Metacat

/**

 *  '$RCSfile$'

 *    Purpose: An implementation of the AuthInterface interface that

 *             allows Metacat to use the LDAP protocol for

 *             directory services

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *    Release: @release@

 *

 *   '$Author: berkley $'

 *     '$Date: 2002-01-15 08:46:37 -0800 (Tue, 15 Jan 2002) $'

 * '$Revision: 894 $'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.net.ConnectException;

import javax.naming.AuthenticationException;

import javax.naming.Context;

import javax.naming.NamingEnumeration;

import javax.naming.NamingException;

import javax.naming.SizeLimitExceededException;

import javax.naming.InitialContext;

import javax.naming.directory.InvalidSearchFilterException;

import javax.naming.directory.Attribute;

import javax.naming.directory.Attributes;

import javax.naming.directory.BasicAttribute;

import javax.naming.directory.BasicAttributes;

import javax.naming.directory.DirContext;

import javax.naming.directory.InitialDirContext;

import javax.naming.directory.SearchResult;

import javax.naming.directory.SearchControls;

import javax.naming.ReferralException;

import javax.naming.ldap.*;

import java.util.Iterator;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Enumeration;

import java.util.Set;

import java.util.Vector;

/**

 * An implementation of the AuthInterface interface that

 * allows Metacat to use the LDAP protocol for directory services.

 * The LDAP authentication service is used to determine if a user 

 * is authenticated, and whether they are a member of a particular group.

 */

public class AuthLdap implements AuthInterface, Runnable {

  private MetaCatUtil util = new MetaCatUtil();

  private String ldapUrl;

  private String ldapsUrl;

  private String ldapBase;

  private String referral;

  private Context referralContext;

  Hashtable env = new Hashtable(11);

  private Context rContext;

  ReferralException refExc;

  /** 

   * Construct an AuthLdap

   */

  public AuthLdap() {

    // Read LDAP URI for directory service information

    this.ldapUrl = MetaCatUtil.getOption("ldapurl");

    this.ldapsUrl = MetaCatUtil.getOption("ldapsurl");

    this.ldapBase = MetaCatUtil.getOption("ldapbase");

    this.referral = MetaCatUtil.getOption("referral");

    //this.referral = "ignore";

    //System.out.println("LDAPBASE is: " + ldapBase);

  }

  /**

   * Determine if a user/password are valid according to the authentication

   * service.

   *

   * @param user the name of the principal to authenticate

   * @param password the password to use for authentication

   * @returns boolean true if authentication successful, false otherwise

   */

  public boolean authenticate(String user, String password)

                    throws ConnectException

  {

    System.out.println("ldap authenticating");

    String ldapUrl = this.ldapUrl;

    String ldapsUrl = this.ldapsUrl;

    String ldapBase = this.ldapBase;

    boolean authenticated = false;

    String identifier = user;

    try {

        // Check the usename as passed in

        authenticated = ldapAuthenticate(identifier, password);

        // if not found, try looking up a valid DN then auth again

        if (!authenticated) {

            identifier = getIdentifyingName(identifier,ldapUrl,ldapBase);

            authenticated = ldapAuthenticate(identifier+","+ldapBase, password);

        }

    } catch (NullPointerException e) {

      util.debugMessage("NullPointerException b' password is null");

      util.debugMessage("NullPointerException while authenticating in " + 

                        "AuthLdap.authenticate: " + e);

      throw new ConnectException(

      "NullPointerException while authenticating in " + 

                        "AuthLdap.authenticate: " + e);

    } catch (NamingException e) {

      util.debugMessage("Naming exception while authenticating in " + 

                        "AuthLdap.authenticate: " + e);

      e.printStackTrace();

    } catch (Exception e) {

      System.out.println(e.getMessage());

    }

    return authenticated;

  }

  /**

   * Connect to the LDAP directory and do the authentication using the

   * username and password as passed into the routine.

   *

   * @param identifier the distinguished name to check against LDAP

   * @param password the password for authentication

   */

  private boolean ldapAuthenticate(String identifier, String password)

            throws ConnectException, NamingException, NullPointerException

  {

    double totStartTime = System.currentTimeMillis();

    boolean authenticated = false;

    if (identifier != null && !password.equals("")) {

        // Identify service provider to use

        Hashtable env = new Hashtable(11);

        env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

        //System.out.println("referral: " + referral);

        // Now that we have the dn, we can authenticate, so

        // authenticate this time when opening the DirContext

        //System.out.println("referral=throw");

        env.put(Context.REFERRAL, "throw");

        /*CB:  Note that the above env.put statement does not use the referral 

          variable.  it is hard coded to 'throw'.  Matt: Is it ok to do this

          only here and not in every method?

        */

        //System.out.println("ldapsUrl: " + ldapsUrl + " ldapBase: " + ldapBase);

        env.put(Context.PROVIDER_URL, ldapsUrl + ldapBase);

        if ( !ldapsUrl.equals(ldapUrl) ) {

          // ldap is set on default port 389

          // ldaps is set on second port - 636 by default

          env.put(Context.SECURITY_PROTOCOL, "ssl");

        }

        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        env.put(Context.SECURITY_PRINCIPAL, identifier);

        //System.out.println("Trying DN: " + identifier);

        env.put(Context.SECURITY_CREDENTIALS, password);

        // If our auth credentials are invalid, an exception will be thrown

        DirContext ctx = null;

        try {

          double startTime = System.currentTimeMillis();

          ctx = new InitialDirContext(env);

//          // StartTLS support from LDAPv3 with X.509 cert and with JSDKv1.4+

//          LdapContext ctx = new InitialLdapContext(env, null);

//          StartTlsResponse tls =

//            (StartTlsResponse)ctx.extendedOperation(new StartTlsRequest());

//          tls.negotiate();

          double stopTime = System.currentTimeMillis();

          System.out.println("Connection time thru " + ldapsUrl + " was: " +

                             (stopTime-startTime)/1000 + " seconds.");

          authenticated = true;

          //tls.close();

          ctx.close();

          this.ldapUrl = ldapUrl;

          this.ldapBase = ldapBase;

          //break;

        } catch (AuthenticationException ae) {

          authenticated = false;

//          if ( tls != null ) {

//            tls.close();

//          }

          if ( ctx != null ) {

            ctx.close();

          }

        } 

        catch (javax.naming.InvalidNameException ine) 

        {

            System.out.println("An invalid DN was provided!");

        } 

        catch(javax.naming.ReferralException re) 

        {

          System.out.println("referral during authentication");

	        try

          {

            refExc = re;

            Thread t = new Thread(this);

            System.out.println("Starting thread...");

            t.start();

            System.out.println("sleeping for 5 seconds.");

            Thread.sleep(5000); //this is a manual override of ldap's hideously long time

                         //out period.

            System.out.println("Awake after 5 seconds.");

            if(referralContext == null)

            {

              System.out.println("killing thread....not authenticated.");

              t.interrupt();

              System.out.println("thread killed.");

              authenticated = false;

            }

            else

            {

              //Context c = handleReferral(env, re.getReferralContext(env));

              authenticated = true;

            }

          }

          catch(Exception e)

          {

            authenticated = false;

          }

        }

    } else { 

        util.debugMessage("User not found");

    }

    double totStopTime = System.currentTimeMillis();

    System.out.println("total ldap authentication time: " + 

                      (totStopTime - totStartTime)/1000 + " seconds");

    return authenticated;

  }

  /**

   * handles a referral exception.  this method should be called from

   * within the catch statement of a ReferralException 

   */

  private Context handleReferral(Hashtable env, Context rContext) throws

                                                                  Exception

  {

    System.out.println("referral to : " + rContext.toString());

    boolean referralSuccess = false;

    while(referralSuccess != true)

    {

      try

      {

        /*

         Matt, I think this is right but I'm not sure...please check me to make

         sure I didn't do something wrong here.

        */

        double refStartTime = System.currentTimeMillis();

        Context refctx = rContext;

        referralSuccess = true;

        refctx.close();

        this.ldapUrl = ldapUrl;

        this.ldapBase = ldapBase;

        double refStopTime = System.currentTimeMillis();

        System.out.println("total referral time: " + 

                          (refStopTime - refStartTime)/1000 + "seconds");

        return refctx;

      }

      catch(ReferralException e)

      {

          System.out.println("Referring to: " + 

                             rContext.toString());

      }

      catch(Exception e)

      {

        throw e;

      }

    }

    return null; //this should never get called

  }

  /**

   * Get the identifying name for a given userid or name.  This is the name

   * that is used in conjunction withthe LDAP BaseDN to create a

   * distinguished name (dn) for the record

   *

   * @param user the user for which the identifying name is requested

   * @returns String the identifying name for the user, 

   *          or null if not found

   */

  private String getIdentifyingName(String user, String ldapUrl, String ldapBase) 

         throws NamingException

  {

    String identifier = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY,

            "com.sun.jndi.ldap.LdapCtxFactory");

    util.debugMessage("setting referrals to: " + referral);

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    //    non-secure LDAP context; dn are publicly readable

    //    env.put(Context.SECURITY_PROTOCOL, "ssl");

    try {

      // Bind to the LDAP server, in order to search for the right

      // distinguished name (dn) based on userid (uid) or common name (cn)

      DirContext ctx = new InitialDirContext(env);

      SearchControls ctls = new SearchControls();

      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

      // Search for the user id or name using the uid, then cn and sn attributes

      // If we find a record, determine the dn for the record

      //System.out.println("Starting search phase...");

      String filter = "(" + user + ")";

      NamingEnumeration answer;

      try {

        answer = ctx.search("", filter, ctls);

        if (answer.hasMore()) {

          SearchResult sr = (SearchResult)answer.next();

          identifier = sr.getName();

          if ( !sr.isRelative() ) { 

            this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

            this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

            identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                              identifier.indexOf(","));

          }

          util.debugMessage("Found: " + identifier);

          return identifier;

        }

      } catch (InvalidSearchFilterException e) {}

      filter = "(uid=" + user + ")";

      answer = ctx.search("", filter, ctls);

      if (answer.hasMore()) {

        SearchResult sr = (SearchResult)answer.next();

        identifier = sr.getName();

        if ( !sr.isRelative() ) { 

          this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

          this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

          identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                            identifier.indexOf(","));

        }

        util.debugMessage("Found: " + identifier);

      } else {

        //Attributes matchAttrs2 = new BasicAttributes(true);

        //matchAttrs2.put(new BasicAttribute("cn", user));

        //NamingEnumeration answer2 = ctx.search("", matchAttrs2);

        filter = "(cn=" + user + ")";

        NamingEnumeration answer2 = ctx.search("", filter, ctls);

        if (answer2.hasMore()) {

          SearchResult sr = (SearchResult)answer2.next();

          identifier = sr.getName();

          if ( !sr.isRelative() ) { 

            this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

            this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

            identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                              identifier.indexOf(","));

          }

          util.debugMessage("Found: " + identifier);

        } else {

          //Attributes matchAttrs3 = new BasicAttributes(true);

          //matchAttrs3.put(new BasicAttribute("sn", user));

          //NamingEnumeration answer3 = ctx.search("", matchAttrs3);

          filter = "(sn=" + user + ")";

          NamingEnumeration answer3 = ctx.search("", filter, ctls);

          if (answer3.hasMore()) {

            SearchResult sr = (SearchResult)answer3.next();

            identifier = sr.getName();

            if ( !sr.isRelative() ) { 

              this.ldapUrl = identifier.substring(0,identifier.lastIndexOf("/")+1);

              this.ldapBase = identifier.substring(identifier.indexOf(",")+1);

              identifier = identifier.substring(identifier.lastIndexOf("/")+1,

                                                identifier.indexOf(","));

            }

            util.debugMessage("Found: " + identifier);

          }

        }

      }

      // Close the context when we're done the initial search

      ctx.close();

    } catch (NamingException e) {

      util.debugMessage("Naming exception while getting dn: " + e);

      throw new NamingException(

      "Naming exception in AuthLdap.getIdentifyingName: " + e);

    }

    return identifier;

  }

  /**

   * Get all users from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of all of the user names

   */

  public String[] getUsers(String user, String password) 

         throws ConnectException

  {

    String[] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    //env.put(Context.BATCHSIZE, "500");

    try {

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the attributes to match.

        // Users are objects that have the attribute objectclass=InetOrgPerson.

        SearchControls ctls = new SearchControls();

        String[] attrIDs = {"dn"};

        ctls.setReturningAttributes(attrIDs);

        ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

        //ctls.setCountLimit(1000);

        String filter = "(objectClass=inetOrgPerson)";

        NamingEnumeration enum = ctx.search(ldapBase, filter, ctls);

        // Store the users in a vector

        Vector uvec = new Vector();

        try {

            while (enum.hasMore()) {

                SearchResult sr = (SearchResult)enum.next();

                uvec.add(sr.getName()+","+ldapBase);

            }

        } catch (SizeLimitExceededException slee) {

            util.debugMessage("LDAP Server size limit exceeded. " +

                    "Returning incomplete record set.");

        }

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i); 

        }

        // Close the context when we're done

        ctx.close();

    } catch (NamingException e) {

      System.err.println("Problem getting users in AuthLdap.getUsers:" + e);

      e.printStackTrace(System.err);

      throw new ConnectException(

      "Problem getting users in AuthLdap.getUsers:" + e);

    }

    return users;

  }

  /**

   * Get the users for a particular group from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param group the group whose user list should be returned

   * @returns string array of the user names belonging to the group

   */

  public String[] getUsers(String user, String password, String group) 

         throws ConnectException

  {

    String[] users = null;

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"uniqueMember"};

        Attributes answer = ctx.getAttributes(group, attrIDs);

        Vector uvec = new Vector();

        try {

            for (NamingEnumeration ae = answer.getAll(); ae.hasMore();) {

                Attribute attr = (Attribute)ae.next();

                for (NamingEnumeration e = attr.getAll(); 

                     e.hasMore();

                     uvec.add(e.next()) 

                    );

            }

        } catch (SizeLimitExceededException slee) {

            util.debugMessage("LDAP Server size limit exceeded. " +

                    "Returning incomplete record set.");

        }

        // initialize users[]; fill users[]

        users = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          users[i] = (String)uvec.elementAt(i); 

        }

        // Close the context when we're done

        ctx.close();

    } catch (NamingException e) {

      System.err.println("Problem getting users for a group in " +

              "AuthLdap.getUsers:" + e);

      throw new ConnectException(

      "Problem getting users for a group in AuthLdap.getUsers:" + e);

    }

    return users;

  }

  /**

   * Get all groups from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @returns string array of the group names

   */

  public String[] getGroups(String user, String password) 

         throws ConnectException

  {

      return getGroups(user, password, null);

  }

  /**

   * Get the groups for a particular user from the authentication service

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param foruser the user whose group list should be returned

   * @returns string array of the group names

   */

  public String[] getGroups(String user, String password, String foruser) 

         throws ConnectException

  {

    //System.err.println("GG in get groups 2");

    String[] groups = null;

    // Identify service provider to use

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, "throw");

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"cn"};

        // Specify the attributes to match.

        // Groups are objects with attribute objectclass=groupofuniquenames.

        // and have attribute uniquemember: uid=foruser,ldapbase.

        SearchControls ctls = new SearchControls();

        ctls.setReturningAttributes(attrIDs);

        ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

        String filter = null;

        String gfilter = "(objectClass=groupOfUniqueNames)";

        if (null == foruser) {

            filter = gfilter;

        } else {

            filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

        }

        NamingEnumeration enum = ctx.search(ldapBase, filter, ctls);

        // Print the groups

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          uvec.add(sr.getName()+","+ldapBase);

        }

        // initialize groups[] and fill it

        groups = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          groups[i] = (String)uvec.elementAt(i); 

        }

        // Close the context when we're done

        ctx.close();

    } catch(ReferralException re) {

      System.out.println("caught a referral to " + re.toString());

      try

      {

        refExc = re;

        Thread t = new Thread(this);

        System.out.println("Starting thread...");

        t.start();

        System.out.println("sleeping for 5 seconds.");

        Thread.sleep(5000); //this is a manual override of ldap's hideously long time

                     //out period.

        System.out.println("Awake after 5 seconds.");

        if(referralContext == null)

        {

          System.out.println("killing thread....returning null.");

          t.interrupt();

          System.out.println("thread killed.");

          return null;

        }

        DirContext dc = (DirContext)referralContext;

        String[] attrIDs = {"cn"};

        // Specify the attributes to match.

        // Groups are objects with attribute objectclass=groupofuniquenames.

        // and have attribute uniquemember: uid=foruser,ldapbase.

        SearchControls ctls = new SearchControls();

        ctls.setReturningAttributes(attrIDs);

        ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

        String filter = null;

        String gfilter = "(objectClass=groupOfUniqueNames)";

        if (null == foruser) {

            filter = gfilter;

        } else {

            filter = "(& " + gfilter + "(uniqueMember=" + foruser + "))";

        }

        NamingEnumeration enum = dc.search(ldapBase, filter, ctls);

        // Print the groups

        Vector uvec = new Vector();

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          uvec.add(sr.getName()+","+ldapBase);

        }

        // initialize groups[] and fill it

        groups = new String[uvec.size()];

        for (int i=0; i < uvec.size(); i++) {

          groups[i] = (String)uvec.elementAt(i); 

        }

        referralContext.close();

        dc.close();

      }

      catch(Exception e)

      {

        System.out.println("returning groups as null");

        return groups;

      }

    } catch (NamingException e) {

      System.err.println("Problem getting groups in AuthLdap.getGroups 2:" + e);

      e.printStackTrace(System.err);

      throw new ConnectException(

      "Problem getting groups for a user in AuthLdap.getGroups:" + e);

    } 

    return groups;

  }

  /**

   * Get attributes describing a user or group

   *

   * @param foruser the user for which the attribute list is requested

   * @returns HashMap a map of attribute name to a Vector of values

   */

  public HashMap getAttributes(String foruser) 

         throws ConnectException

  {

    return getAttributes(null, null, foruser);

  }

  /**

   * Get attributes describing a user or group

   *

   * @param user the user for authenticating against the service

   * @param password the password for authenticating against the service

   * @param foruser the user whose attributes should be returned

   * @returns HashMap a map of attribute name to a Vector of values

   */

  public HashMap getAttributes(String user, String password, String foruser) 

         throws ConnectException

  {

    HashMap attributes = new HashMap();

    String ldapUrl = this.ldapUrl;

    String ldapBase = this.ldapBase;

    String userident = foruser;

    /*

    try { 

      this.ldapBase = userident.substring(userident.indexOf(",")+1);

      userident = userident.substring(0,userident.indexOf(","));

    } catch (StringIndexOutOfBoundsException e) {}

*/

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

        "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl);

    try {

      // Create the initial directory context

      DirContext ctx = new InitialDirContext(env);

      // Find out the identifying attribute for the user

      //userident = getIdentifyingName(userident,ldapUrl,ldapBase);

      // Ask for all attributes of the user 

      //Attributes attrs = ctx.getAttributes(userident);

      Attributes attrs = ctx.getAttributes(foruser);

      // Print all of the attributes

      NamingEnumeration en = attrs.getAll();

      while (en.hasMore()) {

        Attribute att = (Attribute)en.next();

        Vector values = new Vector();

        String attName = att.getID();

        NamingEnumeration attvalues = att.getAll();

        while (attvalues.hasMore()) {

          String value = (String)attvalues.next();

          values.add(value);

        }

        attributes.put(attName, values);

      }

      // Close the context when we're done

      ctx.close();

    } catch (NamingException e) {

      System.err.println("Problem getting attributes in " + 

              "AuthLdap.getAttributes:" + e);

      throw new ConnectException(

      "Problem getting attributes in AuthLdap.getAttributes:" + e);

    }

    return attributes;

  }

  /**

   * Get list of all subtrees holding Metacat's groups and users

   * starting from the Metacat LDAP root, 

   * i.e. ldap://dev.nceas.ucsb.edu/dc=ecoinformatics,dc=org

   */

  private Hashtable getSubtrees(String user, String password,

                                String ldapUrl, String ldapBase)

                throws ConnectException

  {

    Hashtable trees = new Hashtable();

    // Identify service provider to use

    Hashtable env = new Hashtable(11);

    env.put(Context.INITIAL_CONTEXT_FACTORY, 

            "com.sun.jndi.ldap.LdapCtxFactory");

    env.put(Context.REFERRAL, referral);

    env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);

    try {

        // Create the initial directory context

        DirContext ctx = new InitialDirContext(env);

        // Specify the ids of the attributes to return

        String[] attrIDs = {"o","ref"};

        SearchControls ctls = new SearchControls();

        ctls.setReturningAttributes(attrIDs);

        ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

        // Specify the attributes to match.

        // Subtrees from the main server are found as objects with attribute

        // objectclass=organization or objectclass=referral to the subtree

        // resided on other server.

        String filter = "(|(objectclass=organization)(objectclass=referral))";

        // Search for objects in the current context

        NamingEnumeration enum = ctx.search("", filter, ctls);

        // Print the subtrees' <ldapURL, baseDN>

        while (enum.hasMore()) {

          SearchResult sr = (SearchResult)enum.next();

          Attributes attrs = sr.getAttributes();

          NamingEnumeration enum1 = attrs.getAll(); // "dc" and "ref" attrs

          if (enum1.hasMore()) {

            Attribute attr = (Attribute)enum1.next();

            String attrValue = (String)attr.get();

            String attrName = (String)attr.getID();

            //System.out.println(attrName + "=" + attrValue);

            if ( enum1.hasMore() ) {

              attr = (Attribute)enum1.next();

              String refValue = (String)attr.get();

              String refName = (String)attr.getID();

              //System.out.println(refName + "=" + refValue);

              if ( ldapBase.startsWith(refName + "=" + refValue) ) {

                trees.put(ldapBase,

                          attrValue.substring(0,attrValue.lastIndexOf("/")+1) );

              } else {

                trees.put(refName + "=" + refValue + "," + ldapBase,

                          attrValue.substring(0,attrValue.lastIndexOf("/")+1) );

              }

              //System.out.println("REFERRAL:" + attrValue);

            } else if ( ldapBase.startsWith(attrName + "=" + attrValue) ) {

                trees.put(ldapBase, ldapUrl);

            } else {              

                trees.put(attrName + "=" + attrValue + "," + ldapBase, ldapUrl);

                //System.out.println(ldapUrl + attrName + "=" + attrValue + "," + ldapBase);

            }

          }

        }

        // Close the context when we're done

        ctx.close();

    } catch (NamingException e) {

      System.err.println("Problem getting subtrees in AuthLdap.getSubtrees:" + e);

      throw new ConnectException(

      "Problem getting subtrees in AuthLdap.getSubtrees:" + e);

    }

    //System.out.println("number of subtrees:" + trees.size());

    return trees;

  }

  /**

   * Get all groups and users from authentication scheme.

   * The output is formatted in XML.

   * @param user the user which requests the information

   * @param password the user's password

   */

  public String getPrincipals(String user, String password)

                throws ConnectException

  {

    StringBuffer out = new StringBuffer();

    Vector usersIn = new Vector();

    out.append("<?xml version=\"1.0\"?>\n");

    out.append("<principals>\n");

    /*

     * get all subtrees first in the current dir context 

     * and then the Metacat users under them

     */

    Hashtable subtrees = getSubtrees(user,password,this.ldapUrl,this.ldapBase);

    Enumeration enum = subtrees.keys();

    while ( enum.hasMoreElements() ) {

      this.ldapBase = (String)enum.nextElement();

      this.ldapUrl = (String)subtrees.get(ldapBase);

      out.append("  <authSystem URI=\"" + 

                 this.ldapUrl + this.ldapBase + "\">\n");

      // get all groups for directory context

      String[] groups = getGroups(user, password);

      // for the groups and users that belong to them

      if ( groups.length > 0 ) {

        for (int i=0; i < groups.length; i++ ) {

          out.append("    <group>\n");

          out.append("      <groupname>" + groups[i] + "</groupname>\n");

          String[] usersForGroup = getUsers(user,password,groups[i]);

          for (int j=0; j < usersForGroup.length; j++ ) {

            usersIn.addElement(usersForGroup[j]);