Examples with LdapEntry org.graylog2.shared.security.ldap.LdapEntry used on opensource projects

Example 6 with LdapEntry

use of org.graylog2.shared.security.ldap.LdapEntry in project graylog2-server by Graylog2.

the class LdapConnectorTest method testGroupOfUniqueNamesLookup.

@Test
public void testGroupOfUniqueNamesLookup() throws Exception {
    final LdapEntry entry = connector.search(connection, "ou=users,dc=example,dc=com", "(&(objectClass=posixAccount)(uid={0}))", "cn", "john", false, "ou=groups,dc=example,dc=com", "cn", "(objectClass=groupOfUniqueNames)");
    assertThat(entry).isNotNull();
    assertThat(entry.getDn()).isNotNull().isEqualTo("cn=John Doe,ou=users,dc=example,dc=com");
    assertThat(entry.getGroups()).hasSize(2).contains("Engineers", "Whitespace Engineers");
}

Example 7 with LdapEntry

use of org.graylog2.shared.security.ldap.LdapEntry in project graylog2-server by Graylog2.

the class LdapConnectorTest method testUserLookup.

@Test
public void testUserLookup() throws Exception {
    final LdapEntry entry = connector.search(connection, "ou=users,dc=example,dc=com", "(&(objectClass=posixAccount)(uid={0}))", "cn", "john", false, "ou=groups,dc=example,dc=com", "cn", "(|(objectClass=groupOfNames)(objectClass=posixGroup))");
    assertThat(entry).isNotNull();
    assertThat(entry.getDn()).isNotNull().isEqualTo("cn=John Doe,ou=users,dc=example,dc=com");
    assertThat(entry.getGroups()).hasSize(2).contains("QA", "Developers");
}

Example 8 with LdapEntry

use of org.graylog2.shared.security.ldap.LdapEntry in project graylog2-server by Graylog2.

the class LdapConnectorTest method testPosixGroupLookup.

@Test
public void testPosixGroupLookup() throws Exception {
    final LdapEntry entry = connector.search(connection, "ou=users,dc=example,dc=com", "(&(objectClass=posixAccount)(uid={0}))", "cn", "john", false, "ou=groups,dc=example,dc=com", "cn", "(objectClass=posixGroup)");
    assertThat(entry).isNotNull();
    assertThat(entry.getDn()).isNotNull().isEqualTo("cn=John Doe,ou=users,dc=example,dc=com");
    assertThat(entry.getGroups()).hasSize(1).contains("Developers");
}

Example 9 with LdapEntry

use of org.graylog2.shared.security.ldap.LdapEntry in project graylog2-server by Graylog2.

the class LdapUserAuthenticator method doGetAuthenticationInfo.

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authtoken) throws AuthenticationException {
    // safe, we only handle this type
    final UsernamePasswordToken token = (UsernamePasswordToken) authtoken;
    final LdapSettings ldapSettings = ldapSettingsService.load();
    if (ldapSettings == null || !ldapSettings.isEnabled()) {
        LOG.trace("LDAP is disabled, skipping");
        return null;
    }
    final LdapConnectionConfig config = new LdapConnectionConfig();
    config.setLdapHost(ldapSettings.getUri().getHost());
    config.setLdapPort(ldapSettings.getUri().getPort());
    config.setUseSsl(ldapSettings.getUri().getScheme().startsWith("ldaps"));
    config.setUseTls(ldapSettings.isUseStartTls());
    if (ldapSettings.isTrustAllCertificates()) {
        config.setTrustManagers(new TrustAllX509TrustManager());
    }
    config.setName(ldapSettings.getSystemUserName());
    config.setCredentials(ldapSettings.getSystemPassword());
    final String principal = (String) token.getPrincipal();
    final char[] tokenPassword = firstNonNull(token.getPassword(), new char[0]);
    final String password = String.valueOf(tokenPassword);
    // do not try to look a token up in LDAP if there is no principal or password
    if (isNullOrEmpty(principal) || isNullOrEmpty(password)) {
        LOG.debug("Principal or password were empty. Not trying to look up a token in LDAP.");
        return null;
    }
    try (final LdapNetworkConnection connection = ldapConnector.connect(config)) {
        if (null == connection) {
            LOG.error("Couldn't connect to LDAP directory");
            return null;
        }
        final LdapEntry userEntry = ldapConnector.search(connection, ldapSettings.getSearchBase(), ldapSettings.getSearchPattern(), ldapSettings.getDisplayNameAttribute(), principal, ldapSettings.isActiveDirectory(), ldapSettings.getGroupSearchBase(), ldapSettings.getGroupIdAttribute(), ldapSettings.getGroupSearchPattern());
        if (userEntry == null) {
            LOG.debug("User {} not found in LDAP", principal);
            return null;
        }
        // needs to use the DN of the entry, not the parameter for the lookup filter we used to find the entry!
        final boolean authenticated = ldapConnector.authenticate(connection, userEntry.getDn(), password);
        if (!authenticated) {
            LOG.info("Invalid credentials for user {} (DN {})", principal, userEntry.getDn());
            return null;
        }
        // user found and authenticated, sync the user entry with mongodb
        final User user = syncFromLdapEntry(userEntry, ldapSettings, principal);
        if (user == null) {
            // in case there was an error reading, creating or modifying the user in mongodb, we do not authenticate the user.
            LOG.error("Unable to sync LDAP user {} (DN {})", userEntry.getBindPrincipal(), userEntry.getDn());
            return null;
        }
        return new SimpleAccount(principal, null, "ldap realm");
    } catch (LdapException e) {
        LOG.error("LDAP error", e);
    } catch (CursorException e) {
        LOG.error("Unable to read LDAP entry", e);
    } catch (Exception e) {
        LOG.error("Error during LDAP user account sync. Cannot log in user {}", principal, e);
    }
    // Return null by default to ensure a login failure if anything goes wrong.
    return null;
}

Example 10 with LdapEntry

use of org.graylog2.shared.security.ldap.LdapEntry in project graylog2-server by Graylog2.

the class LdapUserAuthenticator method syncFromLdapEntry.

@Nullable
@VisibleForTesting
User syncFromLdapEntry(LdapEntry userEntry, LdapSettings ldapSettings, String username) {
    User user = userService.load(username);
    // create new user object if necessary
    if (user == null) {
        user = userService.create();
    }
    // update user attributes from ldap entry
    updateFromLdap(user, userEntry, ldapSettings, username);
    try {
        userService.save(user);
    } catch (ValidationException e) {
        LOG.error("Cannot save user.", e);
        return null;
    }
    return user;
}