Metacat

 * An implementation of the AuthInterface interface that

 * allows Metacat to use the LDAP protocol for directory services.

 * The LDAP authentication service is used to determine if a user

 * is authenticated, and whether they are a member of a particular group.

  private String ldapUrl;

  private String ldapsUrl;

  private String ldapBase;

  private String referral;

  private String ldapConnectTimeLimit;

  private int ldapSearchTimeLimit;

  private int ldapSearchCountLimit;

  private String currentReferralInfo;

  Hashtable env = new Hashtable(11);

  private Context rContext;

  private String userName;

  private String userPassword;

  ReferralException refExc;

  private static Logger logMetacat = Logger.getLogger(AuthLdap.class);

    /**

			// use the NCEAS base as a fallback.  Normally, the base will be

  /**

  public boolean authenticate(String user, String password) throws ConnectException {

    String ldapUrl = this.ldapUrl;

    String ldapsUrl = this.ldapsUrl;

    String ldapBase = this.ldapBase;

    boolean authenticated = false;

    String identifier = user;

    //get uid here.

    if (user.indexOf(",") == -1) {

    	throw new ConnectException("Invalid LDAP user credential: " + user + ".  Missing ','");

    }

    String uid=user.substring(0, user.indexOf(","));

    user = user.substring(user.indexOf(","), user.length());

    logMetacat.debug("identifier: " + identifier);

    logMetacat.debug("uid: " + uid);

    logMetacat.debug("user: " + user);

    try {

    	// Check the usename as passed in

        logMetacat.info("Calling ldapAuthenticate");

        logMetacat.info("with user as identifier: " + identifier);

        authenticated = ldapAuthenticate(identifier, password, 

        		(new Boolean(PropertyService.getProperty("ldap.onlySecureConnection"))).booleanValue());

        // if not found, try looking up a valid DN then auth again

        if (!authenticated) {

        	logMetacat.info("Not Authenticated");

        	logMetacat.info("Looking up DN for: " + identifier);

        	identifier = getIdentifyingName(identifier, ldapUrl, ldapBase);

        	if(identifier == null){

        		logMetacat.info("No DN found from getIdentifyingName");

        		return authenticated;

        	}

           	logMetacat.info("DN found from getIdentifyingName: " + identifier);

        	String decoded = URLDecoder.decode(identifier);

        	logMetacat.info("DN decoded: " + decoded);

        	identifier = decoded;

        	String refUrl = "";

        	String refBase = "";

        	if (identifier.startsWith("ldap")) {

        		logMetacat.debug("identifier starts with \"ldap\"");

        		refUrl = identifier.substring(0, identifier.lastIndexOf("/") + 1);

        		int position = identifier.indexOf(",");

        		int position2 = identifier.indexOf(",", position + 1);

        		refBase = identifier.substring(position2 + 1);

        		identifier = identifier.substring(identifier.lastIndexOf("/") + 1);

        		logMetacat.info("Calling ldapAuthenticate:");

        		logMetacat.info("with user as identifier: " + identifier);

        		logMetacat.info("and refUrl as: " + refUrl);

        		logMetacat.info("and refBase as: " + refBase);

        		authenticated = ldapAuthenticate(identifier, password, refUrl, refBase,

                		(new Boolean(PropertyService.getProperty("ldap.onlySecureReferalsConnection")))

                			.booleanValue());

        	} else {

        		logMetacat.info("identifier doesnt start with ldap");

        		identifier = identifier + "," + ldapBase;

        		logMetacat.info("Calling ldapAuthenticate");

        		logMetacat.info("with user as identifier: " + identifier);

        		authenticated = ldapAuthenticate(identifier, password,

            		(new Boolean(PropertyService.getProperty("ldap.onlySecureConnection"))).booleanValue());

        	}

        }

    } catch (NullPointerException e) {

    	logMetacat.error("NullPointerException while authenticating in " +

                        "AuthLdap.authenticate: " + e);

    	e.printStackTrace();

    	throw new ConnectException(

          "NullPointerException while authenticating in " +

          "AuthLdap.authenticate: " + e);

    } catch (NamingException e) {

    	logMetacat.error("Naming exception while authenticating in " +

                        "AuthLdap.authenticate: " + e);

    	e.printStackTrace();

    } catch (Exception e) {

    	logMetacat.error(e.getMessage());

    }

    return authenticated;

  }

  /**

   * Connect to the LDAP directory and do the authentication using the

   * username and password as passed into the routine.

   *

   * @param identifier the distinguished name to check against LDAP

   * @param password the password for authentication

   */

  private boolean ldapAuthenticate(String identifier, String password, boolean 

    secureConnectionOnly) throws ConnectException, NamingException, 

    NullPointerException {

    return ldapAuthenticate(identifier, password,

                            this.ldapsUrl, this.ldapBase, secureConnectionOnly);

  }

  /**

   * Connect to the LDAP directory and do the authentication using the

   * username and password as passed into the routine.

   *

   * @param identifier the distinguished name to check against LDAP

   * @param password the password for authentication

   */

  private boolean ldapAuthenticate(String dn, String password, 

    String rootServer, String rootBase, boolean secureConnectionOnly){

	  boolean authenticated = false;

	  String server = "";

	  String userDN = "";

	  logMetacat.info("dn is: " + dn);

	  int position = dn.lastIndexOf("/");

      logMetacat.debug("position is: " + position);

	  if (position == -1) {

		  server = rootServer;

		  if(dn.indexOf(userDN) < 0){

			  userDN = dn + "," + rootBase;

		  } else {

			  userDN = dn;

		  }

		  logMetacat.info("userDN is: " + userDN);

       } else {

		  server = dn.substring(0, position+1);

		  userDN = dn.substring(position+1);

		  logMetacat.info("server is: " + server);

		  logMetacat.info("userDN is: " + userDN);

	   }

	   logMetacat.warn("Trying to authenticate: " + userDN);

	   logMetacat.warn("          Using server: " + server);

	   LdapContext ctx = null;

	   double startTime;

	   double stopTime;

	   try 

     {

		   Hashtable env = new Hashtable();

		   env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		   env.put(Context.PROVIDER_URL, server);

		   env.put(Context.REFERRAL, "throw");

		   try 

       {

			   startTime = System.currentTimeMillis();

			   ctx = new InitialLdapContext(env, null);

			   // Start up TLS here so that we don't pass our jewels in cleartext

		       StartTlsResponse tls =

		              (StartTlsResponse)ctx.extendedOperation(new StartTlsRequest());

		       //tls.setHostnameVerifier(new SampleVerifier());

		       SSLSession sess = tls.negotiate();

		       ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");

			   ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDN);

			   ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);

			   ctx.reconnect(null);

			   stopTime = System.currentTimeMillis();

			   logMetacat.info("Connection time thru " + ldapsUrl + " was: " +

                       	(stopTime - startTime) / 1000 + " seconds.");

			   authenticated = true;

		   } 

       catch (Exception ioe) 

       {

			   logMetacat.info("Caught IOException in login while negotiating TLS: "

	                                 + ioe.getMessage());

			   if(secureConnectionOnly)

         {

				   return authenticated;

			   } 

         else 

         {

				   logMetacat.info("Trying to authenticate without TLS");

				   env.put(Context.SECURITY_AUTHENTICATION, "simple");

				   env.put(Context.SECURITY_PRINCIPAL, userDN);

				   env.put(Context.SECURITY_CREDENTIALS, password);

				   startTime = System.currentTimeMillis();

				   ctx = new InitialLdapContext(env, null);				

				   stopTime = System.currentTimeMillis();

				   logMetacat.info("Connection time thru " + ldapsUrl + " was: " +

	                       	(stopTime - startTime) / 1000 + " seconds.");

				   authenticated = true;

			   }

		   }

	   } 

     catch (AuthenticationException ae) 

     {

		   authenticated = false;

	   } 

     catch (javax.naming.InvalidNameException ine) 

     {

	        logMetacat.error("An invalid DN was provided!");

	   } 

     catch (NamingException e) 

     {

		   logMetacat.warn("Caught NamingException in login: " + e.getClass().getName());

		   logMetacat.info(e.toString() + "  " + e.getRootCause());

     }

       return authenticated;

  }

  /**

   * Get the identifying name for a given userid or name.  This is the name

   * that is used in conjunction withthe LDAP BaseDN to create a

   * distinguished name (dn) for the record

   *

   * @param user the user for which the identifying name is requested

   * @returns String the identifying name for the user,

   *          or null if not found

   */

  private String getIdentifyingName(String user, String ldapUrl, 

    String ldapBase) throws NamingException {

      String identifier = null;

      Hashtable env = new Hashtable();

      env.put(Context.INITIAL_CONTEXT_FACTORY,

              "com.sun.jndi.ldap.LdapCtxFactory");

      env.put(Context.REFERRAL, "throw");

      env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

      try {

    	  int position = user.indexOf(",");

          String uid = user.substring(user.indexOf("=") + 1, position);

          logMetacat.info("uid is: " + uid);

          String org = user.substring(user.indexOf("=", position + 1) + 1,

                                        user.indexOf(",", position + 1));

          logMetacat.info("org is: " + org);

          DirContext sctx = new InitialDirContext(env);

          SearchControls ctls = new SearchControls();

          ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

          String filter = "(&(uid=" + uid + ")(o=" + org + "))";

          logMetacat.warn("Searching for DNs with following filter: " + filter);

          for (boolean moreReferrals = true; moreReferrals;) {

              try {

                  // Perform the search

                  NamingEnumeration answer = 

                      sctx.search("", filter, ctls);

                  // Return the answer

                  while (answer.hasMore()) {

                      SearchResult sr = (SearchResult)answer.next();

                      identifier = sr.getName();

                      return identifier;

                  }

                  // The search completes with no more referrals

                  moreReferrals = false;

              } catch (ReferralException e) {

            	  logMetacat.info("Got referral: " + e.getReferralInfo());

            	  // Point to the new context from the referral

                  if (moreReferrals) {

                      sctx = (DirContext) e.getReferralContext();

                  }

              }

          }

      } catch (NamingException e) {

    	     logMetacat.error("Naming exception while getting dn: " + e);

    	      throw new NamingException(

    	          "Naming exception in AuthLdap.getIdentifyingName: " + e);

    	      }

      return identifier;

  }

  /**

   * Get all users from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of all of the user names

   */

  public String[][] getUsers(String user, String password) throws 

    ConnectException {

    String[][] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    env.put("com.sun.jndi.ldap.connect.timeout", ldapConnectTimeLimit);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the attributes to match.

      // Users are objects that have the attribute objectclass=InetOrgPerson.

      SearchControls ctls = new SearchControls();

      String[] attrIDs = {

          "dn", "cn", "o", "ou", "mail"};

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      ctls.setTimeLimit(ldapSearchTimeLimit);

      //ctls.setCountLimit(1000);

      String filter = "(objectClass=inetOrgPerson)";

      NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);

      // Store the users in a vector

      Vector uvec = new Vector();

      Vector uname = new Vector();

      Vector uorg = new Vector();

      Vector uou = new Vector();

      Vector umail = new Vector();

      Attributes tempAttr = null;

      try {

        while (namingEnum.hasMore()) {

          SearchResult sr = (SearchResult) namingEnum.next();

          tempAttr = sr.getAttributes();

          if ( (tempAttr.get("cn") + "").startsWith("cn: ")) {

            uname.add( (tempAttr.get("cn") + "").substring(4));

          }

          else {

            uname.add(tempAttr.get("cn") + "");

          }

          if ( (tempAttr.get("o") + "").startsWith("o: ")) {

            uorg.add( (tempAttr.get("o") + "").substring(3));

          }

          else {

            uorg.add(tempAttr.get("o") + "");

          }

          if ( (tempAttr.get("ou") + "").startsWith("ou: ")) {

            uou.add( (tempAttr.get("ou") + "").substring(4));

          }

          else {

            uou.add(tempAttr.get("ou") + "");

          }

          if ( (tempAttr.get("mail") + "").startsWith("mail: ")) {

            umail.add( (tempAttr.get("mail") + "").substring(6));

          }

          else {

            umail.add(tempAttr.get("mail") + "");

          }

          uvec.add(sr.getName() + "," + ldapBase);

        }

      }

      catch (SizeLimitExceededException slee) {

        logMetacat.error("LDAP Server size limit exceeded. " +

                          "Returning incomplete record set.");

      }

      // initialize users[]; fill users[]

      users = new String[uvec.size()][5];

      for (int i = 0; i < uvec.size(); i++) {

        users[i][0] = (String) uvec.elementAt(i);

        users[i][1] = (String) uname.elementAt(i);

        users[i][2] = (String) uorg.elementAt(i);

        users[i][3] = (String) uorg.elementAt(i);

        users[i][4] = (String) umail.elementAt(i);

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Problem getting users in AuthLdap.getUsers:" + e);

      //e.printStackTrace(System.err);

     /* throw new ConnectException(

          "Problem getting users in AuthLdap.getUsers:" + e);*/

    }

    return users;

  }

  /**

   * Get all users from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of all of the user names

   */

  public String[] getUserInfo(String user, String password) throws 

    ConnectException {

    String[] userinfo = new String[3];

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the attributes to match.

      // Users are objects that have the attribute objectclass=InetOrgPerson.

      SearchControls ctls = new SearchControls();

      String[] attrIDs = {

          "cn", "o", "mail"};

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      //ctls.setCountLimit(1000);

      // create the filter based on the uid

      String filter = null;

      if(user.indexOf("o=")>0){

    	  String tempStr = user.substring(user.indexOf("o="));

    	  filter = "(&(" + user.substring(0, user.indexOf(",")) 

			+ ")(" + tempStr.substring(0, tempStr.indexOf(",")) 

			+ "))";      

      } else{

    	  filter = "(&(" + user.substring(0, user.indexOf(",")) 

			+ "))";          		  

      }

   	  filter = "(&(" + user.substring(0, user.indexOf(",")) 

		+ "))";          		  

      NamingEnumeration namingEnum = ctx.search(user, filter, ctls);

      Attributes tempAttr = null;

      try {

        while (namingEnum.hasMore()) {

          SearchResult sr = (SearchResult) namingEnum.next();

          tempAttr = sr.getAttributes();

          if ( (tempAttr.get("cn") + "").startsWith("cn: ")) {

        	  userinfo[0] = (tempAttr.get("cn") + "").substring(4);

          }

          else {

        	  userinfo[0] = (tempAttr.get("cn") + "");

          }

          if ( (tempAttr.get("o") + "").startsWith("o: ")) {

        	  userinfo[1] = (tempAttr.get("o") + "").substring(3);

          }

          else {

        	  userinfo[1] = (tempAttr.get("o") + "");

          }

          if ( (tempAttr.get("mail") + "").startsWith("mail: ")) {

        	  userinfo[2] =  (tempAttr.get("mail") + "").substring(6);

          }

          else {

        	  userinfo[2] = (tempAttr.get("mail") + "");

          }

        }

      }

      catch (SizeLimitExceededException slee) {

        logMetacat.error("LDAP Server size limit exceeded. " +

                          "Returning incomplete record set.");

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Problem getting users in AuthLdap.getUsers:" + e);

      //e.printStackTrace(System.err);

      throw new ConnectException(

          "Problem getting users in AuthLdap.getUsers:" + e);

    }

    return userinfo;

  }

  /**

   * Get the users for a particular group from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param group the group whose user list should be returned

   * @returns string array of the user names belonging to the group

   */

  public String[] getUsers(String user, String password, String group) throws 

    ConnectException {

    String[] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the ids of the attributes to return

      String[] attrIDs = {

          "uniqueMember"};

      Attributes answer = ctx.getAttributes(group, attrIDs);

      Vector uvec = new Vector();

      try {

        for (NamingEnumeration ae = answer.getAll(); ae.hasMore(); ) {

          Attribute attr = (Attribute) ae.next();

          for (NamingEnumeration e = attr.getAll();

               e.hasMore();

               uvec.add(e.next())

               ) {

            ;

          }

        }

      }

      catch (SizeLimitExceededException slee) {

        logMetacat.error("LDAP Server size limit exceeded. " +

                          "Returning incomplete record set.");

      }

      // initialize users[]; fill users[]

      users = new String[uvec.size()];

      for (int i = 0; i < uvec.size(); i++) {

        users[i] = (String) uvec.elementAt(i);

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Problem getting users for a group in " +

                        "AuthLdap.getUsers:" + e);

      /*throw new ConnectException(

          "Problem getting users for a group in AuthLdap.getUsers:" + e);*/

    }

    return users;

  }

  /**

   * Get all groups from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of the group names

   */

  public String[][] getGroups(String user, String password) throws 

    ConnectException {

    return getGroups(user, password, null);

  }

  /**

   * Get the groups for a particular user from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param foruser the user whose group list should be returned

   * @returns string array of the group names

   */

  public String[][] getGroups(String user, String password, 

    String foruser) throws ConnectException {

    logMetacat.debug("getGroups() called.");

    // create vectors to store group and dscription values returned from the

    // ldap servers

    Vector gvec = new Vector();

    Vector desc = new Vector();

    Attributes tempAttr = null;

    Attributes rsrAttr = null;

    // DURING getGroups(), DO WE NOT BIND USING userName AND userPassword??

    // NEED TO FIX THIS ...

    userName = user;

    userPassword = password;

    // Identify service provider to use

    env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, "throw");

    env.put(Context.PROVIDER_URL, ldapUrl);

    env.put("com.sun.jndi.ldap.connect.timeout", ldapConnectTimeLimit);

    // Iterate through the referrals, handling NamingExceptions in the 

    // outer catch statement, ReferralExceptions in the inner catch statement

    try { // outer try

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the attributes to match.

      // Groups are objects with attribute objectclass=groupofuniquenames.

      // and have attribute uniquemember: uid=foruser,ldapbase.

      SearchControls ctls = new SearchControls();

      // Specify the ids of the attributes to return

      String[] attrIDs = {"cn", "o", "description"};

      ctls.setReturningAttributes(attrIDs);

      // set the ldap search scope

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      // set a 10 second time limit on searches to limit non-responding servers

      ctls.setTimeLimit(ldapSearchTimeLimit);

      // return at most 20000 entries

      ctls.setCountLimit(ldapSearchCountLimit);

      // build the ldap search filter that represents the "group" concept

      String filter = null;

      String gfilter = "(objectClass=groupOfUniqueNames)";

      if (null == foruser) {

        filter = gfilter;

      } else {

        filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

      }

      logMetacat.info("group filter is: " + filter);

      // now, search and iterate through the referrals

      for (boolean moreReferrals = true; moreReferrals;) {  

        try { // inner try

          NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);

          // Print the groups

          while (namingEnum.hasMore()) {

            SearchResult sr = (SearchResult) namingEnum.next();

            tempAttr = sr.getAttributes();

            if ( (tempAttr.get("description") + "").startsWith("description: ")) {

              desc.add( (tempAttr.get("description") + "").substring(13));

            }

            else {

              desc.add(tempAttr.get("description") + "");

            }

            // check for an absolute URL value or an answer value relative 

            // to the target context  

            if ( !sr.getName().startsWith("ldap") &&

                  sr.isRelative()) {

              logMetacat.debug("Search result entry is relative ...");

              gvec.add(sr.getName() + "," + ldapBase);

              logMetacat.info("group " + sr.getName() + "," +ldapBase + 

              " added to the group vector"); 

            } else {

              logMetacat.debug("Search result entry is absolute ...");

              // search the top level directory for referral objects and match

              // that of the search result's absolute URL.  This will let us

              // rebuild the group name from the search result, referral point

              // in the top directory tree, and ldapBase.

              // configure a new directory search first

              Hashtable envHash = new Hashtable(11);

              // Identify service provider to use

              envHash.put(Context.INITIAL_CONTEXT_FACTORY, 

                "com.sun.jndi.ldap.LdapCtxFactory");

              envHash.put(Context.REFERRAL, "ignore");

              envHash.put(Context.PROVIDER_URL, ldapUrl);

              envHash.put("com.sun.jndi.ldap.connect.timeout", 

                ldapConnectTimeLimit);

              try {

                // Create the initial directory context

                DirContext DirCtx = new InitialDirContext(envHash);

                SearchControls searchCtls = new SearchControls();

                // Specify the ids of the attributes to return

                String[] attrNames = {"o"};

                searchCtls.setReturningAttributes(attrNames);

                // set the ldap search scope - only look for top level referrals

                searchCtls.setSearchScope(SearchControls.ONELEVEL_SCOPE);

                // set a time limit on searches to limit non-responding servers

                searchCtls.setTimeLimit(ldapSearchTimeLimit);

                // return the configured number of entries

                searchCtls.setCountLimit(ldapSearchCountLimit);

                // Specify the attributes to match.

                // build the ldap search filter to match referral entries that 

                // match the search result

                String rFilter = "(&(objectClass=referral)(ref=" + 

                currentReferralInfo.substring(0, 

                currentReferralInfo.indexOf("?")) + "))";

                logMetacat.debug("rFilter is: " + rFilter);

                NamingEnumeration rNamingEnum = 

                  DirCtx.search(ldapBase, rFilter, searchCtls);

                while (rNamingEnum.hasMore()) {

                  SearchResult rsr = (SearchResult) rNamingEnum.next();

                  rsrAttr = rsr.getAttributes();

                  logMetacat.debug("referral search result is: " +

                    rsr.toString());

                  // add the returned groups to the group vector.  Test the 

                  // syntax of the returned attributes - sometimes they are 

                  // preceded with the attribute id and a colon

                  if ( (tempAttr.get("cn") + "").startsWith("cn: ")) {

                    gvec.add( "cn=" + (tempAttr.get("cn") + "").substring(4) + 

                    "," + "o=" + (rsrAttr.get("o") + "").substring(3 ) + "," + 

                    ldapBase);

                    logMetacat.info("group " + 

                    (tempAttr.get("cn") + "").substring(4) + "," + 

                    "o=" + (rsrAttr.get("o") + "").substring(3) + "," + 

                    ldapBase + " added to the group vector");

                  } else {

                    gvec.add( "cn=" + tempAttr.get("cn") + "," + 

                    "o=" + rsrAttr.get("o") +

                    "," + ldapBase);

                    logMetacat.info("group " + 

                    "cn=" + tempAttr.get("cn") + "," + 

                    "o=" + rsrAttr.get("o") + "," + 

                    ldapBase + " added to the group vector");

                  }  

                }

              } catch (NamingException nameEx){

                logMetacat.debug("Caught naming exception: ");

                nameEx.printStackTrace(System.err);

              }

            }

          }// end while

          moreReferrals = false;

        } catch (ReferralException re) {

          logMetacat.info(

            "In AuthLdap.getGroups(), caught referral exception: " +

            re.getReferralInfo()

          );

          this.currentReferralInfo = (String) re.getReferralInfo();

          // set moreReferrals to true and set the referral context

          moreReferrals = true;

          ctx = (DirContext) re.getReferralContext();

        }// end inner try

      }// end for

      // close the context now that all initial and referral 

      // searches are processed

      ctx.close();

    } catch (NamingException e) {

      // naming exceptions get logged, groups are returned

      logMetacat.info("In AuthLdap.getGroups(), caught naming exception: ");

      e.printStackTrace(System.err);

    } finally {

      // once all referrals are followed, report and return the groups found

      logMetacat.warn("The user is in the following groups: " +

                               gvec.toString());

      //build and return the groups array

      String groups[][] = new String[gvec.size()][2];

      for (int i = 0; i < gvec.size(); i++) {

        groups[i][0] = (String) gvec.elementAt(i);

        groups[i][1] = (String) desc.elementAt(i);

      }

      return groups;

    }// end outer try

  }

  /**

   * Get attributes describing a user or group

   *

   * @param foruser the user for which the attribute list is requested

   * @returns HashMap a map of attribute name to a Vector of values

   */

  public HashMap<String, Vector<String>> getAttributes(String foruser) throws ConnectException {

    return getAttributes(null, null, foruser);

  }

  /**

   * Get attributes describing a user or group

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param foruser the user whose attributes should be returned

   * @returns HashMap a map of attribute name to a Vector of values

   */

  public HashMap<String,Vector<String>> getAttributes(String user, String password, 

    String foruser) throws ConnectException {

    HashMap<String,Vector<String>> attributes = new HashMap<String,Vector<String>>();

    String ldapUrl = this.ldapUrl;

    String ldapBase = this.ldapBase;

    String userident = foruser;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Ask for all attributes of the user

      //Attributes attrs = ctx.getAttributes(userident);

      Attributes attrs = ctx.getAttributes(foruser);

      // Print all of the attributes

      NamingEnumeration en = attrs.getAll();

      while (en.hasMore()) {

        Attribute att = (Attribute) en.next();

        Vector<String> values = new Vector();

        String attName = att.getID();

        NamingEnumeration attvalues = att.getAll();

        while (attvalues.hasMore()) {

          String value = (String) attvalues.next();

          values.add(value);

        }

        attributes.put(attName, values);

      }

      // Close the context when we're done

      ctx.close();

    }

    catch (NamingException e) {

      logMetacat.error("Problem getting attributes in " +

                        "AuthLdap.getAttributes:" + e);

      throw new ConnectException(

          "Problem getting attributes in AuthLdap.getAttributes:" + e);

    }

    return attributes;

  }

  /**

   * Get list of all subtrees holding Metacat's groups and users

   * starting from the Metacat LDAP root,

   * i.e. ldap://dev.nceas.ucsb.edu/dc=ecoinformatics,dc=org

   */

  private Hashtable getSubtrees(String user, String password, 

    String ldapUrl, String ldapBase) throws ConnectException {

    Hashtable trees = new Hashtable();

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    // env.put(Context.REFERRAL, referral);

    // Using 'ignore' here instead of 'follow' as 'ignore' seems

    // to do the job better. 'follow' was not bringing up the UCNRS

    // and PISCO tree whereas 'ignore' brings up the tree.

    env.put(Context.REFERRAL, "ignore");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Specify the ids of the attributes to return

      String[] attrIDs = {

          "o", "ref"};

      SearchControls ctls = new SearchControls();

      ctls.setReturningAttributes(attrIDs);

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      // Specify the attributes to match.

      // Subtrees from the main server are found as objects with attribute

      // objectclass=organization or objectclass=referral to the subtree

      // resided on other server.

      String filter = "(|(objectclass=organization)(objectclass=referral))";

      // Search for objects in the current context

      NamingEnumeration namingEnum = ctx.search("", filter, ctls);

      // Print the subtrees' <ldapURL, baseDN>

      while (namingEnum.hasMore()) {

        SearchResult sr = (SearchResult) namingEnum.next();

        Attributes attrs = sr.getAttributes();

        NamingEnumeration enum1 = attrs.getAll(); // "dc" and "ref" attrs

        if (enum1.hasMore()) {

          Attribute attr = (Attribute) enum1.next();

          String attrValue = (String) attr.get();

          String attrName = (String) attr.getID();

          if (enum1.hasMore()) {

            attr = (Attribute) enum1.next();

            String refValue = (String) attr.get();

            String refName = (String) attr.getID();

            if (ldapBase.startsWith(refName + "=" + refValue)) {

              trees.put(ldapBase,

                        attrValue.substring(0, attrValue.lastIndexOf("/") + 1));

            }

            else {

              // this is a referral - so organization name is appended in

              // front of the ldapbase.... later it is stripped out

              // in getPrincipals

              trees.put("[" + refName + "=" + refValue + "]" +

                        attrValue.substring(attrValue.lastIndexOf("/") + 1,

                                            attrValue.length()),

                        attrValue.substring(0, attrValue.lastIndexOf("/") + 1));

              // trees.put(refName + "=" + refValue + "," + ldapBase,

              //           attrValue.substring(0, attrValue.lastIndexOf("/") + 1));

            }

          }

          else if (ldapBase.startsWith(attrName + "=" + attrValue)) {

            trees.put(ldapBase, ldapUrl);

          }

          else {

            if (sr.isRelative()) {

              trees.put(attrName + "=" + attrValue + "," + ldapBase, ldapUrl);

            }

            else {

              String referenceURL = sr.getName();

              referenceURL = referenceURL.substring(0,

                  referenceURL.lastIndexOf("/") + 1);

              trees.put(attrName + "=" + attrValue + "," + ldapBase,

                        referenceURL);

            }

          }

        }

      }