Metacat

/**

 *  '$RCSfile$'

 *    Purpose: An implementation of the AuthInterface interface that

 *             allows Metacat to use the LDAP protocol for

 *             directory services

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *    Release: @release@

 *

 *   '$Author: bojilova $'

 *     '$Date: 2001-03-09 16:41:19 -0800 (Fri, 09 Mar 2001) $'

 * '$Revision: 726 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.naming.AuthenticationException;

import javax.naming.Context;

import javax.naming.directory.Attribute;

import javax.naming.directory.Attributes;

import javax.naming.directory.BasicAttribute;

import javax.naming.directory.BasicAttributes;

import javax.naming.directory.DirContext;

import javax.naming.directory.InitialDirContext;

import javax.naming.directory.SearchResult;

import javax.naming.directory.SearchControls;

import javax.naming.NamingEnumeration;

import javax.naming.NamingException;

import java.util.Iterator;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Set;

import java.util.Vector;

/**

 * An implementation of the AuthInterface interface that

 * allows Metacat to use the LDAP protocol for directory services.

 * The LDAP authentication service is used to determine if a user 

 * is authenticated, and whether they are a member of a particular group.

 */

public class AuthLdap implements AuthInterface {

  /**

   * Determine if a user/password are valid according to the authentication

   * service.

   *

   * @param user the name of the principal to authenticate

   * @param password the password to use for authentication

   * @returns boolean true if authentication successful, false otherwise

   */

  public boolean authenticate(String user, String password)

                    throws ConnectException

  {

    MetaCatUtil util = new MetaCatUtil();

    String ldapUrl = util.getOption("ldapurl");

    String ldapBase = util.getOption("ldapbase");

    String distName = null;

    boolean authenticated = false;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Get the dn for this uid or cn 

      String identifier = getIdentifyingName(user);

      if (identifier != null) {

        distName = identifier + "," + ldapBase;

        // Now that we have the dn, we can authenticate, so

        // authenticate this time when opening the DirContext

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, distName);

        env.put(Context.SECURITY_CREDENTIALS, password);

        // If our auth credentials are invalid, an exception will be thrown

        DirContext ctx = new InitialDirContext(env);

        // If no exception is thrown then authentication succeeded

        authenticated = true;

        // Close the context when we're done

        ctx.close();

      } else {

        util.debugMessage("User not found!");

      }

    } catch (AuthenticationException ae) {

      util.debugMessage("Error authenticating in AuthLdap.authenticate: " + ae);

      throw new ConnectException(

      "Error authenticating in AuthLdap.authenticate: " + ae);

    } catch (NamingException e) {

      util.debugMessage("Naming exception while authenticating in " + 

                        "AuthLdap.authenticate: " + e);

      throw new ConnectException(

      "Naming exception while authenticating in " + 

                        "AuthLdap.authenticate: " + e);

    }

    return authenticated;

  }

  /**

   * Get all users from the authentication service

   */

  public String[] getUsers(String user, String password) 

         throws ConnectException

  {

    MetaCatUtil util = new MetaCatUtil();

    String ldapUrl = util.getOption("ldapurl");

    String ldapBase = util.getOption("ldapbase");

    String[] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Get the dn for this uid or cn 

      String identifier = getIdentifyingName(user);

      if (identifier != null) {

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

        env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"uid"};

        // Specify the attributes to match.

        // Users are objects that have the attribute objectclass=InetOrgPerson.

        Attributes matchAttrs = new BasicAttributes(true); // ignore case

        matchAttrs.put(new BasicAttribute("objectclass", "inetOrgPerson"));

        // Search for objects in the current context

        NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

          NamingEnumeration enum1 = attrs.getAll(); // only "uid" attr

          while (enum1.hasMore()) {

            Attribute attr = (Attribute)enum1.next();

            uvec.add(attr.get());

          }

        }

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i); 

        }

        // Close the context when we're done

        ctx.close();

      } else {

        util.debugMessage("User not found!");

      }

    } catch (NamingException e) {

      System.err.println("Problem getting users in AuthLdap.getUsers:" + e);

      throw new ConnectException(

      "Problem getting groups in AuthLdap.getUsers:" + e);

    }

    return users;

  }

  /**

   * Get the users for a particular group from the authentication service

   */

  public String[] getUsers(String user, String password, String group) 

         throws ConnectException

  {

    MetaCatUtil util = new MetaCatUtil();

    String ldapUrl = util.getOption("ldapurl");

    String ldapBase = util.getOption("ldapbase");

    String[] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Get the dn for this uid or cn 

      String identifier = getIdentifyingName(user);

      if (identifier != null) {

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

        env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"uniquemember"};

        // Get the dn for this group

        identifier = getIdentifyingName(group);

        // Specify the attributes to match.

        // Groups are objects with attribute objectclass=groupofuniquenames.

        Attributes matchAttrs = new BasicAttributes(true); // ignore case

        matchAttrs.put(new BasicAttribute("objectclass", "groupofuniquenames"));

        matchAttrs.put(new BasicAttribute("cn", group));

        // Search for objects in the current context

        NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

          // return all attributes

          NamingEnumeration enum1 = attrs.getAll(); // only "uniquemember" attr

          while (enum1.hasMore()) {

            Attribute attr = (Attribute)enum1.next();

            // return all values of that attribute

            NamingEnumeration enum2 = attr.getAll();

            while (enum2.hasMore()) {

              uvec.add((String)enum2.next());

            }

          }

        }

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i); 

        }

        // Close the context when we're done

        ctx.close();

      } else {

        util.debugMessage("User not found!");

      }

    } catch (NamingException e) {

      System.err.println("Problem getting users in AuthLdap.getUsers:" + e);

      throw new ConnectException(

      "Problem getting groups in AuthLdap.getUsers:" + e);

    }

    return users;

  }

  /**

   * Get all groups from the authentication service

   */

  public String[] getGroups(String user, String password) 

         throws ConnectException

  {

    MetaCatUtil util = new MetaCatUtil();

    String ldapUrl = util.getOption("ldapurl");

    String ldapBase = util.getOption("ldapbase");

    String[] groups = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Get the dn for this uid or cn 

      String identifier = getIdentifyingName(user);

      if (identifier != null) {

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

        env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"cn"};

        // Specify the attributes to match.

        // Groups are objects with attribute objectclass=groupofuniquenames.

        Attributes matchAttrs = new BasicAttributes(true); // ignore case

        matchAttrs.put(new BasicAttribute("objectclass", "groupofuniquenames"));

        // Search for objects in the current context

        NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

          NamingEnumeration enum1 = attrs.getAll(); // only "cn" attr

          while (enum1.hasMore()) {

            Attribute attr = (Attribute)enum1.next();

            uvec.add(attr.get());

          }

        }

        // initialize groups[] and fill it

        groups = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          groups[i] = (String)uvec.elementAt(i); 

        }

        // Close the context when we're done

        ctx.close();

      } else {

        util.debugMessage("User not found!");

      }

    } catch (NamingException e) {

      System.err.println("Problem getting groups in AuthLdap.getGroups:" + e);

      throw new ConnectException(

      "Problem getting groups in AuthLdap.getGroups:" + e);

    }

    return groups;

  }

  /**

   * Get the groups for a particular user from the authentication service

   */

  public String[] getGroups(String user, String password, String foruser) 

         throws ConnectException

  {

    MetaCatUtil util = new MetaCatUtil();

    String ldapUrl = util.getOption("ldapurl");

    String ldapBase = util.getOption("ldapbase");

    String[] groups = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Get the dn for this uid or cn 

      String identifier = getIdentifyingName(user);

      if (identifier != null) {

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

        env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"cn"};

        // Specify the attributes to match.

        // Groups are objects with attribute objectclass=groupofuniquenames.

        // and have attribute uniquemember=foruser,ldapbase.

        Attributes matchAttrs = new BasicAttributes(true); // ignore case

        matchAttrs.put(new BasicAttribute("objectclass", "groupofuniquenames"));

        matchAttrs.put(new BasicAttribute("uniquemember",foruser+","+ldapBase));

        // Search for objects in the current context

        NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

          NamingEnumeration enum1 = attrs.getAll(); // only "gid" attr

          while (enum1.hasMore()) {

            Attribute attr = (Attribute)enum1.next();

            uvec.add(attr.get());

          }

        }

        // initialize groups[] and fill it

        groups = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          groups[i] = (String)uvec.elementAt(i); 

        }

        // Close the context when we're done

        ctx.close();

      } else {

        util.debugMessage("User not found!");

      }

    } catch (NamingException e) {

      System.err.println("Problem getting groups in AuthLdap.getGroups:" + e);

      throw new ConnectException(

      "Problem getting groups in AuthLdap.getGroups:" + e);

    }

    return groups;

  }

  /**

   * Get attributes describing a user or group

   *

   * @param user the user for which the attribute list is requested

   * @returns HashMap a map of attribute name to a Vector of values

   */

  public HashMap getAttributes(String foruser) 

         throws ConnectException

  {

    return getAttributes(null, null, foruser);

  }

  /**

   * Get attributes describing a user or group

   *

   * @param user the user for which the attribute list is requested

   * @param authuser the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns HashMap a map of attribute name to a Vector of values

   */

  public HashMap getAttributes(String user, String password, String foruser) 

         throws ConnectException

  {

    MetaCatUtil util = new MetaCatUtil();

    String ldapUrl = util.getOption("ldapurl");

    String ldapBase = util.getOption("ldapbase");

    HashMap attributes = new HashMap();

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

        "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    // Authentication information

    try {

      if ((user != null) && (password != null)) {

        String identifier = getIdentifyingName(user);

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

        env.put(Context.SECURITY_CREDENTIALS, password);

      }

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Find out the identifying attribute for the user

      String userident = getIdentifyingName(foruser);

      // Ask for all attributes of the user 

      Attributes attrs = ctx.getAttributes(userident);

      // Print all of the attributes

      NamingEnumeration en = attrs.getAll();

      while (en.hasMore()) {

        Attribute att = (Attribute)en.next();

        Vector values = new Vector();

        String attName = att.getID();

        NamingEnumeration attvalues = att.getAll();

        while (attvalues.hasMore()) {

          String value = (String)attvalues.next();

          values.add(value);

        }

        attributes.put(attName, values);

      }

      // Close the context when we're done

      ctx.close();

    } catch (NamingException e) {

      System.err.println("Problem getting attributes in AuthLdap.getAttributes:" 

                          + e);

      throw new ConnectException(

      "Problem getting attributes in AuthLdap.getAttributes:" + e);

    }

    return attributes;

  }

  /**

   * Get the identifying name for a given userid or name.  This is the name

   * that is used in conjunction withthe LDAP BaseDN to create a

   * distinguished name (dn) for the record

   *

   * @param user the user for which the identifying name is requested

   * @returns String the identifying name for the user, 

   *          or null if not found

   */

  private String getIdentifyingName(String user) 

         throws NamingException

  {

    MetaCatUtil util = new MetaCatUtil();

    String ldapUrl = util.getOption("ldapurl");

    String ldapBase = util.getOption("ldapbase");

    String identifier = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      // Bind to the LDAP server, in order to search for the right

      // distinguished name (dn) based on userid (uid) or common name (cn)

      DirContext ctx = new InitialDirContext(env);

      // Search for the user id or name using the uid, then cn and sn attributes

      // If we find a record, determine the dn for the record

      util.debugMessage("\nStarting search phase...\n");

      Attributes matchAttrs = new BasicAttributes(true);

      matchAttrs.put(new BasicAttribute("uid", user));

      NamingEnumeration answer = ctx.search("", matchAttrs);

      if (answer.hasMore()) {

        SearchResult sr = (SearchResult)answer.next();

        identifier = sr.getName();

        util.debugMessage("Found: " + identifier);

      } else {

        Attributes matchAttrs2 = new BasicAttributes(true);

        matchAttrs2.put(new BasicAttribute("cn", user));

        NamingEnumeration answer2 = ctx.search("", matchAttrs2);

        if (answer2.hasMore()) {

          SearchResult sr = (SearchResult)answer2.next();

          identifier = sr.getName();

          util.debugMessage("Found: " + identifier);

        } else {

          Attributes matchAttrs3 = new BasicAttributes(true);

          matchAttrs3.put(new BasicAttribute("sn", user));

          NamingEnumeration answer3 = ctx.search("", matchAttrs3);

          if (answer3.hasMore()) {

            SearchResult sr = (SearchResult)answer3.next();

            identifier = sr.getName();

            util.debugMessage("Found: " + identifier);

          }

        }

      }

      // Close the context when we're done the initial search

      ctx.close();

    } catch (NamingException e) {

      util.debugMessage("Naming exception while getting dn: " + e);

      System.out.println("Naming exception in AuthLdap.getIdentifyingName");

      throw new NamingException(

      "Naming exception in AuthLdap.getIdentifyingName: " + e);

    }

    return identifier;

  }

  /**

   * Get list of all groups and users from authentication scheme.

   * The output is formatted in XML.

   */

  private String getPrincipals(String user, String password)

                throws ConnectException

  {

    StringBuffer out = new StringBuffer();

    String[] groups = getGroups(user, password);

    Vector usersIn = new Vector();

    out.append("<?xml version=\"1.0\"?>\n");

    out.append("<principals>\n");

    // for the groups and users that belong to them

    if ( groups.length > 0 ) {

      for (int i=0; i < groups.length; i++ ) {

        out.append("  <group>\n");

        out.append("    <groupname>" + groups[i] + "<groupname>\n");

        String[] usersForGroup = getUsers(user,password,groups[i]);

        for (int j=0; j < usersForGroup.length; j++ ) {

          usersIn.addElement(usersForGroup[j]);

          out.append("    <user>\n");

          out.append("      <username>" + usersForGroup[j] + "<username>\n");

          out.append("    </user>\n");

        }

        out.append("  </group>\n");

      }

    }

    // for the users not belonging to any group

    String[] users = getUsers(user, password);

    for (int j=0; j < users.length; j++ ) {

      if ( !usersIn.contains(users[j]) ) {

        out.append("  <user>\n");

        out.append("    <username>" + users[j] + "<username>\n");

        out.append("  </user>\n");

      }

    }

    out.append("</principals>");

    return out.toString();

  }

  /**

   * Test method for the class

   */

  public static void main(String[] args) {

    // Provide a user, such as: "Matt Jones", or "jones"

    String user = args[0];

    String password = args[1];

    AuthLdap authservice = new AuthLdap();

    boolean isValid = false;

    try {

      isValid = authservice.authenticate(user, password);

      if (isValid) {

        System.out.println("Authentication successful for: " + user );

        System.out.println(" ");

      } else {

        System.out.println("Authentication failed for: " + user);

      }

      if (isValid) {

        //String group = args[2];

        HashMap userInfo = authservice.getAttributes(user, password, user);

        // Print all of the attributes

        Iterator attList = (Iterator)(((Set)userInfo.keySet()).iterator());

        while (attList.hasNext()) {

          String att = (String)attList.next();

          Vector values = (Vector)userInfo.get(att);

          Iterator attvalues = values.iterator();

          while (attvalues.hasNext()) {

            String value = (String)attvalues.next();

            System.out.println(att + ": " + value);

          }

        }

      }

/*

      // get the whole list of users

      if (isValid) {

        String[] users = authservice.getUsers(user, password);

        for (int i=0; i < users.length; i++) {

          System.out.println(users[i]);          

        }

        System.out.println("Total " + users.length + " users.");

      }

*/

/*

      // get the whole list of users for a group

      if (isValid) {

        String group = args[2];

        String[] users = authservice.getUsers(user, password, group);

        for (int i=0; i < users.length; i++) {

          System.out.println(users[i]);          

        }

      }

*/

      // get the whole list groups and users in XML format

      if (isValid) {

        String out = authservice.getPrincipals(user, password);

        java.io.File f = new java.io.File("principals.txt");

        java.io.FileWriter fw = new java.io.FileWriter(f);

        java.io.BufferedWriter buff = new java.io.BufferedWriter(fw);

        buff.write(out);

        buff.flush();

        buff.close();

        fw.close();

      }

    } catch (ConnectException ce) {

      System.err.println("Error connecting to LDAP server in authldap.main");

    } catch (java.io.IOException ioe) {

      System.err.println("I/O Error writing to file principals.txt");

    }

  }

}