Metacat

/**

 *  '$RCSfile$'

 *    Purpose: An implementation of the AuthInterface interface that

 *             allows Metacat to use the LDAP protocol for

 *             directory services

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *    Release: @release@

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.naming.AuthenticationException;

import javax.naming.Context;

import javax.naming.NamingException;

import javax.naming.directory.Attributes;

import javax.naming.directory.BasicAttributes;

import javax.naming.directory.DirContext;

import javax.naming.directory.InitialDirContext;

import javax.naming.directory.SearchResult;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Vector;

/**

 * An implementation of the AuthInterface interface that

 * allows Metacat to use the LDAP protocol for directory services.

 * The LDAP authentication service is used to determine if a user

 * is authenticated, and whether they are a member of a particular group.

 */

  private Context rContext;

  private String userPassword;

   * Construct an AuthLdap

   */

  public AuthLdap() {

    // Read LDAP URI for directory service information

    this.ldapsUrl = MetaCatUtil.getOption("ldapsurl");

    this.ldapBase = MetaCatUtil.getOption("ldapbase");

   * Determine if a user/password are valid according to the authentication

   * service.

   *

   * @param user the name of the principal to authenticate

   * @param password the password to use for authentication

   * @returns boolean true if authentication successful, false otherwise

   */

  public boolean authenticate(String user, String password)

                    throws ConnectException

  {

        authenticated = ldapAuthenticate(identifier, password);

        if (!authenticated) {

            String decoded = URLDecoder.decode(identifier);

            MetaCatUtil.debugMessage("DN decoded: " + decoded, 35);

            identifier = decoded;

            String refBase = "";

            if (identifier.startsWith("ldap")) {

                refUrl = identifier.substring(0,

                               identifier.lastIndexOf("/")+1);

                int position2 = identifier.indexOf(",", position+1);

                refBase = identifier.substring(position2+1);

                             identifier.lastIndexOf("/")+1);

                                                 refUrl, refBase);

            } else {

                identifier = identifier+","+ldapBase;

            }

            //authenticated = ldapAuthenticate(identifier, password);

      "NullPointerException while authenticating in " +

                        "AuthLdap.authenticate: " + e);

    return authenticated;

  }

  /**

   * username and password as passed into the routine.

   *

   * @param identifier the distinguished name to check against LDAP

   * @param password the password for authentication

   */

  private boolean ldapAuthenticate(String identifier, String password)

            throws ConnectException, NamingException, NullPointerException

  {

                              this.ldapsUrl, this.ldapBase);

  }

  /**

   * Connect to the LDAP directory and do the authentication using the

   * username and password as passed into the routine.

   *

   * @param identifier the distinguished name to check against LDAP

   * @param password the password for authentication

   */

  private boolean ldapAuthenticate(String identifier, String password,

            String directoryUrl, String searchBase)

            throws ConnectException, NamingException, NullPointerException

  {

        userName=identifier;

        userPassword=password;

        // Identify service provider to use

        env.put(Context.INITIAL_CONTEXT_FACTORY,

        if ( !ldapsUrl.equals(ldapUrl) ) {

          // ldaps is set on second port - 636 by default

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, identifier);

        env.put(Context.SECURITY_CREDENTIALS, password);

        // If our auth credentials are invalid, an exception will be thrown

        DirContext ctx = null;

          double stopTime = System.currentTimeMillis();

          //tls.close();

          ctx.close();

          this.ldapUrl = ldapUrl;

          this.ldapBase = ldapBase;

          //break;

          }

          util.debugMessage("Referral information: "+re.getReferralInfo(), 30);

            t.start();

                                //hideously long time out period.

              authenticated = false;

            }

          }

        }

  }

  /**

   * that is used in conjunction withthe LDAP BaseDN to create a

   * distinguished name (dn) for the record

   *

   * @param user the user for which the identifying name is requested

   * @returns String the identifying name for the user,

   *          or null if not found

   */

                                    String ldapBase) throws NamingException

    String identifier = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

      // distinguished name (dn) based on userid (uid) or common name (cn)

      DirContext ctx = new InitialDirContext(env);

      SearchControls ctls = new SearchControls();

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      //attributes

      // they have a ridiculous amount of redundancy

      // This assumes a dn like "uid=x,o=y,dc=someinst,dc=org"

      int position = user.indexOf(",");

      String comp1 = user.substring(0, position);

                                    user.indexOf(",", position+1));

      String filter = "(&(" + comp1 + ")(" + comp2 + "))";

      MetaCatUtil.debugMessage("Provider URL is: " + ldapUrl + ldapBase, 35);

      try {

        if (answer == null) {

            util.debugMessage("Search 1 answer is null.", 35);

        }

          identifier = sr.getName();

        }

          util.debugMessage("Invalid Filter exception thrown (if1)", 35);

      }

      // That failed, so check if it is just a username

      filter = "(" + user + ")";

      try {

        if (answer.hasMore()) {

          SearchResult sr = (SearchResult)answer.next();

          identifier = sr.getName();

                                                identifier.lastIndexOf("/")+1);

            identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                              identifier.indexOf(","));

          }

        }

      } catch (InvalidSearchFilterException e) {}

      // Maybe its a user id (uid)

        SearchResult sr = (SearchResult)answer.next();

        identifier = sr.getName();

        if ( !sr.isRelative() ) {

          this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

          this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

          identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                            identifier.indexOf(","));

        }

        // maybe its just a common name

        if (answer2.hasMore()) {

          SearchResult sr = (SearchResult)answer2.next();

          identifier = sr.getName();

          if ( !sr.isRelative() ) {

                                                identifier.lastIndexOf("/")+1);

            identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                              identifier.indexOf(","));

          }

          // ok, last resort, is it a surname?

          if (answer3.hasMore()) {

            SearchResult sr = (SearchResult)answer3.next();

            identifier = sr.getName();

            if ( !sr.isRelative() ) {

                                                identifier.lastIndexOf("/")+1);

              identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                                identifier.indexOf(","));

            }

        }

      }

      // Close the context when we're done the initial search

      ctx.close();

    } catch (NamingException e) {

      "Naming exception in AuthLdap.getIdentifyingName: " + e);

    }

  }

  /**

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of all of the user names

         throws ConnectException

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Users are objects that have the attribute objectclass=InetOrgPerson.

        String[] attrIDs = {"dn"};

        ctls.setReturningAttributes(attrIDs);

        ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

        NamingEnumeration enum = ctx.search(ldapBase, filter, ctls);

            while (enum.hasMore()) {

                SearchResult sr = (SearchResult)enum.next();

                uvec.add(sr.getName()+","+ldapBase);

            }

        } catch (SizeLimitExceededException slee) {

            util.debugMessage("LDAP Server size limit exceeded. " +

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

    } catch (NamingException e) {

      //e.printStackTrace(System.err);

    return users;

  /**

   * Get the users for a particular group from the authentication service

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param group the group whose user list should be returned

   * @returns string array of the user names belonging to the group

         throws ConnectException

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    try {

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        Vector uvec = new Vector();

            for (NamingEnumeration ae = answer.getAll(); ae.hasMore();) {

                Attribute attr = (Attribute)ae.next();

                for (NamingEnumeration e = attr.getAll();

                     e.hasMore();

                     uvec.add(e.next())

                    );

            }

        } catch (SizeLimitExceededException slee) {

            util.debugMessage("LDAP Server size limit exceeded. " +

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

    } catch (NamingException e) {

    return users;

  /**

   * Get all groups from the authentication service

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of the group names

         throws ConnectException

  /**

   * Get the groups for a particular user from the authentication service

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param foruser the user whose group list should be returned

   * @returns string array of the group names

         throws ConnectException

    userName=user;

    userPassword=password;

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        ctls.setReturningAttributes(attrIDs);

        ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

        String gfilter = "(objectClass=groupOfUniqueNames)";

        if (null == foruser) {

            filter = gfilter;

        } else {

            filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

        }

        // Print the groups

                                  " added to Group vector", 35);

        // Close the context when we're done

        ctx.close();

    catch (ReferralException re)

    {

      refExc = re;

      Thread t = new Thread(new GetGroup());

      {

      }

      catch(InterruptedException ie)

      {

      //this is a manual override of jndi's hideously long time

      //out period.

      {

        for(int i=0; i<uvec.size(); i++)

        return groups;

      }

      DirContext dc = (DirContext)referralContext;

      String[] attrIDs = {"cn"};

      // Specify the attributes to match.

      // Groups are objects with attribute objectclass=groupofuniquenames.

      // and have attribute uniquemember: uid=foruser,ldapbase.

      SearchControls ctls = new SearchControls();

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      String filter = null;

      String gfilter = "(objectClass=groupOfUniqueNames)";

      if (null == foruser) {

          filter = gfilter;

      } else {

          filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

      }

      try

      {

        // Print the groups

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          uvec.add(sr.getName()+","+ldapBase);

        }

        dc.close();