/src/edu/ucsb/nceas/metacat/AuthLdap.java - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 504

Added by Matt Jones over 23 years ago

Fixed the LDAP authentication adapter (AuthLdap.java) so that it now looks up
the distinguished name for a user before attempting to do authentication.
This is because the user's distinguished name can sometimes be based on
their uid attribute, but sometimes be based on their cn (common name)
attribute, or some other attribute. In order to authenticate, we must
be able construct the distinguished name, so we have to look up the
identifying attribute before trying to authenticate. Basically, this
lets us authenticate agains both of the following records:

dn: uid=jones,o=NCEAS,c=US

and

dn: cn=Matt Jones,o=NCEAS,c=US

Effectively, this means that the user can type in their user id (uid),
common name (cn), or surname (sn) and we'll still be able to authenticate them.
BugID: 138

     import javax.naming.AuthenticationException;
     import javax.naming.Context;
     import javax.naming.directory.InitialDirContext;
     import javax.naming.directory.DirContext;
     import javax.naming.directory.Attribute;
     import javax.naming.directory.Attributes;
     import javax.naming.directory.BasicAttribute;
     import javax.naming.directory.BasicAttributes;
     import javax.naming.directory.DirContext;
     import javax.naming.directory.InitialDirContext;
     import javax.naming.directory.SearchResult;
     import javax.naming.NamingEnumeration;
     import javax.naming.NamingException;
     import java.util.Iterator;
-...
         String ldapUrl = util.getOption("ldapurl");
         String ldapBase = util.getOption("ldapbase");
         String distName = null;
         boolean authenticated = false;
         // Identify service provider to use
-...
                 "com.sun.jndi.ldap.LdapCtxFactory");
         env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);
         // Authentication information
         env.put(Context.SECURITY_AUTHENTICATION, "simple");
         env.put(Context.SECURITY_PRINCIPAL, user + "," + ldapBase);
         env.put(Context.SECURITY_CREDENTIALS, password);
         try {
           // Bind to the LDAP server
           // If our auth credentials are invalid, an exception will be thrown
           DirContext ctx = new InitialDirContext(env);
           authenticated = true;
           // Get the dn for this uid or cn
           String identifier = getIdentifyingName(user);
           if (identifier != null) {
             distName = identifier + "," + ldapBase;
             // Now that we have the dn, we can authenticate, so
             // authenticate this time when opening the DirContext
             env.put(Context.SECURITY_AUTHENTICATION, "simple");
             env.put(Context.SECURITY_PRINCIPAL, distName);
             env.put(Context.SECURITY_CREDENTIALS, password);
             // If our auth credentials are invalid, an exception will be thrown
             DirContext ctx = new InitialDirContext(env);
           // Close the context when we're done
           ctx.close();
             // If no exception is thrown then authentication succeeded
             authenticated = true;
             // Close the context when we're done
             ctx.close();
           } else {
             util.debugMessage("User not found!");
+          }
         } catch (AuthenticationException ae) {
           util.debugMessage("Error authenticating: " + ae);
           // NEED TO THROW THE RIGHT EXCEPTION HERE
-...
         // Authentication information
         if ((authuser != null) && (password != null)) {
           String identifier = getIdentifyingName(authuser);
           env.put(Context.SECURITY_AUTHENTICATION, "simple");
           env.put(Context.SECURITY_PRINCIPAL, authuser + "," + ldapBase);
           env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);
           env.put(Context.SECURITY_CREDENTIALS, password);
+        }
         try {
           // Find out the identifying attribute for the user
           String userident = getIdentifyingName(user);
           // Create the initial directory context
           DirContext ctx = new InitialDirContext(env);
           // Ask for all attributes of the object
           Attributes attrs = ctx.getAttributes(user);
           // Ask for all attributes of the user
           Attributes attrs = ctx.getAttributes(userident);
           // Print all of the attributes
           NamingEnumeration en = attrs.getAll();
-...
+      }
       /**
        * Get the identifying name for a given userid or name.  This is the name
        * that is used in conjunction withthe LDAP BaseDN to create a
        * distinguished name (dn) for the record
+       *
        * @param user the user for which the identifying name is requested
        * @returns String the identifying name for the user,
        *          or null if not found
        */
       private String getIdentifyingName(String user)
              throws ConnectException
+      {
         MetaCatUtil util = new MetaCatUtil();
         String ldapUrl = util.getOption("ldapurl");
         String ldapBase = util.getOption("ldapbase");
         String identifier = null;
         // Identify service provider to use
         Hashtable env = new Hashtable(11);
         env.put(Context.INITIAL_CONTEXT_FACTORY,
                 "com.sun.jndi.ldap.LdapCtxFactory");
         env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);
         try {
           // Bind to the LDAP server, in order to search for the right
           // distinguished name (dn) based on userid (uid) or common name (cn)
           DirContext ctx = new InitialDirContext(env);
           // Search for the user id or name using the uid, then cn and sn attributes
           // If we find a record, determine the dn for the record
           util.debugMessage("\nStarting search phase...\n");
           Attributes matchAttrs = new BasicAttributes(true);
           matchAttrs.put(new BasicAttribute("uid", user));
           NamingEnumeration answer = ctx.search("", matchAttrs);
           if (answer.hasMore()) {
             SearchResult sr = (SearchResult)answer.next();
             identifier = sr.getName();
             util.debugMessage("Found: " + identifier);
           } else {
             Attributes matchAttrs2 = new BasicAttributes(true);
             matchAttrs2.put(new BasicAttribute("cn", user));
             NamingEnumeration answer2 = ctx.search("", matchAttrs2);
             if (answer2.hasMore()) {
               SearchResult sr = (SearchResult)answer2.next();
               identifier = sr.getName();
               util.debugMessage("Found: " + identifier);
             } else {
               Attributes matchAttrs3 = new BasicAttributes(true);
               matchAttrs3.put(new BasicAttribute("sn", user));
               NamingEnumeration answer3 = ctx.search("", matchAttrs3);
               if (answer3.hasMore()) {
                 SearchResult sr = (SearchResult)answer3.next();
                 identifier = sr.getName();
                 util.debugMessage("Found: " + identifier);
+              }
+            }
+          }
           // Close the context when we're done the initial search
           ctx.close();
         } catch (NamingException e) {
           util.debugMessage("Naming exception while getting dn: " + e);
           // NEED TO THROW THE RIGHT EXCEPTION HERE
           return null;
+        }
         return identifier;
+      }
       /**
        * Test method for the class
        */
       public static void main(String[] args) {
         // Provide a user, such as: "cn=Matt Jones"
         // Provide a user, such as: "Matt Jones", or "jones"
         String user = args[0];
         String password = args[1];
-...
+          }
           if (isValid) {
             HashMap userInfo = authservice.getAttributes(user);
             HashMap userInfo = authservice.getAttributes(user, user, password);
             // Print all of the attributes
             Iterator attList = (Iterator)(((Set)userInfo.keySet()).iterator());
             while (attList.hasNext()) {
               String att = (String)attList.next();
               Vector values = (Vector)userInfo.get(att);
               System.out.println(att + ": " );
               Iterator attvalues = values.iterator();
               while (attvalues.hasNext()) {
                 String value = (String)attvalues.next();
                 System.out.println("  value: " + value);
                 System.out.println(att + ": " + value);
+              }
+            }
+          }

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 504

Added by Matt Jones over 23 years ago