/ - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 3156

Added by Chris Jones almost 18 years ago

As a partial fix to http://bugzilla.ecoinformatics.org/show_bug.cgi?id=2747,
I've modified AuthLdap.getGroups() and removed the code that handles LDAP
referral connect and search timeout issues in a separate thread. I've replaced
this code with ReferralException code that uses two JNDI parameter settings:

SearchControls.setTimeLimit() and com.sun.jndi.ldap.connect.timeout. The former
limits how long in milliseconds a search can run without returning, and the
latter limits how long in milliseconds a connection to an LDAP referral can
wait with no successful connection. The previous code opened a new Thread
for each ReferralException, and interrupted the thread after 5 seconds. In
this way, the code is simpler and configurable.

Next, this patch changes how referrals are handled. Previously, the code
would terminate and return the groups array after hitting any NamingException
along the way. The new code iterates through all of the referrals in an outer
loop, handling NamingExceptions within an inner try/catch statement. Once
all referrals are processed, the groups array is finally returned.

Lastly, this patch changes how referred group hits are handled. This should
be open for discussion and testing. As it is, groups that are found at the
top level of the ecoinformatics.org LDAP tree will be returned as a relative
group name, such as cn=marine. However, any referral group hits get returned
as absolute URLs such as
ldap://directory.piscoweb.org:389/cn=data-managers,ou=groups,dc=piscoweb,dc=org??sub.
The above URL needs to be translated into an ecoinformatics.org-relative group.
Therefore, this patch does a second query to the ecoinformatics LDAP and finds
the point of the referral, in this case o=PISCOGROUPS,dc=ecoinformatics,dc=org.
The group is then rebuilt as cn=data-managers,o=PISCOGROUPS,dc=ecoinformatics,dc=org.

The question arises: Is this a good convention to stick to? It assumes (as
other parts of the Metacat code does) that groups are defined by commonName (cn)
attributes, and are located just below the top level of the referral point.
Perhaps there is a more flexible way to implement groups, but this way follows
the conventions thus far in the NCEAS, PISCO, LTER, and UCNRS LDAP servers.

        * @param foruser the user whose group list should be returned
        * @returns string array of the group names
        */
       public String[][] getGroups(String user, String password, String foruser) throws
           ConnectException {
       public String[][] getGroups(String user, String password,
         String foruser) throws ConnectException {
         logMetacat.debug("getGroups() called.");
         // create vectors to store group and dscription values returned from the
         // ldap servers
         Vector gvec = new Vector();
         Vector desc = new Vector();
         Attributes tempAttr = null;
         //Pass the username and password to run() method
         Attributes rsrAttr = null;
         // DURING getGroups(), DO WE NOT BIND USING userName AND userPassword??
         // NEED TO FIX THIS ...
         userName = user;
         userPassword = password;
         // Identify service provider to use
         env.put(Context.INITIAL_CONTEXT_FACTORY,
                 "com.sun.jndi.ldap.LdapCtxFactory");
         env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
         env.put(Context.REFERRAL, "throw");
         env.put(Context.PROVIDER_URL, ldapUrl);
         try {
         env.put("com.sun.jndi.ldap.connect.timeout", ldapConnectTimeLimit);
         // Iterate through the referrals, handling NamingExceptions in the
         // outer catch statement, ReferralExceptions in the inner catch statement
         try { // outer try
           // Create the initial directory context
           DirContext ctx = new InitialDirContext(env);
           // Specify the ids of the attributes to return
           String[] attrIDs = {
               "cn", "o", "description"};
           // Specify the attributes to match.
           // Groups are objects with attribute objectclass=groupofuniquenames.
           // and have attribute uniquemember: uid=foruser,ldapbase.
           SearchControls ctls = new SearchControls();
           // Specify the ids of the attributes to return
           String[] attrIDs = {"cn", "o", "description"};
           ctls.setReturningAttributes(attrIDs);
           // set the ldap search scope
           ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
           // set a 10 second time limit on searches to limit non-responding servers
           ctls.setTimeLimit(ldapSearchTimeLimit);
           // return at most 20000 entries
           ctls.setCountLimit(ldapSearchCountLimit);
           // build the ldap search filter that represents the "group" concept
           String filter = null;
           String gfilter = "(objectClass=groupOfUniqueNames)";
           if (null == foruser) {
             filter = gfilter;
+          }
           else {
           } else {
             filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";
+          }
           logMetacat.info("searching for groups: " + filter);
           NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);
           logMetacat.info("group filter is: " + filter);
           // now, search and iterate through the referrals
           for (boolean moreReferrals = true; moreReferrals;) {
             try { // inner try
               NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);
           // Print the groups
           logMetacat.info("getting group results.");
           while (namingEnum.hasMore()) {
             SearchResult sr = (SearchResult) namingEnum.next();
             tempAttr = sr.getAttributes();
               // Print the groups
               while (namingEnum.hasMore()) {
                 SearchResult sr = (SearchResult) namingEnum.next();
                 tempAttr = sr.getAttributes();
                 logMetacat.debug("Search result attributes are:" +
                   "\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" +
                   "\n\tcn:          " + tempAttr.get("cn") +
                   "\n\to:           " + tempAttr.get("o") +
                   "\n\tdescription: " + tempAttr.get("description") +
                   "\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
             if ( (tempAttr.get("description") + "").startsWith("description: ")) {
               desc.add( (tempAttr.get("description") + "").substring(13));
+            }
             else {
               desc.add(tempAttr.get("description") + "");
+            }
                 if ( (tempAttr.get("description") + "").startsWith("description: ")) {
                   desc.add( (tempAttr.get("description") + "").substring(13));
+                }
                 else {
                   desc.add(tempAttr.get("description") + "");
+                }
                 // check for an absolute URL value or an answer value relative
                 // to the target context
                 if ( !sr.getName().startsWith("ldap") &&
                       sr.isRelative()) {
                   logMetacat.debug("Search result entry is relative ...");
                   gvec.add(sr.getName() + "," + ldapBase);
                   logMetacat.info("group " + sr.getName() + "," +ldapBase +
                   " added to the group vector");
                 } else {
                   logMetacat.debug("Search result entry is absolute ...");
                   // search the top level directory for referral objects and match
                   // that of the search result's absolute URL.  This will let us
                   // rebuild the group name from the search result, referral point
                   // in the top directory tree, and ldapBase.
                   // configure a new directory search first
                   Hashtable envHash = new Hashtable(11);
                   // Identify service provider to use
                   envHash.put(Context.INITIAL_CONTEXT_FACTORY,
                     "com.sun.jndi.ldap.LdapCtxFactory");
                   envHash.put(Context.REFERRAL, "ignore");
                   envHash.put(Context.PROVIDER_URL, ldapUrl);
                   envHash.put("com.sun.jndi.ldap.connect.timeout",
                     ldapConnectTimeLimit);
                   try {
                     // Create the initial directory context
                     DirContext DirCtx = new InitialDirContext(envHash);
             gvec.add(sr.getName() + "," + ldapBase);
             logMetacat.info("group " + sr.getName() +
                                      " added to Group vector");
+          }
           // Close the context when we're done
                     SearchControls searchCtls = new SearchControls();
                     // Specify the ids of the attributes to return
                     String[] attrNames = {"o"};
                     searchCtls.setReturningAttributes(attrNames);
                     // set the ldap search scope - only look for top level referrals
                     searchCtls.setSearchScope(SearchControls.ONELEVEL_SCOPE);
                     // set a time limit on searches to limit non-responding servers
                     searchCtls.setTimeLimit(ldapSearchTimeLimit);
                     // return the configured number of entries
                     searchCtls.setCountLimit(ldapSearchCountLimit);
                     // Specify the attributes to match.
                     // build the ldap search filter to match referral entries that
                     // match the search result
                     String rFilter = "(&(objectClass=referral)(ref=" +
                     currentReferralInfo.substring(0,
                     currentReferralInfo.indexOf("?")) + "))";
                     logMetacat.debug("rFilter is: " + rFilter);
                     NamingEnumeration rNamingEnum =
                       DirCtx.search(ldapBase, rFilter, searchCtls);
                     while (rNamingEnum.hasMore()) {
                       SearchResult rsr = (SearchResult) rNamingEnum.next();
                       rsrAttr = rsr.getAttributes();
                       logMetacat.debug("referral search result is: " +
                         rsr.toString());
                       // add the returned groups to the group vector.  Test the
                       // syntax of the returned attributes - sometimes they are
                       // preceded with the attribute id and a colon
                       if ( (tempAttr.get("cn") + "").startsWith("cn: ")) {
                         gvec.add( "cn=" + (tempAttr.get("cn") + "").substring(4) +
                         "," + "o=" + (rsrAttr.get("o") + "").substring(3 ) + "," +
                         ldapBase);
                         logMetacat.info("group " +
                         (tempAttr.get("cn") + "").substring(4) + "," +
                         "o=" + (rsrAttr.get("o") + "").substring(3) + "," +
                         ldapBase + " added to the group vector");
                       } else {
                         gvec.add( "cn=" + tempAttr.get("cn") + "," +
                         "o=" + rsrAttr.get("o") +
                         "," + ldapBase);
                         logMetacat.info("group " +
                         "cn=" + tempAttr.get("cn") + "," +
                         "o=" + rsrAttr.get("o") + "," +
                         ldapBase + " added to the group vector");
+                      }
+                    }
                   } catch (NamingException nameEx){
                     logMetacat.debug("Caught naming exception: ");
                     nameEx.printStackTrace(System.err);
+                  }
+                }
               }// end while
               moreReferrals = false;
             } catch (ReferralException re) {
               logMetacat.info(
                 "In AuthLdap.getGroups(), caught referral exception: " +
                 re.getReferralInfo()
               );
               this.currentReferralInfo = (String) re.getReferralInfo();
               // set moreReferrals to true and set the referral context
               moreReferrals = true;
               ctx = (DirContext) re.getReferralContext();
             }// end inner try
           }// end for
           // close the context now that all initial and referral
           // searches are processed
           ctx.close();
+        }
         catch (ReferralException re) {
           refExc = re;
           Thread t = new Thread(new GetGroup());
           logMetacat.info("Starting thread...");
           t.start();
           logMetacat.info("sleeping for 5 seconds.");
           try {
             Thread.sleep(5000);
+          }
           catch (InterruptedException ie) {
             logMetacat.error("main thread interrupted: " + ie.getMessage());
+          }
           //this is a manual override of jndi's hideously long time
           //out period.
           logMetacat.info("Awake after 5 seconds.");
           if (referralContext == null) {
             logMetacat.info("thread timed out...returning groups: " +
                               gvec.toString());
             String groups[][] = new String[gvec.size()][2];
             for (int i = 0; i < gvec.size(); i++) {
               groups[i][0] = (String) gvec.elementAt(i);
               groups[i][1] = (String) desc.elementAt(i);
+            }
             t.interrupt();
             return groups;
+          }
           DirContext dc = (DirContext) referralContext;
           String[] attrIDs = {
               "cn", "o", "description"};
           // Specify the attributes to match.
           // Groups are objects with attribute objectclass=groupofuniquenames.
           // and have attribute uniquemember: uid=foruser,ldapbase.
           SearchControls ctls = new SearchControls();
           ctls.setReturningAttributes(attrIDs);
           ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
           String filter = null;
           String gfilter = "(objectClass=groupOfUniqueNames)";
           if (null == foruser) {
             filter = gfilter;
+          }
           else {
             filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";
+          }
           try {
             NamingEnumeration namingEnum = dc.search(ldapBase, filter, ctls);
             // Print the groups
             while (namingEnum.hasMore()) {
               SearchResult sr = (SearchResult) namingEnum.next();
               tempAttr = sr.getAttributes();
               if ( (tempAttr.get("description") + "").startsWith("description: ")) {
                 desc.add( (tempAttr.get("description") + "").substring(13));
+              }
               else {
                 desc.add(tempAttr.get("description") + "");
+              }
               gvec.add(sr.getName() + "," + ldapBase);
+            }
             referralContext.close();
             dc.close();
+          }
           catch (NamingException ne) {
             logMetacat.info("Naming Exception in AuthLdap.getGroups for referals" +
                                      ne.getExplanation() + ne.getMessage());
+          }
+        }
         catch (NamingException e) {
         } catch (NamingException e) {
           // naming exceptions get logged, groups are returned
           logMetacat.info("In AuthLdap.getGroups(), caught naming exception: ");
           e.printStackTrace(System.err);
         } finally {
           // once all referrals are followed, report and return the groups found
           logMetacat.warn("The user is in the following groups: " +
                                    gvec.toString());
           //build and return the groups array
           String groups[][] = new String[gvec.size()][2];
           for (int i = 0; i < gvec.size(); i++) {
             groups[i][0] = (String) gvec.elementAt(i);
             groups[i][1] = (String) desc.elementAt(i);
+          }
           return groups;
           /*throw new ConnectException(
                  "Problem getting groups for a user in AuthLdap.getGroups:" + e);*/
+        }
         logMetacat.warn("The user is in the following groups: " +
                                  gvec.toString());
         String groups[][] = new String[gvec.size()][2];
         for (int i = 0; i < gvec.size(); i++) {
           groups[i][0] = (String) gvec.elementAt(i);
           groups[i][1] = (String) desc.elementAt(i);
+        }
         return groups;
         }// end outer try
+      }
       /**
-...
        * @param foruser the user whose attributes should be returned
        * @returns HashMap a map of attribute name to a Vector of values
        */
       public HashMap getAttributes(String user, String password, String foruser) throws
           ConnectException {
       public HashMap getAttributes(String user, String password,
         String foruser) throws ConnectException {
         HashMap attributes = new HashMap();
         String ldapUrl = this.ldapUrl;
         String ldapBase = this.ldapBase;
-...
        * starting from the Metacat LDAP root,
        * i.e. ldap://dev.nceas.ucsb.edu/dc=ecoinformatics,dc=org
        */
       private Hashtable getSubtrees(String user, String password,
                                     String ldapUrl, String ldapBase) throws
           ConnectException {
       private Hashtable getSubtrees(String user, String password,
         String ldapUrl, String ldapBase) throws ConnectException {
         Hashtable trees = new Hashtable();
         // Identify service provider to use
-...
        * @param user the user which requests the information
        * @param password the user's password
        */
       public String getPrincipals(String user, String password) throws
           ConnectException {
       public String getPrincipals(String user, String password) throws
         ConnectException {
         StringBuffer out = new StringBuffer();
         out.append("<?xml version=\"1.0\" encoding=\"US-ASCII\"?>\n");

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 3156

Added by Chris Jones almost 18 years ago