Metacat

/**

 *  '$RCSfile$'

 *    Purpose: An implementation of the AuthInterface interface that

 *             allows Metacat to use the LDAP protocol for

 *             directory services

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.naming.AuthenticationException;

import javax.naming.Context;

import javax.naming.NamingException;

import javax.naming.directory.Attributes;

import javax.naming.directory.InitialDirContext;

import javax.naming.directory.SearchResult;

import javax.naming.ldap.LdapContext;

import javax.naming.ldap.StartTlsRequest;

import javax.naming.ldap.StartTlsResponse;

import javax.net.ssl.SSLSession;

import org.apache.log4j.Logger;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Vector;

/**

 * the LDAP protocol for directory services. The LDAP authentication service is

 * used to determine if a user is authenticated, and whether they are a member

 * of a particular group.

	private String ldapsUrl;

	private String ldapBase;

	private String referral;

	private String ldapConnectTimeLimit;

	private int ldapSearchTimeLimit;

	private int ldapSearchCountLimit;

	private String currentReferralInfo;

	private String userName;

	private String userPassword;

	ReferralException refExc;

	/**

	 */

	public AuthLdap() throws InstantiationException {

		// Read LDAP URI for directory service information

		try {

			this.ldapsUrl = PropertyService.getProperty("auth.surl");

			this.ldapConnectTimeLimit = PropertyService

					.getProperty("ldap.connectTimeLimit");

			this.ldapSearchTimeLimit = Integer.parseInt(PropertyService

					.getProperty("ldap.searchTimeLimit"));

			this.ldapSearchCountLimit = Integer.parseInt(PropertyService

					.getProperty("ldap.searchCountLimit"));

		} catch (PropertyNotFoundException pnfe) {

			throw new InstantiationException(

					"Could not instantiate AuthLdap.  Property not found: "

							+ pnfe.getMessage());

		} catch (NumberFormatException nfe) {

			throw new InstantiationException(

					"Could not instantiate AuthLdap.  Bad number format when converting properties: "

							+ nfe.getMessage());

		}

		this.currentReferralInfo = "";

	}

	 * service.

	 *

	 * @param user

	 *            the name of the principal to authenticate

	 * @param password

	 *            the password to use for authentication

	 * @returns boolean true if authentication successful, false otherwise

	 */

		String ldapUrl = this.ldapUrl;

		String ldapsUrl = this.ldapsUrl;

		String ldapBase = this.ldapBase;

		boolean authenticated = false;

		String identifier = user;

		if (user.indexOf(",") == -1) {

			throw new ConnectException("Invalid LDAP user credential: " + user

					+ ".  Missing ','");

		}

		String uid = user.substring(0, user.indexOf(","));

		user = user.substring(user.indexOf(","), user.length());

				", uid: " + uid +", user: " + user);

			// Check the usename as passed in

				" with user as identifier: " + identifier);

					PropertyService.getProperty("ldap.onlySecureConnection")))

					.booleanValue());

			// if not found, try looking up a valid DN then auth again

			if (!authenticated) {

				logMetacat.info("AuthLdap.authenticate - Looking up DN for: " + identifier);

				if (identifier == null) {

				}

				String refUrl = "";

				String refBase = "";

				if (identifier.startsWith("ldap")) {

					int position = identifier.indexOf(",");

					int position2 = identifier.indexOf(",", position + 1);

					identifier = identifier.substring(identifier.lastIndexOf("/") + 1);

						"with user as identifier: " + identifier + " and refUrl as: " +

						refUrl + " and refBase as: " + refBase);

							refBase, (new Boolean(PropertyService

									.getProperty("ldap.onlySecureReferalsConnection")))

									.booleanValue());

				} else {

							"with user as identifier: " + identifier);

							PropertyService.getProperty("ldap.onlySecureConnection")))

							.booleanValue());

				}

			}

			logMetacat.error("AuthLdap.authenticate - NullPointerException while authenticating in "

					+ "AuthLdap.authenticate: " + npe);

			npe.printStackTrace();

					+ "AuthLdap.authenticate: " + npe);

		} catch (NamingException ne) {

			logMetacat.error("AuthLdap.authenticate - Naming exception while authenticating in "

					+ "AuthLdap.authenticate: " + ne);

			ne.printStackTrace();

		} catch (PropertyNotFoundException pnfe) {

			logMetacat.error("AuthLdap.authenticate - Property exception while authenticating in "

					+ "AuthLdap.authenticate: " + pnfe.getMessage());

	}

	 * Connect to the LDAP directory and do the authentication using the

	 * username and password as passed into the routine.

	 *

	 * @param identifier

	 *            the distinguished name to check against LDAP

	 * @param password

	 *            the password for authentication

	 */

	private boolean ldapAuthenticate(String identifier, String password,

			boolean secureConnectionOnly) throws ConnectException, NamingException,

			NullPointerException {

		return ldapAuthenticate(identifier, password, this.ldapsUrl, this.ldapBase,

				secureConnectionOnly);

	}

	 * Connect to the LDAP directory and do the authentication using the

	 * username and password as passed into the routine.

	 *

	 * @param identifier

	 *            the distinguished name to check against LDAP

	 * @param password

	 *            the password for authentication

	 */

			String rootBase, boolean secureConnectionOnly) {

		String userDN = "";

			server = rootServer;

			if (dn.indexOf(userDN) < 0) {

				userDN = dn + "," + rootBase;

			} else {

				userDN = dn;

			}

			server = dn.substring(0, position + 1);

			userDN = dn.substring(position + 1);

			logMetacat.info("AuthLdap.ldapAuthenticate - userDN is: " + userDN);

				userDN + " Using server: " + server);

			env.put(Context.PROVIDER_URL, server);

			env.put(Context.REFERRAL, "throw");

			} catch (AuthTLSException ate) {

				logMetacat.info("AuthLdap.ldapAuthenticate - error while negotiating TLS: "

						+ ate.getMessage());

					return authenticated;

			}

		} catch (AuthenticationException ae) {

		} catch (javax.naming.InvalidNameException ine) {

		} catch (NamingException ne) {

			logMetacat.warn("AuthLdap.ldapAuthenticate - Caught NamingException in login: " + ne.getClass().getName());

			logMetacat.info(ne.toString() + "  " + ne.getRootCause());

	}

	private boolean authenticateTLS(Hashtable<String, String> env, String userDN, String password)

			throws AuthTLSException{

		logMetacat.info("AuthLdap.authenticateTLS - Trying to authenticate with TLS");

		try {

			LdapContext ctx = null;

			double startTime;

			double stopTime;

			startTime = System.currentTimeMillis();

			ctx = new InitialLdapContext(env, null);

			// Start up TLS here so that we don't pass our jewels in

			// cleartext

			StartTlsResponse tls =

				(StartTlsResponse) ctx.extendedOperation(new StartTlsRequest());

			// tls.setHostnameVerifier(new SampleVerifier());

			SSLSession sess = tls.negotiate();

			ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");

			ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDN);

			ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);

			ctx.reconnect(null);

			stopTime = System.currentTimeMillis();

			logMetacat.info("AuthLdap.authenticateTLS - Connection time thru "

					+ ldapsUrl + " was: " + (stopTime - startTime) / 1000 + " seconds.");

		} catch (NamingException ne) {

			throw new AuthTLSException("AuthLdap.authenticateTLS - Naming error when athenticating via TLS: " + ne.getMessage());

		} catch (IOException ioe) {

			throw new AuthTLSException("AuthLdap.authenticateTLS - I/O error when athenticating via TLS: " + ioe.getMessage());

		}

		return true;

	}

	private boolean authenticateNonTLS(Hashtable<String, String> env, String userDN, String password)

			throws NamingException {

		LdapContext ctx = null;

		double startTime;

		double stopTime;

		logMetacat.info("AuthLdap.authenticateNonTLS - Trying to authenticate without TLS");

		env.put(Context.SECURITY_AUTHENTICATION, "simple");

		env.put(Context.SECURITY_PRINCIPAL, userDN);

		env.put(Context.SECURITY_CREDENTIALS, password);

		ctx = new InitialLdapContext(env, null);

		stopTime = System.currentTimeMillis();

		logMetacat.info("AuthLdap.authenticateNonTLS - Connection time thru " + ldapsUrl + " was: "

				+ (stopTime - startTime) / 1000 + " seconds.");

		return true;

	}

	 * Get the identifying name for a given userid or name. This is the name

	 * that is used in conjunction withthe LDAP BaseDN to create a distinguished

	 * name (dn) for the record

	 *

	 * @param user

	 *            the user for which the identifying name is requested

	 * @returns String the identifying name for the user, or null if not found

	 */

	private String getIdentifyingName(String user, String ldapUrl, String ldapBase)

			throws NamingException {

		Hashtable env = new Hashtable();

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, "throw");

		env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

		try {

			int position = user.indexOf(",");

			String uid = user.substring(user.indexOf("=") + 1, position);

					.indexOf(",", position + 1));

			SearchControls ctls = new SearchControls();

			ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

			String filter = "(&(uid=" + uid + ")(o=" + org + "))";

				try {

					// Perform the search

					NamingEnumeration answer = sctx.search("", filter, ctls);

					while (answer.hasMore()) {

						SearchResult sr = (SearchResult) answer.next();

						identifier = sr.getName();

						return identifier;

					}

					// The search completes with no more referrals

					moreReferrals = false;

				} catch (ReferralException e) {

					if (moreReferrals) {

						boolean referralError = true;

						while (referralError) {

							try {

								sctx = (DirContext) e.getReferralContext();

								referralError = false;

							}

							catch (NamingException ne) {

								logMetacat.error("NamingException when getting referral contex. Skipping this referral. " + ne.getMessage());

								e.skipReferral();

								referralError = true;

							}

						}

		} catch (NamingException e) {

					+ e);

		}

		return identifier;

	}

	 * Get all users from the authentication service

	 *

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @returns string array of all of the user names

	 */

	public String[][] getUsers(String user, String password) throws ConnectException {

		String[][] users = null;

		Hashtable env = new Hashtable(11);

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, referral);

		env.put(Context.PROVIDER_URL, ldapUrl);

		env.put("com.sun.jndi.ldap.connect.timeout", ldapConnectTimeLimit);

			DirContext ctx = new InitialDirContext(env);

			// Users are objects that have the attribute

			// objectclass=InetOrgPerson.

			SearchControls ctls = new SearchControls();

			String[] attrIDs = { "dn", "cn", "o", "ou", "mail" };

			ctls.setReturningAttributes(attrIDs);

			ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

			ctls.setTimeLimit(ldapSearchTimeLimit);

			// ctls.setCountLimit(1000);

			String filter = "(objectClass=inetOrgPerson)";

			NamingEnumeration namingEnum = ctx.search(ldapBase, filter, ctls);

			Vector uvec = new Vector();

			Vector uname = new Vector();

			Vector uorg = new Vector();

			Vector uou = new Vector();

			Vector umail = new Vector();

			Attributes tempAttr = null;

			try {

				while (namingEnum.hasMore()) {

					SearchResult sr = (SearchResult) namingEnum.next();

					tempAttr = sr.getAttributes();

						uname.add((tempAttr.get("cn") + "").substring(4));

					} else {

						uname.add(tempAttr.get("cn") + "");

					}

						uorg.add((tempAttr.get("o") + "").substring(3));

					} else {

						uorg.add(tempAttr.get("o") + "");

					}

						uou.add((tempAttr.get("ou") + "").substring(4));

					} else {

						uou.add(tempAttr.get("ou") + "");

					}

						umail.add((tempAttr.get("mail") + "").substring(6));

					} else {

						umail.add(tempAttr.get("mail") + "");

					}

				}

			} catch (SizeLimitExceededException slee) {

			}

			users = new String[uvec.size()][5];

			for (int i = 0; i < uvec.size(); i++) {

				users[i][0] = (String) uvec.elementAt(i);

				users[i][1] = (String) uname.elementAt(i);

				users[i][2] = (String) uorg.elementAt(i);

				users[i][3] = (String) uorg.elementAt(i);

				users[i][4] = (String) umail.elementAt(i);

			}

			ctx.close();

			/*

			 * throw new ConnectException( "Problem getting users in

			 * AuthLdap.getUsers:" + e);

			 */

		}

	}

	 * Get all users from the authentication service

	 *

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @returns string array of all of the user names

	 */

	public String[] getUserInfo(String user, String password) throws ConnectException {

		String[] userinfo = new String[3];

		Hashtable env = new Hashtable(11);

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, referral);

		env.put(Context.PROVIDER_URL, ldapUrl);

			DirContext ctx = new InitialDirContext(env);

			// Specify the attributes to match.

			// Users are objects that have the attribute

			// objectclass=InetOrgPerson.

			SearchControls ctls = new SearchControls();

			String[] attrIDs = { "cn", "o", "mail" };

			ctls.setReturningAttributes(attrIDs);

			ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

			// ctls.setCountLimit(1000);

			// create the filter based on the uid

				String tempStr = user.substring(user.indexOf("o="));

				filter = "(&(" + user.substring(0, user.indexOf(",")) + ")("

						+ tempStr.substring(0, tempStr.indexOf(",")) + "))";

			} else {

				filter = "(&(" + user.substring(0, user.indexOf(",")) + "))";

			}

			filter = "(&(" + user.substring(0, user.indexOf(",")) + "))";

			try {

				while (namingEnum.hasMore()) {

					SearchResult sr = (SearchResult) namingEnum.next();

					tempAttr = sr.getAttributes();

						userinfo[0] = (tempAttr.get("cn") + "").substring(4);

					} else {

						userinfo[0] = (tempAttr.get("cn") + "");

					}

						userinfo[1] = (tempAttr.get("o") + "").substring(3);

					} else {

						userinfo[1] = (tempAttr.get("o") + "");

					}

						userinfo[2] = (tempAttr.get("mail") + "").substring(6);

					} else {

						userinfo[2] = (tempAttr.get("mail") + "");

					}

				}

			} catch (SizeLimitExceededException slee) {

			}

			ctx.close();

			throw new ConnectException("Problem getting users in AuthLdap.getUsers:" + e);

		}

	}

	 * Get the users for a particular group from the authentication service

	 *

	 * @param user

	 *            the user for authenticating against the service

	 * @param password

	 *            the password for authenticating against the service

	 * @param group

	 *            the group whose user list should be returned

	 * @returns string array of the user names belonging to the group

	 */

	public String[] getUsers(String user, String password, String group)

			throws ConnectException {

		String[] users = null;

		Hashtable env = new Hashtable(11);

		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

		env.put(Context.REFERRAL, referral);

		env.put(Context.PROVIDER_URL, ldapUrl);

			DirContext ctx = new InitialDirContext(env);

			String[] attrIDs = { "uniqueMember" };

			try {

				for (NamingEnumeration ae = answer.getAll(); ae.hasMore();) {

					Attribute attr = (Attribute) ae.next();

					for (NamingEnumeration e = attr.getAll(); e.hasMore(); uvec.add(e