Metacat

/**

 *  '$RCSfile$'

 *    Purpose: An implementation of the AuthInterface interface that

 *             allows Metacat to use the LDAP protocol for

 *             directory services

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *    Release: @release@

 *

 *   '$Author: sgarg $'

 *     '$Date: 2005-10-27 16:15:00 -0700 (Thu, 27 Oct 2005) $'

 * '$Revision: 2697 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.naming.AuthenticationException;

import javax.naming.Context;

import javax.naming.NamingEnumeration;

import javax.naming.NamingException;

import javax.naming.SizeLimitExceededException;

import javax.naming.InitialContext;

import javax.naming.directory.InvalidSearchFilterException;

import javax.naming.directory.Attribute;

import javax.naming.directory.Attributes;

import javax.naming.directory.BasicAttribute;

import javax.naming.directory.BasicAttributes;

import javax.naming.directory.DirContext;

import javax.naming.directory.InitialDirContext;

import javax.naming.directory.SearchResult;

import javax.naming.directory.SearchControls;

import javax.naming.ReferralException;

import javax.naming.ldap.*;

import org.apache.log4j.Logger;

import java.net.URLDecoder;

import java.util.Iterator;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Enumeration;

import java.util.Set;

import java.util.Vector;

/**

 * An implementation of the AuthInterface interface that

 * allows Metacat to use the LDAP protocol for directory services.

 * The LDAP authentication service is used to determine if a user

 * is authenticated, and whether they are a member of a particular group.

 */

public class AuthLdap

    implements AuthInterface, Runnable {

  private MetaCatUtil util = new MetaCatUtil();

  private String ldapUrl;

  private String ldapsUrl;

  private String ldapBase;

  private String referral;

  private Context referralContext;

  Hashtable env = new Hashtable(11);

  private Context rContext;

  private String userName;

  private String userPassword;

  ReferralException refExc;

  private static Logger logMetacat = Logger.getLogger(AuthLdap.class);

  /**

   * Construct an AuthLdap

   */

  public AuthLdap() {

    // Read LDAP URI for directory service information

    this.ldapUrl = MetaCatUtil.getOption("ldapurl");

    this.ldapsUrl = MetaCatUtil.getOption("ldapsurl");

    this.ldapBase = MetaCatUtil.getOption("ldapbase");

    this.referral = MetaCatUtil.getOption("referral");

  }

  /**

   * Determine if a user/password are valid according to the authentication

   * service.

   *

   * @param user the name of the principal to authenticate

   * @param password the password to use for authentication

   * @returns boolean true if authentication successful, false otherwise

   */

  public boolean authenticate(String user, String password) throws

      ConnectException {

    String ldapUrl = this.ldapUrl;

    String ldapsUrl = this.ldapsUrl;

    String ldapBase = this.ldapBase;

    boolean authenticated = false;

    String identifier = user;

    //get uid here.

    //uid=user.substring(0, user.indexOf(","));

    try {

      // Check the usename as passed in

      authenticated = ldapAuthenticate(identifier, password);

      // if not found, try looking up a valid DN then auth again

      if (!authenticated) {

        logMetacat.info("Looking up DN for: " + identifier);

        identifier = getIdentifyingName(identifier, ldapUrl, ldapBase);

        logMetacat.info("DN found: " + identifier);

        String decoded = URLDecoder.decode(identifier);

        logMetacat.info("DN decoded: " + decoded);

        identifier = decoded;

        String refUrl = "";

        String refBase = "";

        if (identifier.startsWith("ldap")) {

          refUrl = identifier.substring(0,

                                        identifier.lastIndexOf("/") + 1);

          logMetacat.info("Ref ldapUrl: " + refUrl);

          int position = identifier.indexOf(",");

          int position2 = identifier.indexOf(",", position + 1);

          refBase = identifier.substring(position2 + 1);

          logMetacat.info("Ref ldapBase: " + refBase);

          identifier = identifier.substring(

              identifier.lastIndexOf("/") + 1);

          logMetacat.info("Trying: " + identifier);

          authenticated = ldapAuthenticate(identifier, password,

                                           refUrl, refBase);

        }

        else {

          identifier = identifier + "," + ldapBase;

          logMetacat.info("Trying: " + identifier);

          authenticated = ldapAuthenticate(identifier, password);

        }

        //authenticated = ldapAuthenticate(identifier, password);

      }

    }

    catch (NullPointerException e) {

      logMetacat.error("NullPointerException b' password is null");

      logMetacat.error("NullPointerException while authenticating in " +

                        "AuthLdap.authenticate: " + e);

      throw new ConnectException(

          "NullPointerException while authenticating in " +

          "AuthLdap.authenticate: " + e);

    }

    catch (NamingException e) {

      logMetacat.error("Naming exception while authenticating in " +

                        "AuthLdap.authenticate: " + e);

      e.printStackTrace();

    }

    catch (Exception e) {

      logMetacat.error(e.getMessage());

    }

    return authenticated;

  }

  /**

   * Connect to the LDAP directory and do the authentication using the

   * username and password as passed into the routine.

   *

   * @param identifier the distinguished name to check against LDAP

   * @param password the password for authentication

   */

  private boolean ldapAuthenticate(String identifier, String password) throws

      ConnectException, NamingException, NullPointerException {

    return ldapAuthenticate(identifier, password,

                            this.ldapsUrl, this.ldapBase);

  }

  /**

   * Connect to the LDAP directory and do the authentication using the

   * username and password as passed into the routine.

   *

   * @param identifier the distinguished name to check against LDAP

   * @param password the password for authentication

   */

  private boolean ldapAuthenticate(String identifier, String password,

                                   String directoryUrl, String searchBase) throws

      ConnectException, NamingException, NullPointerException {

    double totStartTime = System.currentTimeMillis();

    boolean authenticated = false;

    if (identifier != null && !password.equals("")) {

      //Pass the username and password to run() method

      userName = identifier;

      userPassword = password;

      // Identify service provider to use

      Hashtable env = new Hashtable(11);

      env.put(Context.INITIAL_CONTEXT_FACTORY,

              "com.sun.jndi.ldap.LdapCtxFactory");

      env.put(Context.REFERRAL, "throw");

      env.put(Context.PROVIDER_URL, directoryUrl + searchBase);

      logMetacat.info("PROVIDER_URL set to: " + directoryUrl + searchBase);

      if (!ldapsUrl.equals(ldapUrl)) {

        // ldap is set on default port 389

        // ldaps is set on second port - 636 by default

        // env.put(Context.SECURITY_PROTOCOL, "ssl");

       }

      env.put(Context.SECURITY_AUTHENTICATION, "simple");

      env.put(Context.SECURITY_PRINCIPAL, identifier);

      env.put(Context.SECURITY_CREDENTIALS, password);

      // If our auth credentials are invalid, an exception will be thrown

      DirContext ctx = null;

      try {

        double startTime = System.currentTimeMillis();

        //Here to check the authorization

        ctx = new InitialDirContext(env);

        double stopTime = System.currentTimeMillis();

        logMetacat.info("Connection time thru " + ldapsUrl + " was: " +

                          (stopTime - startTime) / 1000 + " seconds.");

        authenticated = true;

        //tls.close();

        ctx.close();

        this.ldapUrl = ldapUrl;

        this.ldapBase = ldapBase;

        //break;

      }

      catch (AuthenticationException ae) {

        authenticated = false;

        if (ctx != null) {

          ctx.close();

        }

      }

      catch (javax.naming.InvalidNameException ine) {

        logMetacat.error("An invalid DN was provided!");

      }

      catch (javax.naming.ReferralException re) {

        logMetacat.error("referral during authentication");

        logMetacat.error("Referral information: " + re.getReferralInfo());

        try {

          refExc = re;

          Thread t = new Thread(this);

          t.start();

          Thread.sleep(5000); //this is a manual override of ldap's

          //hideously long time out period.

          logMetacat.info("Awake after 5 seconds.");

          if (referralContext == null) {

            t.interrupt();

            authenticated = false;

          }

          else {

            authenticated = true;

          }

        }

        catch (Exception e) {

          authenticated = false;

        }

      }

    }

    else {

      logMetacat.info("User not found");

    }

    double totStopTime = System.currentTimeMillis();

    logMetacat.warn("total ldap authentication time: " +

                      (totStopTime - totStartTime) / 1000 + " seconds");

    return authenticated;

  }

  /**

   * Get the identifying name for a given userid or name.  This is the name

   * that is used in conjunction withthe LDAP BaseDN to create a

   * distinguished name (dn) for the record

   *

   * @param user the user for which the identifying name is requested

   * @returns String the identifying name for the user,

   *          or null if not found

   */

  private String getIdentifyingName(String user, String ldapUrl,

                                    String ldapBase) throws NamingException {

    String identifier = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    logMetacat.info("setting referrals to: " + referral);

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    //    non-secure LDAP context; dn are publicly readable

    try {

      // Bind to the LDAP server, in order to search for the right

      // distinguished name (dn) based on userid (uid) or common name (cn)

      DirContext ctx = new InitialDirContext(env);

      SearchControls ctls = new SearchControls();

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      // Search for the user id or name using the uid, then cn and sn

      //attributes

      // If we find a record, determine the dn for the record

      // The following blocks need to be refactored into a subroutine

      // they have a ridiculous amount of redundancy

      // Parse out the uid and org components and look up the real DN

      // This assumes a dn like "uid=x,o=y,dc=someinst,dc=org"

      int position = user.indexOf(",");

      String comp1 = user.substring(0, position);

      logMetacat.info("First comp is: " + comp1);

      String comp2 = user.substring(position + 1,

                                    user.indexOf(",", position + 1));

      logMetacat.info("Second comp is: " + comp2);

      //String filter = "(&(" + comp1 + "))";

      String filter = "(&(" + comp1 + ")(" + comp2 + "))";

      logMetacat.info("Filter is: " + filter);

      logMetacat.info("Provider URL is: " + ldapUrl + ldapBase);

      NamingEnumeration answer;

      try {

        logMetacat.info("Trying search 1: " + filter);

        answer = ctx.search("", filter, ctls);

        logMetacat.info("Search 1 complete");

        if (answer == null) {

          logMetacat.info("Search 1 answer is null.");

        }

        if (answer.hasMore()) {

          logMetacat.info("Search 1 has answers.");

          SearchResult sr = (SearchResult) answer.next();

          identifier = sr.getName();

          logMetacat.info("Originally Found: " + identifier);

          return identifier;

        }

      }

      catch (InvalidSearchFilterException e) {

        logMetacat.error("Invalid Filter exception thrown (if1)");

      }

      // That failed, so check if it is just a username

      filter = "(" + user + ")";

      try {

        logMetacat.info("Trying again: " + filter);

        answer = ctx.search("", filter, ctls);

        if (answer.hasMore()) {

          SearchResult sr = (SearchResult) answer.next();

          identifier = sr.getName();

          if (!sr.isRelative()) {

            this.ldapUrl = identifier.substring(0,

                                                identifier.lastIndexOf("/") + 1);

            this.ldapBase = identifier.substring(identifier.indexOf(",") + 1);

            identifier = identifier.substring(identifier.lastIndexOf("/") + 1,

                                              identifier.indexOf(","));

          }

          logMetacat.info("Found: " + identifier);

          return identifier;

        }

      }

      catch (InvalidSearchFilterException e) {}

      // Maybe its a user id (uid)

      filter = "(uid=" + user + ")";

      logMetacat.info("Trying again: " + filter);

      answer = ctx.search("", filter, ctls);

      if (answer.hasMore()) {

        SearchResult sr = (SearchResult) answer.next();

        identifier = sr.getName();

        if (!sr.isRelative()) {

          this.ldapUrl = identifier.substring(0,

                                              identifier.lastIndexOf("/") + 1);

          this.ldapBase = identifier.substring(identifier.indexOf(",") + 1);

          identifier = identifier.substring(identifier.lastIndexOf("/") + 1,

                                            identifier.indexOf(","));

        }

        logMetacat.info("Found: " + identifier);

      }

      else {

        // maybe its just a common name

        filter = "(cn=" + user + ")";

        logMetacat.info("Trying again: " + filter);

        NamingEnumeration answer2 = ctx.search("", filter, ctls);

        if (answer2.hasMore()) {

          SearchResult sr = (SearchResult) answer2.next();

          identifier = sr.getName();

          if (!sr.isRelative()) {

            this.ldapUrl = identifier.substring(0,

                                                identifier.lastIndexOf("/") + 1);

            this.ldapBase = identifier.substring(identifier.indexOf(",") + 1);

            identifier = identifier.substring(identifier.lastIndexOf("/") + 1,

                                              identifier.indexOf(","));

          }

          logMetacat.info("Found: " + identifier);

        }

        else {

          // ok, last resort, is it a surname?

          filter = "(sn=" + user + ")";

          logMetacat.info("Trying again: " + filter);

          NamingEnumeration answer3 = ctx.search("", filter, ctls);

          if (answer3.hasMore()) {

            SearchResult sr = (SearchResult) answer3.next();

            identifier = sr.getName();

            if (!sr.isRelative()) {

              this.ldapUrl = identifier.substring(0,

                                                  identifier.lastIndexOf("/") +

                                                  1);

              this.ldapBase = identifier.substring(identifier.indexOf(",") + 1);

              identifier = identifier.substring(identifier.lastIndexOf("/") + 1,

                                                identifier.indexOf(","));

            }

            logMetacat.info("Found: " + identifier);

          }

        }

      }

      // Close the context when we're done the initial search

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Naming exception while getting dn: " + e);

      throw new NamingException(

          "Naming exception in AuthLdap.getIdentifyingName: " + e);

    }

    logMetacat.error("Returning found identifier as: " + identifier);

    return identifier;

  }

  /**

   * Get all users from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of all of the user names

   */

  public String[][] getUsers(String user, String password) throws

      ConnectException {

    String[][] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the attributes to match.

      // Users are objects that have the attribute objectclass=InetOrgPerson.

      SearchControls ctls = new SearchControls();

      String[] attrIDs = {

          "dn", "cn", "o", "ou", "mail"};

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      //ctls.setCountLimit(1000);

      String filter = "(objectClass=inetOrgPerson)";

      NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);

      // Store the users in a vector

      Vector uvec = new Vector();

      Vector uname = new Vector();

      Vector uorg = new Vector();

      Vector uou = new Vector();

      Vector umail = new Vector();

      Attributes tempAttr = null;

      try {

        while (namingEnum.hasMore()) {

          SearchResult sr = (SearchResult) namingEnum.next();

          tempAttr = sr.getAttributes();

          if ( (tempAttr.get("cn") + "").startsWith("cn: ")) {

            uname.add( (tempAttr.get("cn") + "").substring(4));

          }

          else {

            uname.add(tempAttr.get("cn") + "");

          }

          if ( (tempAttr.get("o") + "").startsWith("o: ")) {

            uorg.add( (tempAttr.get("o") + "").substring(3));

          }

          else {

            uorg.add(tempAttr.get("o") + "");

          }

          if ( (tempAttr.get("ou") + "").startsWith("ou: ")) {

            uou.add( (tempAttr.get("ou") + "").substring(4));

          }

          else {

            uou.add(tempAttr.get("ou") + "");

          }

          if ( (tempAttr.get("mail") + "").startsWith("mail: ")) {

            umail.add( (tempAttr.get("mail") + "").substring(6));

          }

          else {

            umail.add(tempAttr.get("mail") + "");

          }

          uvec.add(sr.getName() + "," + ldapBase);

        }

      }

      catch (SizeLimitExceededException slee) {

        logMetacat.error("LDAP Server size limit exceeded. " +

                          "Returning incomplete record set.");

      }

      // initialize users[]; fill users[]

      users = new String[uvec.size()][5];

      for (int i = 0; i < uvec.size(); i++) {

        users[i][0] = (String) uvec.elementAt(i);

        users[i][1] = (String) uname.elementAt(i);

        users[i][2] = (String) uorg.elementAt(i);

        users[i][3] = (String) uorg.elementAt(i);

        users[i][4] = (String) umail.elementAt(i);

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Problem getting users in AuthLdap.getUsers:" + e);

      //e.printStackTrace(System.err);

      throw new ConnectException(

          "Problem getting users in AuthLdap.getUsers:" + e);

    }

    return users;

  }

  /**

   * Get all users from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of all of the user names

   */

  public String[] getUserInfo(String user, String password) throws

      ConnectException {

    String[] userinfo = new String[3];

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the attributes to match.

      // Users are objects that have the attribute objectclass=InetOrgPerson.

      SearchControls ctls = new SearchControls();

      String[] attrIDs = {

          "cn", "o", "mail"};

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      //ctls.setCountLimit(1000);

      // create the filter based on the uid

      String filter = null;

      if(user.indexOf("o=")>0){

    	  String tempStr = user.substring(user.indexOf("o="));

    	  filter = "(&(" + user.substring(0, user.indexOf(",")) 

			+ ")(" + tempStr.substring(0, tempStr.indexOf(",")) 

			+ "))";      

      } else{

    	  filter = "(&(" + user.substring(0, user.indexOf(",")) 

			+ "))";          		  

      }

   	  filter = "(&(" + user.substring(0, user.indexOf(",")) 

		+ "))";          		  

      NamingEnumeration namingEnum = ctx.search(user, filter, ctls);

      Attributes tempAttr = null;

      try {

        while (namingEnum.hasMore()) {

          SearchResult sr = (SearchResult) namingEnum.next();

          tempAttr = sr.getAttributes();

          if ( (tempAttr.get("cn") + "").startsWith("cn: ")) {

        	  userinfo[0] = (tempAttr.get("cn") + "").substring(4);

          }

          else {

        	  userinfo[0] = (tempAttr.get("cn") + "");

          }

          if ( (tempAttr.get("o") + "").startsWith("o: ")) {

        	  userinfo[1] = (tempAttr.get("o") + "").substring(3);

          }

          else {

        	  userinfo[1] = (tempAttr.get("o") + "");

          }

          if ( (tempAttr.get("mail") + "").startsWith("mail: ")) {

        	  userinfo[2] =  (tempAttr.get("mail") + "").substring(6);

          }

          else {

        	  userinfo[2] = (tempAttr.get("mail") + "");

          }

        }

      }

      catch (SizeLimitExceededException slee) {

        logMetacat.error("LDAP Server size limit exceeded. " +

                          "Returning incomplete record set.");

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Problem getting users in AuthLdap.getUsers:" + e);

      //e.printStackTrace(System.err);

      throw new ConnectException(

          "Problem getting users in AuthLdap.getUsers:" + e);

    }

    return userinfo;

  }

  /**

   * Get the users for a particular group from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param group the group whose user list should be returned

   * @returns string array of the user names belonging to the group

   */

  public String[] getUsers(String user, String password, String group) throws

      ConnectException {

    String[] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the ids of the attributes to return

      String[] attrIDs = {

          "uniqueMember"};

      Attributes answer = ctx.getAttributes(group, attrIDs);

      Vector uvec = new Vector();

      try {

        for (NamingEnumeration ae = answer.getAll(); ae.hasMore(); ) {

          Attribute attr = (Attribute) ae.next();

          for (NamingEnumeration e = attr.getAll();

               e.hasMore();

               uvec.add(e.next())

               ) {

            ;

          }

        }

      }

      catch (SizeLimitExceededException slee) {

        logMetacat.error("LDAP Server size limit exceeded. " +

                          "Returning incomplete record set.");

      }

      // initialize users[]; fill users[]

      users = new String[uvec.size()];

      for (int i = 0; i < uvec.size(); i++) {

        users[i] = (String) uvec.elementAt(i);

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Problem getting users for a group in " +

                        "AuthLdap.getUsers:" + e);

      throw new ConnectException(

          "Problem getting users for a group in AuthLdap.getUsers:" + e);

    }

    return users;

  }

  /**

   * Get all groups from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of the group names

   */

  public String[][] getGroups(String user, String password) throws

      ConnectException {

    return getGroups(user, password, null);

  }

  /**

   * Get the groups for a particular user from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param foruser the user whose group list should be returned

   * @returns string array of the group names

   */

  public String[][] getGroups(String user, String password, String foruser) throws

      ConnectException {

    Vector gvec = new Vector();

    Vector desc = new Vector();

    Attributes tempAttr = null;

    //Pass the username and password to run() method

    userName = user;

    userPassword = password;

    // Identify service provider to use

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, "throw");

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the ids of the attributes to return

      String[] attrIDs = {

          "cn", "o", "description"};

      // Specify the attributes to match.

      // Groups are objects with attribute objectclass=groupofuniquenames.

      // and have attribute uniquemember: uid=foruser,ldapbase.

      SearchControls ctls = new SearchControls();

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      String filter = null;

      String gfilter = "(objectClass=groupOfUniqueNames)";

      if (null == foruser) {

        filter = gfilter;

      }

      else {

        filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

      }

      logMetacat.info("searching for groups: " + filter);

      NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);

      // Print the groups

      logMetacat.info("getting group results.");

      while (namingEnum.hasMore()) {

        SearchResult sr = (SearchResult) namingEnum.next();

        tempAttr = sr.getAttributes();

        if ( (tempAttr.get("description") + "").startsWith("description: ")) {

          desc.add( (tempAttr.get("description") + "").substring(13));

        }

        else {

          desc.add(tempAttr.get("description") + "");

        }

        gvec.add(sr.getName() + "," + ldapBase);

        logMetacat.info("group " + sr.getName() +

                                 " added to Group vector");

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (ReferralException re) {

      refExc = re;

      Thread t = new Thread(new GetGroup());

      logMetacat.info("Starting thread...");

      t.start();

      logMetacat.info("sleeping for 5 seconds.");

      try {

        Thread.sleep(5000);

      }

      catch (InterruptedException ie) {

        logMetacat.error("main thread interrupted: " + ie.getMessage());

      }

      //this is a manual override of jndi's hideously long time

      //out period.

      logMetacat.info("Awake after 5 seconds.");

      if (referralContext == null) {

        logMetacat.info("thread timed out...returning groups: " +

                          gvec.toString());

        String groups[][] = new String[gvec.size()][2];

        for (int i = 0; i < gvec.size(); i++) {

          groups[i][0] = (String) gvec.elementAt(i);

          groups[i][1] = (String) desc.elementAt(i);

        }

        t.interrupt();

        return groups;

      }

      DirContext dc = (DirContext) referralContext;

      String[] attrIDs = {

          "cn", "o", "description"};

      // Specify the attributes to match.

      // Groups are objects with attribute objectclass=groupofuniquenames.

      // and have attribute uniquemember: uid=foruser,ldapbase.

      SearchControls ctls = new SearchControls();

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      String filter = null;

      String gfilter = "(objectClass=groupOfUniqueNames)";

      if (null == foruser) {

        filter = gfilter;

      }

      else {

        filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

      }

      try {

        NamingEnumeration namingEnum = dc.search(ldapBase, filter, ctls);

        // Print the groups

        while (namingEnum.hasMore()) {

          SearchResult sr = (SearchResult) namingEnum.next();