Examples with Authenticator org.ldaptive.auth.Authenticator used on opensource projects

Example 6 with Authenticator

use of org.ldaptive.auth.Authenticator in project cas by apereo.

the class Beans method getSaslAuthenticator.

private static Authenticator getSaslAuthenticator(final AbstractLdapAuthenticationProperties l) {
    if (StringUtils.isBlank(l.getUserFilter())) {
        throw new IllegalArgumentException("User filter cannot be empty/blank for sasl authentication");
    }
    final PooledConnectionFactory connectionFactoryForSearch = Beans.newLdaptivePooledConnectionFactory(l);
    final PooledSearchDnResolver resolver = new PooledSearchDnResolver();
    resolver.setBaseDn(l.getBaseDn());
    resolver.setSubtreeSearch(l.isSubtreeSearch());
    resolver.setAllowMultipleDns(l.isAllowMultipleDns());
    resolver.setConnectionFactory(connectionFactoryForSearch);
    resolver.setUserFilter(l.getUserFilter());
    return new Authenticator(resolver, getPooledBindAuthenticationHandler(l, Beans.newLdaptivePooledConnectionFactory(l)));
}

Example 7 with Authenticator

use of org.ldaptive.auth.Authenticator in project cas by apereo.

the class Beans method getDirectBindAuthenticator.

private static Authenticator getDirectBindAuthenticator(final AbstractLdapAuthenticationProperties l) {
    if (StringUtils.isBlank(l.getDnFormat())) {
        throw new IllegalArgumentException("Dn format cannot be empty/blank for direct bind authentication");
    }
    final FormatDnResolver resolver = new FormatDnResolver(l.getDnFormat());
    final Authenticator authenticator = new Authenticator(resolver, getPooledBindAuthenticationHandler(l, Beans.newLdaptivePooledConnectionFactory(l)));
    if (l.isEnhanceWithEntryResolver()) {
        authenticator.setEntryResolver(Beans.newLdaptiveSearchEntryResolver(l, Beans.newLdaptivePooledConnectionFactory(l)));
    }
    return authenticator;
}

Example 8 with Authenticator

use of org.ldaptive.auth.Authenticator in project cas by apereo.

the class LdapAuthenticationConfiguration method ldapAuthenticationHandlers.

@Bean
public Collection<AuthenticationHandler> ldapAuthenticationHandlers() {
    final Collection<AuthenticationHandler> handlers = new HashSet<>();
    casProperties.getAuthn().getLdap().stream().filter(ldapInstanceConfigurationPredicate()).forEach(l -> {
        final Multimap<String, Object> multiMapAttributes = CoreAuthenticationUtils.transformPrincipalAttributesListIntoMultiMap(l.getPrincipalAttributeList());
        LOGGER.debug("Created and mapped principal attributes [{}] for [{}]...", multiMapAttributes, l.getLdapUrl());
        LOGGER.debug("Creating LDAP authenticator for [{}] and baseDn [{}]", l.getLdapUrl(), l.getBaseDn());
        final Authenticator authenticator = LdapUtils.newLdaptiveAuthenticator(l);
        LOGGER.debug("Ldap authenticator configured with return attributes [{}] for [{}] and baseDn [{}]", multiMapAttributes.keySet(), l.getLdapUrl(), l.getBaseDn());
        LOGGER.debug("Creating LDAP password policy handling strategy for [{}]", l.getLdapUrl());
        final LdapPasswordPolicyHandlingStrategy strategy = createLdapPasswordPolicyHandlingStrategy(l);
        LOGGER.debug("Creating LDAP authentication handler for [{}]", l.getLdapUrl());
        final LdapAuthenticationHandler handler = new LdapAuthenticationHandler(l.getName(), servicesManager, ldapPrincipalFactory(), l.getOrder(), authenticator, strategy);
        handler.setCollectDnAttribute(l.isCollectDnAttribute());
        final List<String> additionalAttributes = l.getAdditionalAttributes();
        if (StringUtils.isNotBlank(l.getPrincipalAttributeId())) {
            additionalAttributes.add(l.getPrincipalAttributeId());
        }
        if (StringUtils.isNotBlank(l.getPrincipalDnAttributeName())) {
            handler.setPrincipalDnAttributeName(l.getPrincipalDnAttributeName());
        }
        handler.setAllowMultiplePrincipalAttributeValues(l.isAllowMultiplePrincipalAttributeValues());
        handler.setAllowMissingPrincipalAttributeValue(l.isAllowMissingPrincipalAttributeValue());
        handler.setPasswordEncoder(PasswordEncoderUtils.newPasswordEncoder(l.getPasswordEncoder()));
        handler.setPrincipalNameTransformer(PrincipalNameTransformerUtils.newPrincipalNameTransformer(l.getPrincipalTransformation()));
        if (StringUtils.isNotBlank(l.getCredentialCriteria())) {
            LOGGER.debug("Ldap authentication for [{}] is filtering credentials by [{}]", l.getLdapUrl(), l.getCredentialCriteria());
            handler.setCredentialSelectionPredicate(CoreAuthenticationUtils.newCredentialSelectionPredicate(l.getCredentialCriteria()));
        }
        if (StringUtils.isBlank(l.getPrincipalAttributeId())) {
            LOGGER.debug("No principal id attribute is found for LDAP authentication via [{}]", l.getLdapUrl());
        } else {
            handler.setPrincipalIdAttribute(l.getPrincipalAttributeId());
            LOGGER.debug("Using principal id attribute [{}] for LDAP authentication via [{}]", l.getPrincipalAttributeId(), l.getLdapUrl());
        }
        if (l.getPasswordPolicy().isEnabled()) {
            LOGGER.debug("Password policy is enabled for [{}]. Constructing password policy configuration", l.getLdapUrl());
            final LdapPasswordPolicyConfiguration cfg = createLdapPasswordPolicyConfiguration(l, authenticator, multiMapAttributes);
            handler.setPasswordPolicyConfiguration(cfg);
        }
        final Map<String, Object> attributes = CollectionUtils.wrap(multiMapAttributes);
        handler.setPrincipalAttributeMap(attributes);
        LOGGER.debug("Initializing LDAP authentication handler for [{}]", l.getLdapUrl());
        handler.initialize();
        handlers.add(handler);
    });
    return handlers;
}

Example 9 with Authenticator

use of org.ldaptive.auth.Authenticator in project cas by apereo.

the class LdapUtils method getActiveDirectoryAuthenticator.

private static Authenticator getActiveDirectoryAuthenticator(final AbstractLdapAuthenticationProperties l) {
    if (StringUtils.isBlank(l.getDnFormat())) {
        throw new IllegalArgumentException("Dn format cannot be empty/blank for active directory authentication");
    }
    final FormatDnResolver resolver = new FormatDnResolver(l.getDnFormat());
    final Authenticator authn = new Authenticator(resolver, getPooledBindAuthenticationHandler(l, newLdaptivePooledConnectionFactory(l)));
    if (l.isEnhanceWithEntryResolver()) {
        authn.setEntryResolver(newLdaptiveSearchEntryResolver(l, newLdaptivePooledConnectionFactory(l)));
    }
    return authn;
}

Example 10 with Authenticator

use of org.ldaptive.auth.Authenticator in project cas by apereo.

the class LdapAuthenticationProvider method authenticate.

@Override
public Authentication authenticate(final Authentication authentication) throws AuthenticationException {
    try {
        final String username = authentication.getPrincipal().toString();
        final Object credentials = authentication.getCredentials();
        final String password = credentials == null ? null : credentials.toString();
        LOGGER.debug("Preparing LDAP authentication request for user [{}]", username);
        final AuthenticationRequest request = new AuthenticationRequest(username, new org.ldaptive.Credential(password), ReturnAttributes.ALL.value());
        final Authenticator authenticator = LdapUtils.newLdaptiveAuthenticator(adminPagesSecurityProperties.getLdap());
        LOGGER.debug("Executing LDAP authentication request for user [{}]", username);
        final AuthenticationResponse response = authenticator.authenticate(request);
        LOGGER.debug("LDAP response: [{}]", response);
        if (response.getResult()) {
            final LdapEntry entry = response.getLdapEntry();
            final CommonProfile profile = new CommonProfile();
            profile.setId(username);
            entry.getAttributes().forEach(a -> profile.addAttribute(a.getName(), a.getStringValues()));
            LOGGER.debug("Collected user profile [{}]", profile);
            this.authorizationGenerator.generate(Pac4jUtils.getPac4jJ2EContext(), profile);
            LOGGER.debug("Assembled user profile with roles after generating authorization claims [{}]", profile);
            final Collection<GrantedAuthority> authorities = new ArrayList<>();
            authorities.addAll(profile.getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()));
            LOGGER.debug("List of authorities remapped from profile roles are [{}]", authorities);
            final RequireAnyRoleAuthorizer authorizer = new RequireAnyRoleAuthorizer(adminPagesSecurityProperties.getAdminRoles());
            LOGGER.debug("Executing authorization for expected admin roles [{}]", authorizer.getElements());
            final J2EContext context = Pac4jUtils.getPac4jJ2EContext();
            if (authorizer.isAllAuthorized(context, CollectionUtils.wrap(profile))) {
                return new UsernamePasswordAuthenticationToken(username, password, authorities);
            }
            LOGGER.warn("User [{}] is not authorized to access the requested resource allowed to roles [{}]", username, authorizer.getElements());
        } else {
            LOGGER.warn("LDAP authentication response produced no results for [{}]", username);
        }
    } catch (final Exception e) {
        LOGGER.error(e.getMessage(), e);
        throw new InsufficientAuthenticationException("Unexpected LDAP error", e);
    }
    throw new BadCredentialsException("Could not authenticate provided credentials");
}