Metacat

/**

 *  '$RCSfile$'

 *    Purpose: An implementation of the AuthInterface interface that

 *             allows Metacat to use the LDAP protocol for

 *             directory services

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *    Release: @release@

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.naming.AuthenticationException;

import javax.naming.Context;

import javax.naming.directory.Attributes;

import javax.naming.directory.BasicAttributes;

import javax.naming.directory.DirContext;

import javax.naming.directory.InitialDirContext;

import javax.naming.directory.SearchResult;

import javax.naming.NamingException;

import java.util.Iterator;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Vector;

/**

 * An implementation of the AuthInterface interface that

 * allows Metacat to use the LDAP protocol for directory services.

 * The LDAP authentication service is used to determine if a user

 * is authenticated, and whether they are a member of a particular group.

 */

  private MetaCatUtil util;

  private String ldapUrl;

  private String ldapBase;

   * Construct an AuthLdap

   */

  public AuthLdap() {

    // Read LDAP URI for directory service information

    this.util = new MetaCatUtil();

    this.ldapUrl = util.getOption("ldapurl");

    this.ldapBase = util.getOption("ldapbase");

  }

   * Determine if a user/password are valid according to the authentication

   * service.

   *

   * @param user the name of the principal to authenticate

   * @param password the password to use for authentication

   * @returns boolean true if authentication successful, false otherwise

   */

  public boolean authenticate(String user, String password)

                    throws ConnectException

  {

    String ldapBase = this.ldapBase;

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

//    env.put(Context.SECURITY_PRINCIPAL, user);

    try {

       * get all subtrees first in the current dir context

       * and then the dn for this uid or cn

       */

      Hashtable subtrees = getSubtrees(user,password,ldapUrl,ldapBase);

      Enumeration enum = subtrees.keys();

      while ( enum.hasMoreElements() ) {

        ldapBase = (String)enum.nextElement();

        ldapUrl = (String)subtrees.get(ldapBase);

System.out.println(ldapUrl + ldapBase);

        String identifier = getIdentifyingName(user,ldapUrl,ldapBase);

          // authenticate this time when opening the DirContext

          env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

          env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

          env.put(Context.SECURITY_CREDENTIALS, password);

          // If our auth credentials are invalid, an exception will be thrown

          DirContext ctx = null;

          try {

            ctx = new InitialDirContext(env);

            authenticated = true;

            ctx.close();

            this.ldapUrl = ldapUrl;

            this.ldapBase = ldapBase;

            break;

          } catch (AuthenticationException ae) {

            authenticated = false;

            if ( ctx != null ) {

              ctx.close();

            }

          }

        } else {

          util.debugMessage("User not found");

      } /* while ( enum.hasMore() ) */

      util.debugMessage("NullPointerException b' password is null");

      util.debugMessage("NullPointerException while authenticating in " +

                        "AuthLdap.authenticate: " + e);

      throw new ConnectException(

      "NullPointerException while authenticating in " +

                        "AuthLdap.authenticate: " + e);

                        "AuthLdap.authenticate: " + e);

      "Naming exception while authenticating in " +

                        "AuthLdap.authenticate: " + e);

      System.out.println(e.getMessage());

    return authenticated;

  }

  /**

   * that is used in conjunction withthe LDAP BaseDN to create a

   * distinguished name (dn) for the record

   *

   * @param user the user for which the identifying name is requested

   * @returns String the identifying name for the user,

   *          or null if not found

   */

  private String getIdentifyingName(String user, String ldapUrl, String ldapBase)

         throws NamingException

  {

    String identifier = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

//    env.put(Context.SECURITY_AUTHENTICATION, "EXTERNAL");

//    env.put(Context.SECURITY_PROTOCOL, "ssl");

    try {

      // Bind to the LDAP server, in order to search for the right

      // distinguished name (dn) based on userid (uid) or common name (cn)

      DirContext ctx = new InitialDirContext(env);

      SearchControls ctls = new SearchControls();

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      // Search for the user id or name using the uid, then cn and sn attributes

      // If we find a record, determine the dn for the record

      util.debugMessage("\nStarting search phase...\n");

      String filter = "(uid=" + user + ")";

      NamingEnumeration answer = ctx.search("", filter, ctls);

      if (answer.hasMore()) {

        SearchResult sr = (SearchResult)answer.next();

        identifier = sr.getName();

        if ( !sr.isRelative() ) {

          this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

          this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

          identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                            identifier.indexOf(","));

        }

        util.debugMessage("Found: " + identifier);

      } else {

        //Attributes matchAttrs2 = new BasicAttributes(true);

        //matchAttrs2.put(new BasicAttribute("cn", user));

        //NamingEnumeration answer2 = ctx.search("", matchAttrs2);

        filter = "(cn=" + user + ")";

        NamingEnumeration answer2 = ctx.search("", filter, ctls);

        if (answer2.hasMore()) {

          SearchResult sr = (SearchResult)answer2.next();

          identifier = sr.getName();

          if ( !sr.isRelative() ) {

            this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

            this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

            identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                              identifier.indexOf(","));

          }

          util.debugMessage("Found: " + identifier);

        } else {

          //Attributes matchAttrs3 = new BasicAttributes(true);

          //matchAttrs3.put(new BasicAttribute("sn", user));

          //NamingEnumeration answer3 = ctx.search("", matchAttrs3);

          filter = "(sn=" + user + ")";

          NamingEnumeration answer3 = ctx.search("", filter, ctls);

          if (answer3.hasMore()) {

            SearchResult sr = (SearchResult)answer3.next();

            identifier = sr.getName();

            if ( !sr.isRelative() ) {

              this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

              this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

              identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                                identifier.indexOf(","));

            }

            util.debugMessage("Found: " + identifier);

          }

        }

      }

      // Close the context when we're done the initial search

      ctx.close();

    } catch (NamingException e) {

      util.debugMessage("Naming exception while getting dn: " + e);

      throw new NamingException(

      "Naming exception in AuthLdap.getIdentifyingName: " + e);

    }

//System.out.println("context: " + identifier);

    return identifier;

  }

  /**

   */

         throws ConnectException

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      //String identifier = getIdentifyingName(user);

      //if (identifier != null) {

      //  env.put(Context.SECURITY_AUTHENTICATION, "simple");

      //  env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

      //  env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"uid"};

        // Users are objects that have the attribute objectclass=InetOrgPerson.

        Attributes matchAttrs = new BasicAttributes(true); // ignore case

        matchAttrs.put(new BasicAttribute("objectclass", "inetOrgPerson"));

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

          NamingEnumeration enum1 = attrs.getAll(); // only "uid" attr

          while (enum1.hasMore()) {

            Attribute attr = (Attribute)enum1.next();

            uvec.add(attr.get());

          }

        }

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

      //  util.debugMessage("User not found!");

      //}

    } catch (NamingException e) {

      System.err.println("Problem getting users in AuthLdap.getUsers:" + e);

      throw new ConnectException(

    return users;

  /**

   * Get the users for a particular group from the authentication service

   */

         throws ConnectException

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      //String identifier = getIdentifyingName(user);

      //if (identifier != null) {

      //  env.put(Context.SECURITY_AUTHENTICATION, "simple");

      //  env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

      //  env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        // Specify the attributes to match.

        matchAttrs.put(new BasicAttribute("cn", group));

        // Search for objects in the current context

        NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

          NamingEnumeration enum1 = attrs.getAll();

            Attribute attr = (Attribute)enum1.next();

            NamingEnumeration enum2 = attr.getAll();

            while (enum2.hasMore()) {

              String memberDN = (String)enum2.next();

              try {

                // we actually need RDN of the member

                // try to get RDN (UID) of the member in case of a user

                String memberID = getUserID(memberDN);

                if ( memberID != null ) {

                  uvec.add(memberID);

                // CURRENTLY WE DON'T SUPPORT SUBGROUPING, THUS

                // IGNORE SUBGROUPS AS MEMBERS OF THE GROUP

                // // this is a group, not user

                // // try to get RDN (CN) of the group

                // } else {

                //   memberID = getGroupID(memberDN);

                //   uvec.add(memberID);

                }

              } catch (NamingException ne) {}

        }

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

      //  util.debugMessage("User not found!");

      //}

    } catch (NamingException e) {

    return users;

  /**

   */

  private String getUserID(String dn)

         throws NamingException

  {

    String[] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl); // + ldapBase);

    try {

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"uid"};

        // Ask for "uid" attributes of the user

        Attributes attrs = ctx.getAttributes(dn, attrIDs);

        // Print all of the attributes (only "uid" attr)

        Vector uvec = new Vector();

        NamingEnumeration en = attrs.getAll();

        while (en.hasMore()) {

          Attribute att = (Attribute)en.next();

          Vector values = new Vector();

          String attName = att.getID();

          NamingEnumeration attvalues = att.getAll();

          while (attvalues.hasMore()) {

            String value = (String)attvalues.next();

            values.add(value);

          }

          uvec.add(values.elementAt(0));

        }

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

    } catch (NamingException ne) {

      System.err.println("Problem getting userID by \"dn\" in AuthLdap.getUserID:" + ne);

      throw ne;

    }

    if ( users.length > 0 ) {

      return users[0];

    }

    return null;

  }

  /**

   * Get CN by DN of a member

   */

  private String getGroupID(String dn)

         throws NamingException

  {

    String[] groups = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl); // + ldapBase);

    try {

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"cn"};

        // Ask for "uid" attributes of the user

        Attributes attrs = ctx.getAttributes(dn, attrIDs);

        // Print all of the attributes (only "cn" attr)

        Vector uvec = new Vector();

        NamingEnumeration en = attrs.getAll();

        while (en.hasMore()) {

          Attribute att = (Attribute)en.next();

          Vector values = new Vector();

          String attName = att.getID();

          NamingEnumeration attvalues = att.getAll();

          while (attvalues.hasMore()) {

            String value = (String)attvalues.next();

            values.add(value);

          }

          uvec.add(values.elementAt(0));

        }

        // initialize users[]; fill users[]

        groups = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          groups[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

    } catch (NamingException ne) {

      System.err.println("Problem getting groupID by \"dn\" in AuthLdap.getGroupID:" + ne);

      throw ne;

    }

    if ( groups.length > 0 ) {

      return groups[0];

    }

    return null;

  }

  /**

   */

         throws ConnectException

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      //String identifier = getIdentifyingName(user);

      //if (identifier != null) {

      //  env.put(Context.SECURITY_AUTHENTICATION, "simple");

      //  env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

      //  env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        // Groups are objects with attribute objectclass=groupofuniquenames.

        Attributes matchAttrs = new BasicAttributes(true); // ignore case

        matchAttrs.put(new BasicAttribute("objectclass", "groupofuniquenames"));

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

            Attribute attr = (Attribute)enum1.next();

            uvec.add(attr.get());

          }

        }

        // initialize groups[] and fill it

        groups = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          groups[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

      //  util.debugMessage("User not found!");

      //}

    } catch (NamingException e) {

      System.err.println("Problem getting groups in AuthLdap.getGroups:" + e);

      throw new ConnectException(

      "Problem getting groups in AuthLdap.getGroups:" + e);

    }

    return groups;

  /**

   * Get the groups for a particular user from the authentication service

   */

         throws ConnectException

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

      //String identifier = getIdentifyingName(user);

      //if (identifier != null) {

      //  env.put(Context.SECURITY_AUTHENTICATION, "simple");

      //  env.put(Context.SECURITY_PRINCIPAL, identifier + "," + ldapBase);

      //  env.put(Context.SECURITY_CREDENTIALS, password);

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        // Specify the attributes to match.

        // and have attribute uniquemember=foruser,ldapbase.

        matchAttrs.put(new BasicAttribute("uniquemember",foruser+","+ldapBase));

        // Search for objects in the current context

        NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);

        // Print the users

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

            Attribute attr = (Attribute)enum1.next();

            uvec.add(attr.get());

          }

        }

        // initialize groups[] and fill it

        groups = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          groups[i] = (String)uvec.elementAt(i);

        }

        // Close the context when we're done

        ctx.close();

      //  util.debugMessage("User not found!");

      //}

    } catch (NamingException e) {

      System.err.println("Problem getting groups in AuthLdap.getGroups:" + e);

      throw new ConnectException(

    return groups;

  /**

   * Get attributes describing a user or group

   *

   * @param user the user for which the attribute list is requested

   * @returns HashMap a map of attribute name to a Vector of values

   */

  {

  /**

   * Get attributes describing a user or group

   *

   * @param user the user for which the attribute list is requested

   * @param authuser the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns HashMap a map of attribute name to a Vector of values

   */

  {

    HashMap attributes = new HashMap();

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

        "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    // Authentication information

    try {