Examples with JiveInitialLdapContext org.jivesoftware.util.JiveInitialLdapContext used on opensource projects

Example 1 with JiveInitialLdapContext

use of org.jivesoftware.util.JiveInitialLdapContext in project Openfire by igniterealtime.

the class LdapManager method getContext.

/**
     * Returns a DirContext for the LDAP server that can be used to perform
     * lookups and searches using the specified base DN. The context uses the
     * admin login that is defined by <tt>adminDN</tt> and <tt>adminPassword</tt>.
     *
     * @param baseDN the base DN to use for the context.
     * @return a connection to the LDAP server.
     * @throws NamingException if there is an error making the LDAP connection.
     */
public LdapContext getContext(String baseDN) throws NamingException {
    boolean debug = Log.isDebugEnabled();
    if (debug) {
        Log.debug("LdapManager: Creating a DirContext in LdapManager.getContext()...");
        if (!sslEnabled && !startTlsEnabled) {
            Log.debug("LdapManager: Warning: Using unencrypted connection to LDAP service!");
        }
    }
    // Set up the environment for creating the initial context
    Hashtable<String, Object> env = new Hashtable<>();
    env.put(Context.INITIAL_CONTEXT_FACTORY, initialContextFactory);
    env.put(Context.PROVIDER_URL, getProviderURL(baseDN));
    // SSL
    if (sslEnabled) {
        env.put("java.naming.ldap.factory.socket", "org.jivesoftware.util.SimpleSSLSocketFactory");
        env.put(Context.SECURITY_PROTOCOL, "ssl");
    }
    // Use simple authentication to connect as the admin.
    if (adminDN != null) {
        /* If startTLS is requested we MUST NOT bind() before
             * the secure connection has been established. */
        if (!(startTlsEnabled && !sslEnabled)) {
            env.put(Context.SECURITY_AUTHENTICATION, "simple");
            env.put(Context.SECURITY_PRINCIPAL, adminDN);
            if (adminPassword != null) {
                env.put(Context.SECURITY_CREDENTIALS, adminPassword);
            }
        }
    } else // No login information so attempt to use anonymous login.
    {
        env.put(Context.SECURITY_AUTHENTICATION, "none");
    }
    if (ldapDebugEnabled) {
        env.put("com.sun.jndi.ldap.trace.ber", System.err);
    }
    if (connectionPoolEnabled) {
        if (!startTlsEnabled) {
            env.put("com.sun.jndi.ldap.connect.pool", "true");
            System.setProperty("com.sun.jndi.ldap.connect.pool.protocol", "plain ssl");
        } else {
            if (debug) {
                // See http://java.sun.com/products/jndi/tutorial/ldap/connect/pool.html
                // "When Not to Use Pooling"
                Log.debug("LdapManager: connection pooling was requested but has been disabled because of StartTLS.");
            }
            env.put("com.sun.jndi.ldap.connect.pool", "false");
        }
    } else {
        env.put("com.sun.jndi.ldap.connect.pool", "false");
    }
    if (connTimeout > 0) {
        env.put("com.sun.jndi.ldap.connect.timeout", String.valueOf(connTimeout));
    } else {
        env.put("com.sun.jndi.ldap.connect.timeout", "10000");
    }
    if (readTimeout > 0) {
        env.put("com.sun.jndi.ldap.read.timeout", String.valueOf(readTimeout));
    }
    if (followReferrals) {
        env.put(Context.REFERRAL, "follow");
    }
    if (!followAliasReferrals) {
        env.put("java.naming.ldap.derefAliases", "never");
    }
    if (debug) {
        Log.debug("LdapManager: Created hashtable with context values, attempting to create context...");
    }
    // Create new initial context
    JiveInitialLdapContext context = new JiveInitialLdapContext(env, null);
    // TLS http://www.ietf.org/rfc/rfc2830.txt ("1.3.6.1.4.1.1466.20037")
    if (startTlsEnabled && !sslEnabled) {
        if (debug) {
            Log.debug("LdapManager: ... StartTlsRequest");
        }
        if (followReferrals) {
            Log.warn("\tConnections to referrals are unencrypted! If you do not want this, please turn off ldap.autoFollowReferrals");
        }
        // Perform a StartTLS extended operation
        StartTlsResponse tls = (StartTlsResponse) context.extendedOperation(new StartTlsRequest());
        /* Open a TLS connection (over the existing LDAP association) and
               get details of the negotiated TLS session: cipher suite,
               peer certificate, etc. */
        try {
            SSLSession session = tls.negotiate(new org.jivesoftware.util.SimpleSSLSocketFactory());
            context.setTlsResponse(tls);
            context.setSslSession(session);
            if (debug) {
                Log.debug("LdapManager: ... peer host: " + session.getPeerHost() + ", CipherSuite: " + session.getCipherSuite());
            }
            /* Set login credentials only if SSL session has been
                 * negotiated successfully - otherwise user/password
                 * could be transmitted in clear text. */
            if (adminDN != null) {
                context.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");
                context.addToEnvironment(Context.SECURITY_PRINCIPAL, adminDN);
                if (adminPassword != null) {
                    context.addToEnvironment(Context.SECURITY_CREDENTIALS, adminPassword);
                }
            }
        } catch (java.io.IOException ex) {
            Log.error(ex.getMessage(), ex);
        }
    }
    if (debug) {
        Log.debug("LdapManager: ... context created successfully, returning.");
    }
    return context;
}

Example 2 with JiveInitialLdapContext

use of org.jivesoftware.util.JiveInitialLdapContext in project Openfire by igniterealtime.

the class LdapManager method checkAuthentication.

/**
     * Returns true if the user is able to successfully authenticate against
     * the LDAP server. The "simple" authentication protocol is used.
     *
     * @param userDN the user's dn to authenticate (relative to <tt>baseDN</tt>).
     * @param password the user's password.
     * @return true if the user successfully authenticates.
     */
public boolean checkAuthentication(String userDN, String password) {
    boolean debug = Log.isDebugEnabled();
    if (debug) {
        Log.debug("LdapManager: In LdapManager.checkAuthentication(userDN, password), userDN is: " + userDN + "...");
        if (!sslEnabled && !startTlsEnabled) {
            Log.debug("LdapManager: Warning: Using unencrypted connection to LDAP service!");
        }
    }
    JiveInitialLdapContext ctx = null;
    try {
        // See if the user authenticates.
        Hashtable<String, Object> env = new Hashtable<>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, initialContextFactory);
        env.put(Context.PROVIDER_URL, getProviderURL(baseDN));
        if (sslEnabled) {
            env.put("java.naming.ldap.factory.socket", "org.jivesoftware.util.SimpleSSLSocketFactory");
            env.put(Context.SECURITY_PROTOCOL, "ssl");
        }
        /* If startTLS is requested we MUST NOT bind() before
             * the secure connection has been established. */
        if (!(startTlsEnabled && !sslEnabled)) {
            env.put(Context.SECURITY_AUTHENTICATION, "simple");
            env.put(Context.SECURITY_PRINCIPAL, userDN + "," + baseDN);
            env.put(Context.SECURITY_CREDENTIALS, password);
        } else {
            if (followReferrals) {
                Log.warn("\tConnections to referrals are unencrypted! If you do not want this, please turn off ldap.autoFollowReferrals");
            }
        }
        if (connTimeout > 0) {
            env.put("com.sun.jndi.ldap.connect.timeout", String.valueOf(connTimeout));
        } else {
            env.put("com.sun.jndi.ldap.connect.timeout", "10000");
        }
        if (readTimeout > 0) {
            env.put("com.sun.jndi.ldap.read.timeout", String.valueOf(readTimeout));
        }
        if (ldapDebugEnabled) {
            env.put("com.sun.jndi.ldap.trace.ber", System.err);
        }
        if (followReferrals) {
            env.put(Context.REFERRAL, "follow");
        }
        if (!followAliasReferrals) {
            env.put("java.naming.ldap.derefAliases", "never");
        }
        if (debug) {
            Log.debug("LdapManager: Created context values, attempting to create context...");
        }
        ctx = new JiveInitialLdapContext(env, null);
        if (startTlsEnabled && !sslEnabled) {
            if (debug) {
                Log.debug("LdapManager: ... StartTlsRequest");
            }
            // Perform a StartTLS extended operation
            StartTlsResponse tls = (StartTlsResponse) ctx.extendedOperation(new StartTlsRequest());
            /* Open a TLS connection (over the existing LDAP association) and
                   get details of the negotiated TLS session: cipher suite,
                   peer certificate, etc. */
            try {
                SSLSession session = tls.negotiate(new org.jivesoftware.util.SimpleSSLSocketFactory());
                ctx.setTlsResponse(tls);
                ctx.setSslSession(session);
                if (debug) {
                    Log.debug("LdapManager: ... peer host: " + session.getPeerHost() + ", CipherSuite: " + session.getCipherSuite());
                }
                ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");
                ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDN + "," + baseDN);
                ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);
            } catch (java.io.IOException ex) {
                Log.error(ex.getMessage(), ex);
            }
            // make at least one lookup to check authorization
            lookupExistence(ctx, userDN + "," + baseDN, new String[] { usernameField });
        }
        if (debug) {
            Log.debug("LdapManager: ... context created successfully, returning.");
        }
    } catch (NamingException ne) {
        // If an alt baseDN is defined, attempt a lookup there.
        if (alternateBaseDN != null) {
            try {
                if (ctx != null) {
                    ctx.close();
                }
            } catch (Exception e) {
                Log.error(e.getMessage(), e);
            }
            try {
                // See if the user authenticates.
                Hashtable<String, Object> env = new Hashtable<>();
                // Use a custom initial context factory if specified. Otherwise, use the default.
                env.put(Context.INITIAL_CONTEXT_FACTORY, initialContextFactory);
                env.put(Context.PROVIDER_URL, getProviderURL(alternateBaseDN));
                if (sslEnabled) {
                    env.put("java.naming.ldap.factory.socket", "org.jivesoftware.util.SimpleSSLSocketFactory");
                    env.put(Context.SECURITY_PROTOCOL, "ssl");
                }
                /* If startTLS is requested we MUST NOT bind() before
                     * the secure connection has been established. */
                if (!(startTlsEnabled && !sslEnabled)) {
                    env.put(Context.SECURITY_AUTHENTICATION, "simple");
                    env.put(Context.SECURITY_PRINCIPAL, userDN + "," + alternateBaseDN);
                    env.put(Context.SECURITY_CREDENTIALS, password);
                }
                env.put("com.sun.jndi.ldap.connect.timeout", "10000");
                if (ldapDebugEnabled) {
                    env.put("com.sun.jndi.ldap.trace.ber", System.err);
                }
                if (followReferrals) {
                    env.put(Context.REFERRAL, "follow");
                }
                if (!followAliasReferrals) {
                    env.put("java.naming.ldap.derefAliases", "never");
                }
                if (debug) {
                    Log.debug("LdapManager: Created context values, attempting to create context...");
                }
                ctx = new JiveInitialLdapContext(env, null);
                if (startTlsEnabled && !sslEnabled) {
                    if (debug) {
                        Log.debug("LdapManager: ... StartTlsRequest");
                    }
                    // Perform a StartTLS extended operation
                    StartTlsResponse tls = (StartTlsResponse) ctx.extendedOperation(new StartTlsRequest());
                    /* Open a TLS connection (over the existing LDAP association) and
                           get details of the negotiated TLS session: cipher suite,
                           peer certificate, etc. */
                    try {
                        SSLSession session = tls.negotiate(new org.jivesoftware.util.SimpleSSLSocketFactory());
                        ctx.setTlsResponse(tls);
                        ctx.setSslSession(session);
                        if (debug) {
                            Log.debug("LdapManager: ... peer host: " + session.getPeerHost() + ", CipherSuite: " + session.getCipherSuite());
                        }
                        ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");
                        ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDN + "," + alternateBaseDN);
                        ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);
                    } catch (java.io.IOException ex) {
                        Log.error(ex.getMessage(), ex);
                    }
                    // make at least one lookup to check user authorization
                    lookupExistence(ctx, userDN + "," + alternateBaseDN, new String[] { usernameField });
                }
            } catch (NamingException e) {
                if (debug) {
                    Log.debug("LdapManager: Caught a naming exception when creating InitialContext", ne);
                }
                return false;
            }
        } else {
            if (debug) {
                Log.debug("LdapManager: Caught a naming exception when creating InitialContext", ne);
            }
            return false;
        }
    } finally {
        try {
            if (ctx != null) {
                ctx.close();
            }
        } catch (Exception e) {
            Log.error(e.getMessage(), e);
        }
    }
    return true;
}