Examples with ExternalIdentityException org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityException used on opensource projects

Example 1 with ExternalIdentityException

use of org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityException in project jackrabbit-oak by apache.

the class LdapIdentityProvider method getDeclaredGroupRefs.

//-----------------------------------------------------------< internal >---
/**
     * Collects the declared (direct) groups of an identity
     * @param ref reference to the identity
     * @return map of identities where the key is the DN of the LDAP entity
     */
Map<String, ExternalIdentityRef> getDeclaredGroupRefs(ExternalIdentityRef ref) throws ExternalIdentityException {
    if (!isMyRef(ref)) {
        return Collections.emptyMap();
    }
    String searchFilter = config.getMemberOfSearchFilter(ref.getId());
    LdapConnection connection = null;
    SearchCursor searchCursor = null;
    try {
        // Create the SearchRequest object
        SearchRequest req = new SearchRequestImpl();
        req.setScope(SearchScope.SUBTREE);
        String idAttribute = config.getGroupConfig().getIdAttribute();
        req.addAttributes(idAttribute == null ? SchemaConstants.NO_ATTRIBUTE : idAttribute);
        req.setTimeLimit((int) config.getSearchTimeout());
        req.setBase(new Dn(config.getGroupConfig().getBaseDN()));
        req.setFilter(searchFilter);
        if (log.isDebugEnabled()) {
            log.debug("getDeclaredGroupRefs: using SearchRequest {}.", req);
        }
        Map<String, ExternalIdentityRef> groups = new HashMap<String, ExternalIdentityRef>();
        DebugTimer timer = new DebugTimer();
        connection = connect();
        timer.mark("connect");
        searchCursor = connection.search(req);
        timer.mark("search");
        while (searchCursor.next()) {
            Response response = searchCursor.get();
            if (response instanceof SearchResultEntry) {
                Entry resultEntry = ((SearchResultEntry) response).getEntry();
                ExternalIdentityRef groupRef = new ExternalIdentityRef(resultEntry.getDn().toString(), this.getName());
                groups.put(groupRef.getId(), groupRef);
            }
        }
        timer.mark("iterate");
        if (log.isDebugEnabled()) {
            log.debug("getDeclaredGroupRefs: search below {} with {} found {} entries. {}", config.getGroupConfig().getBaseDN(), searchFilter, groups.size(), timer.getString());
        }
        return groups;
    } catch (Exception e) {
        log.error("Error during ldap membership search.", e);
        throw new ExternalIdentityException("Error during ldap membership search.", e);
    } finally {
        if (searchCursor != null) {
            try {
                searchCursor.close();
            } catch (IOException e) {
                log.warn("Failed to close search cursor.", e);
            }
        }
        disconnect(connection);
    }
}

Example 2 with ExternalIdentityException

use of org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityException in project jackrabbit-oak by apache.

the class LdapIdentityProvider method authenticate.

@Override
public ExternalUser authenticate(@Nonnull Credentials credentials) throws ExternalIdentityException, LoginException {
    if (!(credentials instanceof SimpleCredentials)) {
        log.debug("LDAP IDP can only authenticate SimpleCredentials.");
        return null;
    }
    final SimpleCredentials creds = (SimpleCredentials) credentials;
    final ExternalUser user = getUser(creds.getUserID());
    if (user != null) {
        // see http://tools.ietf.org/html/rfc4513#section-5.1.1 for details.
        if (creds.getPassword().length == 0) {
            throw new LoginException("Refusing to authenticate against LDAP server: Empty passwords not allowed.");
        }
        // authenticate
        LdapConnection connection = null;
        try {
            DebugTimer timer = new DebugTimer();
            if (userPool == null) {
                connection = userConnectionFactory.makeObject();
            } else {
                connection = userPool.getConnection();
            }
            timer.mark("connect");
            connection.bind(user.getExternalId().getId(), new String(creds.getPassword()));
            timer.mark("bind");
            if (log.isDebugEnabled()) {
                log.debug("authenticate({}) {}", user.getId(), timer.getString());
            }
        } catch (LdapAuthenticationException e) {
            throw new LoginException("Unable to authenticate against LDAP server: " + e.getMessage());
        } catch (Exception e) {
            throw new ExternalIdentityException("Error while binding user credentials", e);
        } finally {
            if (connection != null) {
                try {
                    if (userPool == null) {
                        userConnectionFactory.destroyObject(connection);
                    } else {
                        userPool.releaseConnection(connection);
                    }
                } catch (Exception e) {
                // ignore
                }
            }
        }
    }
    return user;
}

Example 3 with ExternalIdentityException

use of org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityException in project jackrabbit-oak by apache.

the class Delegatee method syncAllExternalUsers.

/**
     * @see SynchronizationMBean#syncAllExternalUsers()
     */
@Nonnull
String[] syncAllExternalUsers() {
    List<String> list = new ArrayList<String>();
    context.setForceGroupSync(true).setForceUserSync(true);
    try {
        List<SyncResult> results = new ArrayList<SyncResult>(batchSize);
        Iterator<ExternalUser> it = idp.listUsers();
        while (it.hasNext()) {
            ExternalUser user = it.next();
            results = syncUser(user, results, list);
        }
        commit(list, results, NO_BATCH_SIZE);
        return list.toArray(new String[list.size()]);
    } catch (ExternalIdentityException e) {
        throw new SyncRuntimeException("Unable to retrieve external users", e);
    }
}

Example 4 with ExternalIdentityException

use of org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityException in project jackrabbit-oak by apache.

the class Delegatee method syncExternalUsers.

/**
     * @see SynchronizationMBean#syncExternalUsers(String[])
     */
@Nonnull
String[] syncExternalUsers(@Nonnull String[] externalIds) {
    List<String> list = new ArrayList<String>();
    context.setForceGroupSync(true).setForceUserSync(true);
    List<SyncResult> results = new ArrayList<SyncResult>(batchSize);
    for (String externalId : externalIds) {
        ExternalIdentityRef ref = ExternalIdentityRef.fromString(externalId);
        if (!idp.getName().equals(ref.getProviderName())) {
            results.add(new DefaultSyncResultImpl(new DefaultSyncedIdentity(ref.getId(), ref, false, -1), SyncResult.Status.FOREIGN));
        } else {
            try {
                ExternalIdentity id = idp.getIdentity(ref);
                if (id != null) {
                    results = syncUser(id, results, list);
                } else {
                    results.add(new DefaultSyncResultImpl(new DefaultSyncedIdentity("", ref, false, -1), SyncResult.Status.NO_SUCH_IDENTITY));
                }
            } catch (ExternalIdentityException e) {
                log.warn("error while fetching the external identity {}", externalId, e);
                results.add(new ErrorSyncResult(ref, e));
            }
        }
    }
    commit(list, results, NO_BATCH_SIZE);
    return list.toArray(new String[list.size()]);
}

Example 5 with ExternalIdentityException

use of org.apache.jackrabbit.oak.spi.security.authentication.external.ExternalIdentityException in project jackrabbit-oak by apache.

the class LdapIdentityProvider method getDeclaredMemberRefs.

/**
     * Collects the declared (direct) members of a group
     * @param ref the reference to the group
     * @return map of identity refers
     * @throws ExternalIdentityException if an error occurs
     */
Map<String, ExternalIdentityRef> getDeclaredMemberRefs(ExternalIdentityRef ref) throws ExternalIdentityException {
    if (!isMyRef(ref)) {
        return Collections.emptyMap();
    }
    LdapConnection connection = null;
    try {
        Map<String, ExternalIdentityRef> members = new HashMap<String, ExternalIdentityRef>();
        DebugTimer timer = new DebugTimer();
        connection = connect();
        timer.mark("connect");
        Entry entry = connection.lookup(ref.getId());
        timer.mark("lookup");
        Attribute attr = entry.get(config.getGroupMemberAttribute());
        if (attr == null) {
            log.warn("LDAP group does not have configured attribute: {}", config.getGroupMemberAttribute());
        } else {
            for (Value value : attr) {
                ExternalIdentityRef memberRef = new ExternalIdentityRef(value.getString(), this.getName());
                members.put(memberRef.getId(), memberRef);
            }
        }
        timer.mark("iterate");
        if (log.isDebugEnabled()) {
            log.debug("members lookup of {} found {} members. {}", ref.getId(), members.size(), timer.getString());
        }
        return members;
    } catch (Exception e) {
        String msg = "Error during ldap group members lookup.";
        log.error(msg, e);
        throw new ExternalIdentityException(msg, e);
    } finally {
        disconnect(connection);
    }
}