Examples with LdapSettings org.graylog2.shared.security.ldap.LdapSettings used on opensource projects

Example 6 with LdapSettings

use of org.graylog2.shared.security.ldap.LdapSettings in project graylog2-server by Graylog2.

the class LdapUserAuthenticator method doGetAuthenticationInfo.

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authtoken) throws AuthenticationException {
    // safe, we only handle this type
    final UsernamePasswordToken token = (UsernamePasswordToken) authtoken;
    final LdapSettings ldapSettings = ldapSettingsService.load();
    if (ldapSettings == null || !ldapSettings.isEnabled()) {
        LOG.trace("LDAP is disabled, skipping");
        return null;
    }
    final LdapConnectionConfig config = new LdapConnectionConfig();
    config.setLdapHost(ldapSettings.getUri().getHost());
    config.setLdapPort(ldapSettings.getUri().getPort());
    config.setUseSsl(ldapSettings.getUri().getScheme().startsWith("ldaps"));
    config.setUseTls(ldapSettings.isUseStartTls());
    if (ldapSettings.isTrustAllCertificates()) {
        config.setTrustManagers(new TrustAllX509TrustManager());
    }
    config.setName(ldapSettings.getSystemUserName());
    config.setCredentials(ldapSettings.getSystemPassword());
    final String principal = (String) token.getPrincipal();
    final char[] tokenPassword = firstNonNull(token.getPassword(), new char[0]);
    final String password = String.valueOf(tokenPassword);
    // do not try to look a token up in LDAP if there is no principal or password
    if (isNullOrEmpty(principal) || isNullOrEmpty(password)) {
        LOG.debug("Principal or password were empty. Not trying to look up a token in LDAP.");
        return null;
    }
    try (final LdapNetworkConnection connection = ldapConnector.connect(config)) {
        if (null == connection) {
            LOG.error("Couldn't connect to LDAP directory");
            return null;
        }
        final LdapEntry userEntry = ldapConnector.search(connection, ldapSettings.getSearchBase(), ldapSettings.getSearchPattern(), ldapSettings.getDisplayNameAttribute(), principal, ldapSettings.isActiveDirectory(), ldapSettings.getGroupSearchBase(), ldapSettings.getGroupIdAttribute(), ldapSettings.getGroupSearchPattern());
        if (userEntry == null) {
            LOG.debug("User {} not found in LDAP", principal);
            return null;
        }
        // needs to use the DN of the entry, not the parameter for the lookup filter we used to find the entry!
        final boolean authenticated = ldapConnector.authenticate(connection, userEntry.getDn(), password);
        if (!authenticated) {
            LOG.info("Invalid credentials for user {} (DN {})", principal, userEntry.getDn());
            return null;
        }
        // user found and authenticated, sync the user entry with mongodb
        final User user = syncFromLdapEntry(userEntry, ldapSettings, principal);
        if (user == null) {
            // in case there was an error reading, creating or modifying the user in mongodb, we do not authenticate the user.
            LOG.error("Unable to sync LDAP user {} (DN {})", userEntry.getBindPrincipal(), userEntry.getDn());
            return null;
        }
        return new SimpleAccount(principal, null, "ldap realm");
    } catch (LdapException e) {
        LOG.error("LDAP error", e);
    } catch (CursorException e) {
        LOG.error("Unable to read LDAP entry", e);
    } catch (Exception e) {
        LOG.error("Error during LDAP user account sync. Cannot log in user {}", principal, e);
    }
    // Return null by default to ensure a login failure if anything goes wrong.
    return null;
}

Example 7 with LdapSettings

use of org.graylog2.shared.security.ldap.LdapSettings in project graylog2-server by Graylog2.

the class LdapUserAuthenticator method syncFromLdapEntry.

@Nullable
@VisibleForTesting
User syncFromLdapEntry(LdapEntry userEntry, LdapSettings ldapSettings, String username) {
    User user = userService.load(username);
    // create new user object if necessary
    if (user == null) {
        user = userService.create();
    }
    // update user attributes from ldap entry
    updateFromLdap(user, userEntry, ldapSettings, username);
    try {
        userService.save(user);
    } catch (ValidationException e) {
        LOG.error("Cannot save user.", e);
        return null;
    }
    return user;
}

Example 8 with LdapSettings

use of org.graylog2.shared.security.ldap.LdapSettings in project graylog2-server by Graylog2.

the class LdapResource method readGroups.

@GET
@ApiOperation(value = "Get the available LDAP groups", notes = "")
@RequiresPermissions(RestPermissions.LDAPGROUPS_READ)
@Path("/groups")
@Produces(MediaType.APPLICATION_JSON)
public Set<String> readGroups() {
    final LdapSettings ldapSettings = firstNonNull(ldapSettingsService.load(), ldapSettingsFactory.createEmpty());
    if (!ldapSettings.isEnabled()) {
        throw new BadRequestException("LDAP is disabled.");
    }
    if (isNullOrEmpty(ldapSettings.getGroupSearchBase()) || isNullOrEmpty(ldapSettings.getGroupIdAttribute())) {
        throw new BadRequestException("LDAP group configuration settings are not set.");
    }
    final LdapConnectionConfig config = new LdapConnectionConfig();
    final URI ldapUri = ldapSettings.getUri();
    config.setLdapHost(ldapUri.getHost());
    config.setLdapPort(ldapUri.getPort());
    config.setUseSsl(ldapUri.getScheme().startsWith("ldaps"));
    config.setUseTls(ldapSettings.isUseStartTls());
    if (ldapSettings.isTrustAllCertificates()) {
        config.setTrustManagers(new TrustAllX509TrustManager());
    }
    if (!isNullOrEmpty(ldapSettings.getSystemUserName()) && !isNullOrEmpty(ldapSettings.getSystemPassword())) {
        config.setName(ldapSettings.getSystemUserName());
        config.setCredentials(ldapSettings.getSystemPassword());
    }
    try (LdapNetworkConnection connection = ldapConnector.connect(config)) {
        return ldapConnector.listGroups(connection, ldapSettings.getGroupSearchBase(), ldapSettings.getGroupSearchPattern(), ldapSettings.getGroupIdAttribute());
    } catch (IOException | LdapException e) {
        LOG.error("Unable to retrieve available LDAP groups", e);
        throw new InternalServerErrorException("Unable to retrieve available LDAP groups", e);
    }
}

Example 9 with LdapSettings

use of org.graylog2.shared.security.ldap.LdapSettings in project graylog2-server by Graylog2.

the class LdapResource method updateLdapSettings.

@PUT
@Timed
@RequiresPermissions(RestPermissions.LDAP_EDIT)
@ApiOperation("Update the LDAP configuration")
@Path("/settings")
@Consumes(MediaType.APPLICATION_JSON)
@AuditEvent(type = AuditEventTypes.LDAP_CONFIGURATION_UPDATE)
public void updateLdapSettings(@ApiParam(name = "JSON body", required = true) @Valid @NotNull LdapSettingsRequest request) throws ValidationException {
    // load the existing config, or create a new one. we only support having one, currently
    final LdapSettings ldapSettings = firstNonNull(ldapSettingsService.load(), ldapSettingsFactory.createEmpty());
    ldapSettings.setSystemUsername(request.systemUsername());
    ldapSettings.setSystemPassword(request.systemPassword());
    ldapSettings.setUri(request.ldapUri());
    ldapSettings.setUseStartTls(request.useStartTls());
    ldapSettings.setTrustAllCertificates(request.trustAllCertificates());
    ldapSettings.setActiveDirectory(request.activeDirectory());
    ldapSettings.setSearchPattern(request.searchPattern());
    ldapSettings.setSearchBase(request.searchBase());
    ldapSettings.setEnabled(request.enabled());
    ldapSettings.setDisplayNameAttribute(request.displayNameAttribute());
    ldapSettings.setDefaultGroup(request.defaultGroup());
    ldapSettings.setGroupMapping(request.groupMapping());
    ldapSettings.setGroupSearchBase(request.groupSearchBase());
    ldapSettings.setGroupIdAttribute(request.groupIdAttribute());
    ldapSettings.setGroupSearchPattern(request.groupSearchPattern());
    ldapSettings.setAdditionalDefaultGroups(request.additionalDefaultGroups());
    ldapSettingsService.save(ldapSettings);
}

Example 10 with LdapSettings

use of org.graylog2.shared.security.ldap.LdapSettings in project graylog2-server by Graylog2.

the class LdapSettingsServiceImplTest method loadReturnsLdapSettings.

@Test
@UsingDataSet(loadStrategy = LoadStrategyEnum.CLEAN_INSERT)
public void loadReturnsLdapSettings() throws Exception {
    final LdapSettings ldapSettings = ldapSettingsService.load();
    assertThat(ldapSettings).isNotNull();
    assertThat(ldapSettings.getId()).isEqualTo("54e3deadbeefdeadbeefaffe");
    assertThat(ldapSettings.getUri()).isEqualTo(URI.create("ldap://localhost:389"));
    assertThat(ldapSettings.getSystemPassword()).isEqualTo("password");
}