Examples with AbstractContextMapper org.springframework.ldap.core.support.AbstractContextMapper used on opensource projects

Example 1 with AbstractContextMapper

use of org.springframework.ldap.core.support.AbstractContextMapper in project coprhd-controller by CoprHD.

the class ImmutableAuthenticationProviders method checkDirectoryType.

/**
 * Check directory type/vendor, supported LDAP versions,
 * and make sure configured mode matches with AD/LDAP server type
 *
 * @param template the ldap template to use
 * @param rootDSE the RootDSE object
 * @param param the param structure containing the parameters to validate
 * @param errorString output parameter to store error string
 * @return true if validation succeeded. false otherwise
 */
@SuppressWarnings("rawtypes")
private static boolean checkDirectoryType(LdapTemplate template, RootDSE rootDSE, final AuthnProviderParamsToValidate param, StringBuilder errorString) {
    // check LDAP version
    boolean ldapVersionPassed = false;
    if (rootDSE.getSupportedLDAPVersion() != null) {
        for (int i = 0; i < rootDSE.getSupportedLDAPVersion().length; i++) {
            if (rootDSE.getSupportedLDAPVersion()[i] >= LDAP_VERSION_LEVEL) {
                ldapVersionPassed = true;
                break;
            }
        }
        if (!ldapVersionPassed) {
            String errorMsg = MessageFormat.format("Supported LDAP version is insufficient at server {0}: must be at least {1}.", param.getUrls().toString(), LDAP_VERSION_LEVEL);
            errorString.append(errorMsg);
            _log.error(errorMsg);
            return false;
        }
    } else {
        _log.warn("Failed to get supported LDAP versions at server {}", param.getUrls().toString());
    }
    String serverType = null;
    // check active directory
    String rootDomainNamingContext = rootDSE.getRootDomainNamingContext();
    if (rootDomainNamingContext == null || rootDomainNamingContext.equals("")) {
        serverType = LDAP_SERVER;
        if (!param.getMode().equals("ldap")) {
            String errorMsg = MessageFormat.format("Directory server type LDAP doesn't match with specified mode {1} at server {0}.", param.getUrls().toString(), param.getMode());
            errorString.append(errorMsg);
            _log.error(errorMsg);
            return false;
        }
        serverType = OpenLDAPVersionChecker.getOpenLDAPVersion(rootDSE);
        if (serverType == null) {
            serverType = LDAP_SERVER;
        }
        _log.info("Server type: {} at {}", serverType, param.getUrls().toString());
    } else {
        serverType = MICROSOFT_ACTIVE_DIRECTORY;
        if (!param.getMode().equals("ad")) {
            // using AD as LDAP server only will not take advantage of AD specific features, but it is allowed
            String errorMsg = MessageFormat.format("Directory server type Active Directory doesn't match with specified mode {1} at server {0}.", param.getUrls().toString(), param.getMode());
            _log.warn(errorMsg);
        }
        // retrieve the rootDSE's schemaNamingContext operational attribute
        String schemaDN = rootDSE.getSchemaNamingContext();
        if (schemaDN == null || schemaDN.equals("")) {
            String errorMsg = MessageFormat.format("Could not find Schema Naming Context for server {0}", param.getUrls().toString());
            errorString.append(errorMsg);
            _log.error(errorMsg);
            return false;
        } else {
            _log.debug("Found Schema DN: {} for server {}", schemaDN, param.getUrls().toString());
        }
        // check and record objectVersion, windows server type
        try {
            List list = template.search(schemaDN, "(objectclass=*)", SearchControls.OBJECT_SCOPE, new AbstractContextMapper() {

                @Override
                protected Object doMapFromContext(DirContextOperations ctx) {
                    return ctx.getStringAttribute(OBJECT_VERSION);
                }
            });
            if (CollectionUtils.isEmpty(list)) {
                String errorMsg = MessageFormat.format("The attribute {0} could not be found in AD schema at server {1}.", OBJECT_VERSION, param.getUrls().toString());
                errorString.append(errorMsg);
                _log.error(errorMsg);
                return false;
            }
            String objectVersion = (String) list.get(0);
            String windowsServer = ActiveDirectoryVersionMap.getActiveDirectoryVersion(objectVersion);
            String infoMsg = MessageFormat.format("Active Directory server information {0} - server type: {1}, objectVersion: {2}, Microsoft Windows Server version: {3}", param.getUrls().toString(), serverType, objectVersion, windowsServer);
            _log.info(infoMsg);
            return true;
        } catch (CommunicationException e) {
            String errorMsg = MessageFormat.format("Connection to Active Directory server {0} failed during query of schema DN ({1})'s objectVersion attribute. LDAP error: {2}", param.getUrls().toString(), schemaDN, stripNonPrintableCharacters(e.getMessage()));
            errorString.append(errorMsg);
            _log.error(errorMsg);
            return false;
        } catch (Exception e) {
            String errorMsg = MessageFormat.format("Query {0} against server {1} failed because of LDAP error: {2}", OBJECT_VERSION, param.getUrls().toString(), stripNonPrintableCharacters(e.getMessage()));
            errorString.append(errorMsg);
            _log.error(errorMsg);
            return false;
        }
    }
    return true;
}

Example 2 with AbstractContextMapper

use of org.springframework.ldap.core.support.AbstractContextMapper in project coprhd-controller by CoprHD.

the class ImmutableAuthenticationProviders method checkGroupAttribute.

/**
 * Queries the AD schema to check that the group attribute exists
 *
 * @param template the ldap template to use
 * @param rootDSE the RootDSE object
 * @param param the param structure containing the parameters to validate
 * @param errorString output parameter to store error string
 * @return true if validation succeeded. false otherwise
 */
@SuppressWarnings("rawtypes")
private static boolean checkGroupAttribute(LdapTemplate template, final RootDSE rootDSE, final AuthnProviderParamsToValidate param, StringBuilder errorString) {
    try {
        // retrieve the rootDSE's schemaNamingContext operational attribute
        String schemaDN = rootDSE.getSchemaNamingContext();
        // query for the attribute
        List list = template.search(schemaDN, LdapFilterUtil.getAttributeFilterWithValues(param.getGroupAttr()), SearchControls.ONELEVEL_SCOPE, new AbstractContextMapper() {

            @Override
            protected Object doMapFromContext(DirContextOperations ctx) {
                return ctx.getStringAttribute("cn");
            }
        });
        if (CollectionUtils.isEmpty(list)) {
            errorString.append(MessageFormat.format("The group attribute {0} could not be found in AD schema at server {1}.", param.getGroupAttr(), param.getUrls().toString()));
            return false;
        } else {
            _log.debug("Found attribute: {} {}", list.get(0), param.getGroupAttr());
        }
        return true;
    } catch (CommunicationException e) {
        errorString.append(MessageFormat.format("Connection to LDAP server {0} failed during search for group attribute {1}. LDAP error: {2}", param.getUrls().toString(), param.getGroupAttr(), stripNonPrintableCharacters(e.getMessage())));
        return false;
    } catch (Exception e) {
        errorString.append(MessageFormat.format("Validation of group attribute {0} against server {1} failed because of LDAP error: {2}", param.getGroupAttr(), param.getUrls().toString(), stripNonPrintableCharacters(e.getMessage())));
        return false;
    }
}

Example 3 with AbstractContextMapper

use of org.springframework.ldap.core.support.AbstractContextMapper in project cxf by apache.

the class LdapUtils method getDnOfEntry.

public static Name getDnOfEntry(LdapTemplate ldapTemplate, String baseDN, String objectClass, String filterAttributeName, String filterAttributeValue) {
    ContextMapper<Name> mapper = new AbstractContextMapper<Name>() {

        public Name doMapFromContext(DirContextOperations ctx) {
            return ctx.getDn();
        }
    };
    AndFilter filter = new AndFilter();
    filter.and(new EqualsFilter("objectclass", objectClass)).and(new EqualsFilter(filterAttributeName, filterAttributeValue));
    List<Name> result = ldapTemplate.search((baseDN == null) ? "" : baseDN, filter.toString(), SearchControls.SUBTREE_SCOPE, mapper);
    if (result != null && !result.isEmpty()) {
        // not only the first one....
        return result.get(0);
    }
    return null;
}

Example 4 with AbstractContextMapper

use of org.springframework.ldap.core.support.AbstractContextMapper in project nifi-registry by apache.

the class LdapUserGroupProvider method load.

/**
 * Reloads the tenants.
 */
private void load(final ContextSource contextSource) {
    // create the ldapTemplate based on the context source. use a single source context to use the same connection
    // to support paging when configured
    final SingleContextSource singleContextSource = new SingleContextSource(contextSource.getReadOnlyContext());
    final LdapTemplate ldapTemplate = new LdapTemplate(singleContextSource);
    try {
        final List<User> userList = new ArrayList<>();
        final List<Group> groupList = new ArrayList<>();
        // group dn -> user identifiers lookup
        final Map<String, Set<String>> groupToUserIdentifierMappings = new HashMap<>();
        // user dn -> user lookup
        final Map<String, User> userLookup = new HashMap<>();
        if (performUserSearch) {
            // search controls
            final SearchControls userControls = new SearchControls();
            userControls.setSearchScope(userSearchScope.ordinal());
            // consider paging support for users
            final DirContextProcessor userProcessor;
            if (pageSize == null) {
                userProcessor = new NullDirContextProcessor();
            } else {
                userProcessor = new PagedResultsDirContextProcessor(pageSize);
            }
            // looking for objects matching the user object class
            final AndFilter userFilter = new AndFilter();
            userFilter.and(new EqualsFilter("objectClass", userObjectClass));
            // if a filter has been provided by the user, we add it to the filter
            if (StringUtils.isNotBlank(userSearchFilter)) {
                userFilter.and(new HardcodedFilter(userSearchFilter));
            }
            do {
                userList.addAll(ldapTemplate.search(userSearchBase, userFilter.encode(), userControls, new AbstractContextMapper<User>() {

                    @Override
                    protected User doMapFromContext(DirContextOperations ctx) {
                        // get the user identity
                        final String identity = getUserIdentity(ctx);
                        // build the user
                        final User user = new User.Builder().identifierGenerateFromSeed(identity).identity(identity).build();
                        // store the user for group member later
                        userLookup.put(getReferencedUserValue(ctx), user);
                        if (StringUtils.isNotBlank(userGroupNameAttribute)) {
                            final Attribute attributeGroups = ctx.getAttributes().get(userGroupNameAttribute);
                            if (attributeGroups == null) {
                                logger.warn("User group name attribute [" + userGroupNameAttribute + "] does not exist. Ignoring group membership.");
                            } else {
                                try {
                                    final NamingEnumeration<String> groupValues = (NamingEnumeration<String>) attributeGroups.getAll();
                                    while (groupValues.hasMoreElements()) {
                                        // store the group -> user identifier mapping
                                        groupToUserIdentifierMappings.computeIfAbsent(groupValues.next(), g -> new HashSet<>()).add(user.getIdentifier());
                                    }
                                } catch (NamingException e) {
                                    throw new AuthorizationAccessException("Error while retrieving user group name attribute [" + userIdentityAttribute + "].");
                                }
                            }
                        }
                        return user;
                    }
                }, userProcessor));
            } while (hasMorePages(userProcessor));
        }
        if (performGroupSearch) {
            final SearchControls groupControls = new SearchControls();
            groupControls.setSearchScope(groupSearchScope.ordinal());
            // consider paging support for groups
            final DirContextProcessor groupProcessor;
            if (pageSize == null) {
                groupProcessor = new NullDirContextProcessor();
            } else {
                groupProcessor = new PagedResultsDirContextProcessor(pageSize);
            }
            // looking for objects matching the group object class
            AndFilter groupFilter = new AndFilter();
            groupFilter.and(new EqualsFilter("objectClass", groupObjectClass));
            // if a filter has been provided by the user, we add it to the filter
            if (StringUtils.isNotBlank(groupSearchFilter)) {
                groupFilter.and(new HardcodedFilter(groupSearchFilter));
            }
            do {
                groupList.addAll(ldapTemplate.search(groupSearchBase, groupFilter.encode(), groupControls, new AbstractContextMapper<Group>() {

                    @Override
                    protected Group doMapFromContext(DirContextOperations ctx) {
                        final String dn = ctx.getDn().toString();
                        // get the group identity
                        final String name = getGroupName(ctx);
                        // get the value of this group that may associate it to users
                        final String referencedGroupValue = getReferencedGroupValue(ctx);
                        if (!StringUtils.isBlank(groupMemberAttribute)) {
                            Attribute attributeUsers = ctx.getAttributes().get(groupMemberAttribute);
                            if (attributeUsers == null) {
                                logger.warn("Group member attribute [" + groupMemberAttribute + "] does not exist. Ignoring group membership.");
                            } else {
                                try {
                                    final NamingEnumeration<String> userValues = (NamingEnumeration<String>) attributeUsers.getAll();
                                    while (userValues.hasMoreElements()) {
                                        final String userValue = userValues.next();
                                        if (performUserSearch) {
                                            // find the user by it's referenced attribute and add the identifier to this group
                                            final User user = userLookup.get(userValue);
                                            // ensure the user is known
                                            if (user != null) {
                                                groupToUserIdentifierMappings.computeIfAbsent(referencedGroupValue, g -> new HashSet<>()).add(user.getIdentifier());
                                            } else {
                                                logger.warn(String.format("%s contains member %s but that user was not found while searching users. Ignoring group membership.", name, userValue));
                                            }
                                        } else {
                                            // since performUserSearch is false, then the referenced group attribute must be blank... the user value must be the dn
                                            final String userDn = userValue;
                                            final String userIdentity;
                                            if (useDnForUserIdentity) {
                                                // use the user value to avoid the unnecessary look up
                                                userIdentity = userDn;
                                            } else {
                                                // lookup the user to extract the user identity
                                                userIdentity = getUserIdentity((DirContextAdapter) ldapTemplate.lookup(userDn));
                                            }
                                            // build the user
                                            final User user = new User.Builder().identifierGenerateFromSeed(userIdentity).identity(userIdentity).build();
                                            // add this user
                                            userList.add(user);
                                            groupToUserIdentifierMappings.computeIfAbsent(referencedGroupValue, g -> new HashSet<>()).add(user.getIdentifier());
                                        }
                                    }
                                } catch (NamingException e) {
                                    throw new AuthorizationAccessException("Error while retrieving group name attribute [" + groupNameAttribute + "].");
                                }
                            }
                        }
                        // build this group
                        final Group.Builder groupBuilder = new Group.Builder().identifierGenerateFromSeed(name).name(name);
                        // add all users that were associated with this referenced group attribute
                        if (groupToUserIdentifierMappings.containsKey(referencedGroupValue)) {
                            groupToUserIdentifierMappings.remove(referencedGroupValue).forEach(userIdentifier -> groupBuilder.addUser(userIdentifier));
                        }
                        return groupBuilder.build();
                    }
                }, groupProcessor));
            } while (hasMorePages(groupProcessor));
            // any remaining groupDn's were referenced by a user but not found while searching groups
            groupToUserIdentifierMappings.forEach((referencedGroupValue, userIdentifiers) -> {
                logger.warn(String.format("[%s] are members of %s but that group was not found while searching users. Ignoring group membership.", StringUtils.join(userIdentifiers, ", "), referencedGroupValue));
            });
        } else {
            // since performGroupSearch is false, then the referenced user attribute must be blank... the group value must be the dn
            // groups are not being searched so lookup any groups identified while searching users
            groupToUserIdentifierMappings.forEach((groupDn, userIdentifiers) -> {
                final String groupName;
                if (useDnForGroupName) {
                    // use the dn to avoid the unnecessary look up
                    groupName = groupDn;
                } else {
                    groupName = getGroupName((DirContextAdapter) ldapTemplate.lookup(groupDn));
                }
                // define the group
                final Group.Builder groupBuilder = new Group.Builder().identifierGenerateFromSeed(groupName).name(groupName);
                // add each user
                userIdentifiers.forEach(userIdentifier -> groupBuilder.addUser(userIdentifier));
                // build the group
                groupList.add(groupBuilder.build());
            });
        }
        // record the updated tenants
        tenants.set(new TenantHolder(new HashSet<>(userList), new HashSet<>(groupList)));
    } finally {
        singleContextSource.destroy();
    }
}

Example 5 with AbstractContextMapper

use of org.springframework.ldap.core.support.AbstractContextMapper in project nifi by apache.

the class LdapUserGroupProvider method load.

/**
 * Reloads the tenants.
 */
private void load(final ContextSource contextSource) {
    // create the ldapTemplate based on the context source. use a single source context to use the same connection
    // to support paging when configured
    final SingleContextSource singleContextSource = new SingleContextSource(contextSource.getReadOnlyContext());
    final LdapTemplate ldapTemplate = new LdapTemplate(singleContextSource);
    try {
        final List<User> userList = new ArrayList<>();
        final List<Group> groupList = new ArrayList<>();
        // group dn -> user identifiers lookup
        final Map<String, Set<String>> groupToUserIdentifierMappings = new HashMap<>();
        // user dn -> user lookup
        final Map<String, User> userLookup = new HashMap<>();
        if (performUserSearch) {
            // search controls
            final SearchControls userControls = new SearchControls();
            userControls.setSearchScope(userSearchScope.ordinal());
            // consider paging support for users
            final DirContextProcessor userProcessor;
            if (pageSize == null) {
                userProcessor = new NullDirContextProcessor();
            } else {
                userProcessor = new PagedResultsDirContextProcessor(pageSize);
            }
            // looking for objects matching the user object class
            final AndFilter userFilter = new AndFilter();
            userFilter.and(new EqualsFilter("objectClass", userObjectClass));
            // if a filter has been provided by the user, we add it to the filter
            if (StringUtils.isNotBlank(userSearchFilter)) {
                userFilter.and(new HardcodedFilter(userSearchFilter));
            }
            do {
                userList.addAll(ldapTemplate.search(userSearchBase, userFilter.encode(), userControls, new AbstractContextMapper<User>() {

                    @Override
                    protected User doMapFromContext(DirContextOperations ctx) {
                        // get the user identity
                        final String identity = getUserIdentity(ctx);
                        // build the user
                        final User user = new User.Builder().identifierGenerateFromSeed(identity).identity(identity).build();
                        // store the user for group member later
                        userLookup.put(getReferencedUserValue(ctx), user);
                        if (StringUtils.isNotBlank(userGroupNameAttribute)) {
                            final Attribute attributeGroups = ctx.getAttributes().get(userGroupNameAttribute);
                            if (attributeGroups == null) {
                                logger.warn("User group name attribute [" + userGroupNameAttribute + "] does not exist. Ignoring group membership.");
                            } else {
                                try {
                                    final NamingEnumeration<String> groupValues = (NamingEnumeration<String>) attributeGroups.getAll();
                                    while (groupValues.hasMoreElements()) {
                                        // store the group -> user identifier mapping
                                        groupToUserIdentifierMappings.computeIfAbsent(groupValues.next(), g -> new HashSet<>()).add(user.getIdentifier());
                                    }
                                } catch (NamingException e) {
                                    throw new AuthorizationAccessException("Error while retrieving user group name attribute [" + userIdentityAttribute + "].");
                                }
                            }
                        }
                        return user;
                    }
                }, userProcessor));
            } while (hasMorePages(userProcessor));
        }
        if (performGroupSearch) {
            final SearchControls groupControls = new SearchControls();
            groupControls.setSearchScope(groupSearchScope.ordinal());
            // consider paging support for groups
            final DirContextProcessor groupProcessor;
            if (pageSize == null) {
                groupProcessor = new NullDirContextProcessor();
            } else {
                groupProcessor = new PagedResultsDirContextProcessor(pageSize);
            }
            // looking for objects matching the group object class
            AndFilter groupFilter = new AndFilter();
            groupFilter.and(new EqualsFilter("objectClass", groupObjectClass));
            // if a filter has been provided by the user, we add it to the filter
            if (StringUtils.isNotBlank(groupSearchFilter)) {
                groupFilter.and(new HardcodedFilter(groupSearchFilter));
            }
            do {
                groupList.addAll(ldapTemplate.search(groupSearchBase, groupFilter.encode(), groupControls, new AbstractContextMapper<Group>() {

                    @Override
                    protected Group doMapFromContext(DirContextOperations ctx) {
                        final String dn = ctx.getDn().toString();
                        // get the group identity
                        final String name = getGroupName(ctx);
                        // get the value of this group that may associate it to users
                        final String referencedGroupValue = getReferencedGroupValue(ctx);
                        if (!StringUtils.isBlank(groupMemberAttribute)) {
                            Attribute attributeUsers = ctx.getAttributes().get(groupMemberAttribute);
                            if (attributeUsers == null) {
                                logger.warn("Group member attribute [" + groupMemberAttribute + "] does not exist. Ignoring group membership.");
                            } else {
                                try {
                                    final NamingEnumeration<String> userValues = (NamingEnumeration<String>) attributeUsers.getAll();
                                    while (userValues.hasMoreElements()) {
                                        final String userValue = userValues.next();
                                        if (performUserSearch) {
                                            // find the user by it's referenced attribute and add the identifier to this group
                                            final User user = userLookup.get(userValue);
                                            // ensure the user is known
                                            if (user != null) {
                                                groupToUserIdentifierMappings.computeIfAbsent(referencedGroupValue, g -> new HashSet<>()).add(user.getIdentifier());
                                            } else {
                                                logger.warn(String.format("%s contains member %s but that user was not found while searching users. Ignoring group membership.", name, userValue));
                                            }
                                        } else {
                                            // since performUserSearch is false, then the referenced group attribute must be blank... the user value must be the dn
                                            final String userDn = userValue;
                                            final String userIdentity;
                                            if (useDnForUserIdentity) {
                                                // use the user value to avoid the unnecessary look up
                                                userIdentity = userDn;
                                            } else {
                                                // lookup the user to extract the user identity
                                                userIdentity = getUserIdentity((DirContextAdapter) ldapTemplate.lookup(userDn));
                                            }
                                            // build the user
                                            final User user = new User.Builder().identifierGenerateFromSeed(userIdentity).identity(userIdentity).build();
                                            // add this user
                                            userList.add(user);
                                            groupToUserIdentifierMappings.computeIfAbsent(referencedGroupValue, g -> new HashSet<>()).add(user.getIdentifier());
                                        }
                                    }
                                } catch (NamingException e) {
                                    throw new AuthorizationAccessException("Error while retrieving group name attribute [" + groupNameAttribute + "].");
                                }
                            }
                        }
                        // build this group
                        final Group.Builder groupBuilder = new Group.Builder().identifierGenerateFromSeed(name).name(name);
                        // add all users that were associated with this referenced group attribute
                        if (groupToUserIdentifierMappings.containsKey(referencedGroupValue)) {
                            groupToUserIdentifierMappings.remove(referencedGroupValue).forEach(userIdentifier -> groupBuilder.addUser(userIdentifier));
                        }
                        return groupBuilder.build();
                    }
                }, groupProcessor));
            } while (hasMorePages(groupProcessor));
            // any remaining groupDn's were referenced by a user but not found while searching groups
            groupToUserIdentifierMappings.forEach((referencedGroupValue, userIdentifiers) -> {
                logger.warn(String.format("[%s] are members of %s but that group was not found while searching users. Ignoring group membership.", StringUtils.join(userIdentifiers, ", "), referencedGroupValue));
            });
        } else {
            // since performGroupSearch is false, then the referenced user attribute must be blank... the group value must be the dn
            // groups are not being searched so lookup any groups identified while searching users
            groupToUserIdentifierMappings.forEach((groupDn, userIdentifiers) -> {
                final String groupName;
                if (useDnForGroupName) {
                    // use the dn to avoid the unnecessary look up
                    groupName = groupDn;
                } else {
                    groupName = getGroupName((DirContextAdapter) ldapTemplate.lookup(groupDn));
                }
                // define the group
                final Group.Builder groupBuilder = new Group.Builder().identifierGenerateFromSeed(groupName).name(groupName);
                // add each user
                userIdentifiers.forEach(userIdentifier -> groupBuilder.addUser(userIdentifier));
                // build the group
                groupList.add(groupBuilder.build());
            });
        }
        // record the updated tenants
        tenants.set(new TenantHolder(new HashSet<>(userList), new HashSet<>(groupList)));
    } finally {
        singleContextSource.destroy();
    }
}