Metacat

/**

 *  '$RCSfile$'

 *    Purpose: An implementation of the AuthInterface interface that

 *             allows Metacat to use the LDAP protocol for

 *             directory services

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *

 *   '$Author: daigle $'

 *     '$Date: 2009-08-24 14:34:17 -0700 (Mon, 24 Aug 2009) $'

 * '$Revision: 5030 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.naming.AuthenticationException;

import javax.naming.Context;

import javax.naming.NamingEnumeration;

import javax.naming.NamingException;

import javax.naming.SizeLimitExceededException;

import javax.naming.directory.Attribute;

import javax.naming.directory.Attributes;

import javax.naming.directory.DirContext;

import javax.naming.directory.InitialDirContext;

import javax.naming.directory.SearchResult;

import javax.naming.directory.SearchControls;

import javax.naming.ReferralException;

import javax.naming.ldap.InitialLdapContext;

import javax.naming.ldap.LdapContext;

import javax.naming.ldap.StartTlsRequest;

import javax.naming.ldap.StartTlsResponse;

import javax.net.ssl.SSLSession;

import org.apache.log4j.Logger;

import edu.ucsb.nceas.metacat.properties.PropertyService;

import edu.ucsb.nceas.utilities.PropertyNotFoundException;

import java.lang.InstantiationException;

import java.net.URLDecoder;

import java.util.Iterator;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Enumeration;

import java.util.Set;

import java.util.Vector;

/**

 * An implementation of the AuthInterface interface that allows Metacat to use

 * the LDAP protocol for directory services. The LDAP authentication service is

 * used to determine if a user is authenticated, and whether they are a member

 * of a particular group.

 */

public class AuthLdap implements AuthInterface {

	private String ldapUrl;

	private String ldapsUrl;

	private String ldapBase;

	private String referral;

	private String ldapConnectTimeLimit;

	private int ldapSearchTimeLimit;

	private int ldapSearchCountLimit;

	private String currentReferralInfo;

	Hashtable env = new Hashtable(11);

	private Context rContext;

	private String userName;

	private String userPassword;

	ReferralException refExc;

	private static Logger logMetacat = Logger.getLogger(AuthLdap.class);

	/**

	 * Construct an AuthLdap

	 */

	public AuthLdap() throws InstantiationException {

		// Read LDAP URI for directory service information

		try {

			this.ldapUrl = PropertyService.getProperty("auth.url");

			this.ldapsUrl = PropertyService.getProperty("auth.surl");

			this.ldapBase = PropertyService.getProperty("auth.base");

			this.referral = PropertyService.getProperty("ldap.referral");

			this.ldapConnectTimeLimit = PropertyService

					.getProperty("ldap.connectTimeLimit");

			this.ldapSearchTimeLimit = Integer.parseInt(PropertyService

					.getProperty("ldap.searchTimeLimit"));

			this.ldapSearchCountLimit = Integer.parseInt(PropertyService

					.getProperty("ldap.searchCountLimit"));

		} catch (PropertyNotFoundException pnfe) {

			throw new InstantiationException(

					"Could not instantiate AuthLdap.  Property not found: "

							+ pnfe.getMessage());

		} catch (NumberFormatException nfe) {

			throw new InstantiationException(

					"Could not instantiate AuthLdap.  Bad number format when converting properties: "

							+ nfe.getMessage());

		}

		// Store referral info for use in building group DNs in getGroups()

		this.currentReferralInfo = "";

	}

	/**

	 * Determine if a user/password are valid according to the authentication

	 * service.

	 * 

	 * @param user

	 *            the name of the principal to authenticate

	 * @param password

	 *            the password to use for authentication

	 * @returns boolean true if authentication successful, false otherwise

	 */

	public boolean authenticate(String user, String password) throws ConnectException {

		String ldapUrl = this.ldapUrl;

		String ldapsUrl = this.ldapsUrl;

		String ldapBase = this.ldapBase;

		boolean authenticated = false;

		String identifier = user;

		// get uid here.

		if (user.indexOf(",") == -1) {

			throw new ConnectException("Invalid LDAP user credential: " + user

					+ ".  Missing ','");

		}

		String uid = user.substring(0, user.indexOf(","));

		user = user.substring(user.indexOf(","), user.length());

		logMetacat.debug("identifier: " + identifier);

		logMetacat.debug("uid: " + uid);

		logMetacat.debug("user: " + user);

		try {

			// Check the usename as passed in

			logMetacat.info("Calling ldapAuthenticate");

			logMetacat.info("with user as identifier: " + identifier);

			authenticated = ldapAuthenticate(identifier, password, (new Boolean(

					PropertyService.getProperty("ldap.onlySecureConnection")))

					.booleanValue());

			// if not found, try looking up a valid DN then auth again

			if (!authenticated) {

				logMetacat.info("Not Authenticated");

				logMetacat.info("Looking up DN for: " + identifier);

				identifier = getIdentifyingName(identifier, ldapUrl, ldapBase);

				if (identifier == null) {

					logMetacat.info("No DN found from getIdentifyingName");

					return authenticated;

				}

				logMetacat.info("DN found from getIdentifyingName: " + identifier);

				String decoded = URLDecoder.decode(identifier);

				logMetacat.info("DN decoded: " + decoded);

				identifier = decoded;

				String refUrl = "";

				String refBase = "";

				if (identifier.startsWith("ldap")) {

					logMetacat.debug("identifier starts with \"ldap\"");

					refUrl = identifier.substring(0, identifier.lastIndexOf("/") + 1);

					int position = identifier.indexOf(",");

					int position2 = identifier.indexOf(",", position + 1);

					refBase = identifier.substring(position2 + 1);

					identifier = identifier.substring(identifier.lastIndexOf("/") + 1);

					logMetacat.info("Calling ldapAuthenticate:");

					logMetacat.info("with user as identifier: " + identifier);

					logMetacat.info("and refUrl as: " + refUrl);

					logMetacat.info("and refBase as: " + refBase);

					authenticated = ldapAuthenticate(identifier, password, refUrl,

							refBase, (new Boolean(PropertyService

									.getProperty("ldap.onlySecureReferalsConnection")))

									.booleanValue());

				} else {

					logMetacat.info("identifier doesnt start with ldap");

					identifier = identifier + "," + ldapBase;

					logMetacat.info("Calling ldapAuthenticate");

					logMetacat.info("with user as identifier: " + identifier);

					authenticated = ldapAuthenticate(identifier, password, (new Boolean(

							PropertyService.getProperty("ldap.onlySecureConnection")))

							.booleanValue());

				}

			}

		} catch (NullPointerException e) {

			logMetacat.error("NullPointerException while authenticating in "

					+ "AuthLdap.authenticate: " + e);

			e.printStackTrace();

			throw new ConnectException("NullPointerException while authenticating in "

					+ "AuthLdap.authenticate: " + e);

		} catch (NamingException e) {

			logMetacat.error("Naming exception while authenticating in "

					+ "AuthLdap.authenticate: " + e);

			e.printStackTrace();

		} catch (Exception e) {

			logMetacat.error(e.getMessage());

		}

		return authenticated;

	}

	/**

	 * Connect to the LDAP directory and do the authentication using the

	 * username and password as passed into the routine.

	 * 

	 * @param identifier

	 *            the distinguished name to check against LDAP

	 * @param password

	 *            the password for authentication

	 */

	private boolean ldapAuthenticate(String identifier, String password,

			boolean secureConnectionOnly) throws ConnectException, NamingException,

			NullPointerException {

		return ldapAuthenticate(identifier, password, this.ldapsUrl, this.ldapBase,

				secureConnectionOnly);

	}

	/**

	 * Connect to the LDAP directory and do the authentication using the

	 * username and password as passed into the routine.

	 * 

	 * @param identifier

	 *            the distinguished name to check against LDAP

	 * @param password

	 *            the password for authentication

	 */

	private boolean ldapAuthenticate(String dn, String password, String rootServer,

			String rootBase, boolean secureConnectionOnly) {

		boolean authenticated = false;

		String server = "";

		String userDN = "";

		logMetacat.info("dn is: " + dn);

		int position = dn.lastIndexOf("/");

		logMetacat.debug("position is: " + position);

		if (position == -1) {

			server = rootServer;

			if (dn.indexOf(userDN) < 0) {

				userDN = dn + "," + rootBase;

			} else {

				userDN = dn;

			}

			logMetacat.info("userDN is: " + userDN);

		} else {

			server = dn.substring(0, position + 1);

			userDN = dn.substring(position + 1);

			logMetacat.info("server is: " + server);

			logMetacat.info("userDN is: " + userDN);

		}

		logMetacat.warn("Trying to authenticate: " + userDN);

		logMetacat.warn("          Using server: " + server);

		LdapContext ctx = null;

		double startTime;

		double stopTime;

		try {

			Hashtable env = new Hashtable();

			env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

			env.put(Context.PROVIDER_URL, server);

			env.put(Context.REFERRAL, "throw");

			try {

				startTime = System.currentTimeMillis();

				ctx = new InitialLdapContext(env, null);

				// Start up TLS here so that we don't pass our jewels in

				// cleartext

				StartTlsResponse tls = (StartTlsResponse) ctx

						.extendedOperation(new StartTlsRequest());

				// tls.setHostnameVerifier(new SampleVerifier());

				SSLSession sess = tls.negotiate();

				ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");

				ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDN);

				ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);

				ctx.reconnect(null);

				stopTime = System.currentTimeMillis();

				logMetacat.info("Connection time thru " + ldapsUrl + " was: "

						+ (stopTime - startTime) / 1000 + " seconds.");

				authenticated = true;

			} catch (Exception ioe) {

				logMetacat.info("Caught IOException in login while negotiating TLS: "

						+ ioe.getMessage());

				if (secureConnectionOnly) {

					return authenticated;

				} else {

					logMetacat.info("Trying to authenticate without TLS");

					env.put(Context.SECURITY_AUTHENTICATION, "simple");

					env.put(Context.SECURITY_PRINCIPAL, userDN);

					env.put(Context.SECURITY_CREDENTIALS, password);

					startTime = System.currentTimeMillis();

					ctx = new InitialLdapContext(env, null);

					stopTime = System.currentTimeMillis();

					logMetacat.info("Connection time thru " + ldapsUrl + " was: "

							+ (stopTime - startTime) / 1000 + " seconds.");

					authenticated = true;

				}

			}

		} catch (AuthenticationException ae) {

			authenticated = false;

		} catch (javax.naming.InvalidNameException ine) {

			logMetacat.error("An invalid DN was provided!");

		} catch (NamingException e) {

			logMetacat.warn("Caught NamingException in login: " + e.getClass().getName());

			logMetacat.info(e.toString() + "  " + e.getRootCause());

		}

		return authenticated;

	}

	/**

	 * Get the identifying name for a given userid or name. This is the name

	 * that is used in conjunction withthe LDAP BaseDN to create a distinguished

	 * name (dn) for the record

	 * 

	 * @param user

	 *            the user for which the identifying name is requested

	 * @returns String the identifying name for the user, or null if not found

	 */

	private String getIdentifyingName(String user, String ldapUrl, String ldapBase)

			throws NamingException {

		String identifier = null;

		Hashtable env = new Hashtable();

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, "throw");

		env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

		try {

			int position = user.indexOf(",");

			String uid = user.substring(user.indexOf("=") + 1, position);

			logMetacat.info("uid is: " + uid);

			String org = user.substring(user.indexOf("=", position + 1) + 1, user

					.indexOf(",", position + 1));

			logMetacat.info("org is: " + org);

			DirContext sctx = new InitialDirContext(env);

			SearchControls ctls = new SearchControls();

			ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

			String filter = "(&(uid=" + uid + ")(o=" + org + "))";

			logMetacat.warn("Searching for DNs with following filter: " + filter);

			for (boolean moreReferrals = true; moreReferrals;) {

				try {

					// Perform the search

					NamingEnumeration answer = sctx.search("", filter, ctls);

					// Return the answer

					while (answer.hasMore()) {

						SearchResult sr = (SearchResult) answer.next();

						identifier = sr.getName();

						return identifier;

					}

					// The search completes with no more referrals

					moreReferrals = false;

				} catch (ReferralException e) {

					logMetacat.info("Got referral: " + e.getReferralInfo());

					// Point to the new context from the referral

					if (moreReferrals) {

						sctx = (DirContext) e.getReferralContext();

					}

				}

			}

		} catch (NamingException e) {

			logMetacat.error("Naming exception while getting dn: " + e);

			throw new NamingException("Naming exception in AuthLdap.getIdentifyingName: "

					+ e);

		}

		return identifier;

	}

	/**

	 * Get all users from the authentication service

	 * 

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @returns string array of all of the user names

	 */

	public String[][] getUsers(String user, String password) throws ConnectException {

		String[][] users = null;

		// Identify service provider to use

		Hashtable env = new Hashtable(11);

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, referral);

		env.put(Context.PROVIDER_URL, ldapUrl);

		env.put("com.sun.jndi.ldap.connect.timeout", ldapConnectTimeLimit);

		try {

			// Create the initial directory context

			DirContext ctx = new InitialDirContext(env);

			// Specify the attributes to match.

			// Users are objects that have the attribute

			// objectclass=InetOrgPerson.

			SearchControls ctls = new SearchControls();

			String[] attrIDs = { "dn", "cn", "o", "ou", "mail" };

			ctls.setReturningAttributes(attrIDs);

			ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

			ctls.setTimeLimit(ldapSearchTimeLimit);

			// ctls.setCountLimit(1000);

			String filter = "(objectClass=inetOrgPerson)";

			NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);

			// Store the users in a vector

			Vector uvec = new Vector();

			Vector uname = new Vector();

			Vector uorg = new Vector();

			Vector uou = new Vector();

			Vector umail = new Vector();

			Attributes tempAttr = null;

			try {

				while (namingEnum.hasMore()) {

					SearchResult sr = (SearchResult) namingEnum.next();

					tempAttr = sr.getAttributes();

					if ((tempAttr.get("cn") + "").startsWith("cn: ")) {

						uname.add((tempAttr.get("cn") + "").substring(4));

					} else {

						uname.add(tempAttr.get("cn") + "");

					}

					if ((tempAttr.get("o") + "").startsWith("o: ")) {

						uorg.add((tempAttr.get("o") + "").substring(3));

					} else {

						uorg.add(tempAttr.get("o") + "");

					}

					if ((tempAttr.get("ou") + "").startsWith("ou: ")) {

						uou.add((tempAttr.get("ou") + "").substring(4));

					} else {

						uou.add(tempAttr.get("ou") + "");

					}

					if ((tempAttr.get("mail") + "").startsWith("mail: ")) {

						umail.add((tempAttr.get("mail") + "").substring(6));

					} else {

						umail.add(tempAttr.get("mail") + "");

					}

					uvec.add(sr.getName() + "," + ldapBase);

				}

			} catch (SizeLimitExceededException slee) {

				logMetacat.error("LDAP Server size limit exceeded. "

						+ "Returning incomplete record set.");

			}

			// initialize users[]; fill users[]

			users = new String[uvec.size()][5];

			for (int i = 0; i < uvec.size(); i++) {

				users[i][0] = (String) uvec.elementAt(i);

				users[i][1] = (String) uname.elementAt(i);

				users[i][2] = (String) uorg.elementAt(i);

				users[i][3] = (String) uorg.elementAt(i);

				users[i][4] = (String) umail.elementAt(i);

			}

			// Close the context when we're done

			ctx.close();

		} catch (NamingException e) {

			logMetacat.error("Problem getting users in AuthLdap.getUsers:" + e);

			// e.printStackTrace(System.err);

			/*

			 * throw new ConnectException( "Problem getting users in

			 * AuthLdap.getUsers:" + e);

			 */

		}

		return users;

	}

	/**

	 * Get all users from the authentication service

	 * 

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @returns string array of all of the user names

	 */

	public String[] getUserInfo(String user, String password) throws ConnectException {

		String[] userinfo = new String[3];

		// Identify service provider to use

		Hashtable env = new Hashtable(11);

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, referral);

		env.put(Context.PROVIDER_URL, ldapUrl);

		try {

			// Create the initial directory context

			DirContext ctx = new InitialDirContext(env);

			// Specify the attributes to match.

			// Users are objects that have the attribute

			// objectclass=InetOrgPerson.

			SearchControls ctls = new SearchControls();

			String[] attrIDs = { "cn", "o", "mail" };

			ctls.setReturningAttributes(attrIDs);

			ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

			// ctls.setCountLimit(1000);

			// create the filter based on the uid

			String filter = null;

			if (user.indexOf("o=") > 0) {

				String tempStr = user.substring(user.indexOf("o="));

				filter = "(&(" + user.substring(0, user.indexOf(",")) + ")("

						+ tempStr.substring(0, tempStr.indexOf(",")) + "))";

			} else {

				filter = "(&(" + user.substring(0, user.indexOf(",")) + "))";

			}

			filter = "(&(" + user.substring(0, user.indexOf(",")) + "))";

			NamingEnumeration namingEnum = ctx.search(user, filter, ctls);

			Attributes tempAttr = null;

			try {

				while (namingEnum.hasMore()) {

					SearchResult sr = (SearchResult) namingEnum.next();

					tempAttr = sr.getAttributes();

					if ((tempAttr.get("cn") + "").startsWith("cn: ")) {

						userinfo[0] = (tempAttr.get("cn") + "").substring(4);

					} else {

						userinfo[0] = (tempAttr.get("cn") + "");

					}

					if ((tempAttr.get("o") + "").startsWith("o: ")) {

						userinfo[1] = (tempAttr.get("o") + "").substring(3);

					} else {

						userinfo[1] = (tempAttr.get("o") + "");

					}

					if ((tempAttr.get("mail") + "").startsWith("mail: ")) {

						userinfo[2] = (tempAttr.get("mail") + "").substring(6);

					} else {

						userinfo[2] = (tempAttr.get("mail") + "");

					}

				}

			} catch (SizeLimitExceededException slee) {

				logMetacat.error("LDAP Server size limit exceeded. "

						+ "Returning incomplete record set.");

			}

			// Close the context when we're done

			ctx.close();

		} catch (NamingException e) {

			logMetacat.error("Problem getting users in AuthLdap.getUsers:" + e);

			// e.printStackTrace(System.err);

			throw new ConnectException("Problem getting users in AuthLdap.getUsers:" + e);

		}

		return userinfo;

	}

	/**

	 * Get the users for a particular group from the authentication service

	 * 

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @param group

	 *            the group whose user list should be returned

	 * @returns string array of the user names belonging to the group

	 */

	public String[] getUsers(String user, String password, String group)

			throws ConnectException {

		String[] users = null;

		// Identify service provider to use

		Hashtable env = new Hashtable(11);

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, referral);

		env.put(Context.PROVIDER_URL, ldapUrl);

		try {

			// Create the initial directory context

			DirContext ctx = new InitialDirContext(env);

			// Specify the ids of the attributes to return

			String[] attrIDs = { "uniqueMember" };

			Attributes answer = ctx.getAttributes(group, attrIDs);

			Vector uvec = new Vector();

			try {

				for (NamingEnumeration ae = answer.getAll(); ae.hasMore();) {

					Attribute attr = (Attribute) ae.next();

					for (NamingEnumeration e = attr.getAll(); e.hasMore(); uvec.add(e

							.next())) {

						;

					}

				}

			} catch (SizeLimitExceededException slee) {

				logMetacat.error("LDAP Server size limit exceeded. "

						+ "Returning incomplete record set.");

			}

			// initialize users[]; fill users[]

			users = new String[uvec.size()];

			for (int i = 0; i < uvec.size(); i++) {

				users[i] = (String) uvec.elementAt(i);

			}

			// Close the context when we're done

			ctx.close();

		} catch (NamingException e) {

			logMetacat.error("Problem getting users for a group in "

					+ "AuthLdap.getUsers:" + e);

			/*

			 * throw new ConnectException( "Problem getting users for a group in

			 * AuthLdap.getUsers:" + e);

			 */

		}

		return users;

	}

	/**

	 * Get all groups from the authentication service

	 * 

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @returns string array of the group names

	 */

	public String[][] getGroups(String user, String password) throws ConnectException {

		return getGroups(user, password, null);

	}

	/**

	 * Get the groups for a particular user from the authentication service

	 * 

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @param foruser

	 *            the user whose group list should be returned

	 * @returns string array of the group names

	 */

	public String[][] getGroups(String user, String password, String foruser)

			throws ConnectException {

		logMetacat.debug("getGroups() called.");

		// create vectors to store group and dscription values returned from the

		// ldap servers

		Vector gvec = new Vector();

		Vector desc = new Vector();

		Attributes tempAttr = null;

		Attributes rsrAttr = null;

		// DURING getGroups(), DO WE NOT BIND USING userName AND userPassword??

		// NEED TO FIX THIS ...

		userName = user;

		userPassword = password;

		// Identify service provider to use

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, "throw");

		env.put(Context.PROVIDER_URL, ldapUrl);

		env.put("com.sun.jndi.ldap.connect.timeout", ldapConnectTimeLimit);

		// Iterate through the referrals, handling NamingExceptions in the

		// outer catch statement, ReferralExceptions in the inner catch

		// statement

		try { // outer try

			// Create the initial directory context

			DirContext ctx = new InitialDirContext(env);

			// Specify the attributes to match.

			// Groups are objects with attribute objectclass=groupofuniquenames.

			// and have attribute uniquemember: uid=foruser,ldapbase.

			SearchControls ctls = new SearchControls();

			// Specify the ids of the attributes to return

			String[] attrIDs = { "cn", "o", "description" };

			ctls.setReturningAttributes(attrIDs);

			// set the ldap search scope

			ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

			// set a 10 second time limit on searches to limit non-responding

			// servers

			ctls.setTimeLimit(ldapSearchTimeLimit);

			// return at most 20000 entries

			ctls.setCountLimit(ldapSearchCountLimit);

			// build the ldap search filter that represents the "group" concept

			String filter = null;

			String gfilter = "(objectClass=groupOfUniqueNames)";

			if (null == foruser) {

				filter = gfilter;

			} else {

				filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

			}

			logMetacat.info("group filter is: " + filter);

			// now, search and iterate through the referrals

			for (boolean moreReferrals = true; moreReferrals;) {

				try { // inner try

					NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);

					// Print the groups

					while (namingEnum.hasMore()) {

						SearchResult sr = (SearchResult) namingEnum.next();

						tempAttr = sr.getAttributes();

						if ((tempAttr.get("description") + "")

								.startsWith("description: ")) {

							desc.add((tempAttr.get("description") + "").substring(13));

						} else {

							desc.add(tempAttr.get("description") + "");

						}

						// check for an absolute URL value or an answer value

						// relative

						// to the target context

						if (!sr.getName().startsWith("ldap") && sr.isRelative()) {

							logMetacat.debug("Search result entry is relative ...");

							gvec.add(sr.getName() + "," + ldapBase);

							logMetacat.info("group " + sr.getName() + "," + ldapBase

									+ " added to the group vector");

						} else {

							logMetacat.debug("Search result entry is absolute ...");

							// search the top level directory for referral

							// objects and match

							// that of the search result's absolute URL. This

							// will let us

							// rebuild the group name from the search result,

							// referral point

							// in the top directory tree, and ldapBase.

							// configure a new directory search first

							Hashtable envHash = new Hashtable(11);

							// Identify service provider to use

							envHash.put(Context.INITIAL_CONTEXT_FACTORY,

									"com.sun.jndi.ldap.LdapCtxFactory");

							envHash.put(Context.REFERRAL, "ignore");

							envHash.put(Context.PROVIDER_URL, ldapUrl);

							envHash.put("com.sun.jndi.ldap.connect.timeout",

									ldapConnectTimeLimit);

							try {

								// Create the initial directory context

								DirContext DirCtx = new InitialDirContext(envHash);

								SearchControls searchCtls = new SearchControls();

								// Specify the ids of the attributes to return

								String[] attrNames = { "o" };

								searchCtls.setReturningAttributes(attrNames);

								// set the ldap search scope - only look for top

								// level referrals

								searchCtls.setSearchScope(SearchControls.ONELEVEL_SCOPE);

								// set a time limit on searches to limit

								// non-responding servers

								searchCtls.setTimeLimit(ldapSearchTimeLimit);

								// return the configured number of entries

								searchCtls.setCountLimit(ldapSearchCountLimit);

								// Specify the attributes to match.

								// build the ldap search filter to match

								// referral entries that

								// match the search result

								String rFilter = "(&(objectClass=referral)(ref="

										+ currentReferralInfo.substring(0,

												currentReferralInfo.indexOf("?")) + "))";

								logMetacat.debug("rFilter is: " + rFilter);

								NamingEnumeration rNamingEnum = DirCtx.search(ldapBase,

										rFilter, searchCtls);

								while (rNamingEnum.hasMore()) {

									SearchResult rsr = (SearchResult) rNamingEnum.next();

									rsrAttr = rsr.getAttributes();

									logMetacat.debug("referral search result is: "

											+ rsr.toString());

									// add the returned groups to the group

									// vector. Test the

									// syntax of the returned attributes -

									// sometimes they are

									// preceded with the attribute id and a

									// colon

									if ((tempAttr.get("cn") + "").startsWith("cn: ")) {

										gvec.add("cn="

												+ (tempAttr.get("cn") + "").substring(4)

												+ "," + "o="

												+ (rsrAttr.get("o") + "").substring(3)

												+ "," + ldapBase);

										logMetacat.info("group "

												+ (tempAttr.get("cn") + "").substring(4)

												+ "," + "o="

												+ (rsrAttr.get("o") + "").substring(3)

												+ "," + ldapBase

												+ " added to the group vector");