class AbstractLoginModule
javax.security.auth.login.LoginException
- if unable to commitLoginModule.commit()
public boolean abort() throws javax.security.auth.login.LoginException
abort
in interface javax.security.auth.spi.LoginModule
abort
in class AbstractLoginModule
javax.security.auth.login.LoginException
- if unable to abortLoginModule.abort()
private java.lang.String getOption(java.util.Map<java.lang.String,?> options, java.lang.String key, java.lang.String defaultValue)
public java.util.Hashtable<java.lang.Object,java.lang.Object> getEnvironment()
public static java.lang.String convertCredentialLdapToJetty(java.lang.String encryptedPassword)
private static java.lang.String base64ToHex(java.lang.String src)
private static java.lang.String hexToBase64(java.lang.String src)