Skip to content
This repository was archived by the owner on May 11, 2018. It is now read-only.

Commit 1debba6

Browse files
wmhopkinswmhopkins
committed
Tweak LdapIdentityStoreDefinition and CredentialValidationResult for better config flexibility.
1 parent 775fa71 commit 1debba6

2 files changed

Lines changed: 149 additions & 71 deletions

File tree

‎src/main/java/javax/security/enterprise/identitystore/CredentialValidationResult.java‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ public class CredentialValidationResult {
6464

6565
private final Status status;
6666
private final String storeId;
67+
private final String callerDn;
6768
private final String callerUniqueId;
6869
private final CallerPrincipal callerPrincipal;
6970
private final Set<String> groups;
@@ -92,7 +93,7 @@ public enum Status {
9293
* @param status
9394
*/
9495
private CredentialValidationResult(Status status) {
95-
this(status, null, null, null, null);
96+
this(status, null, null, null, null, null);
9697
}
9798

9899
/**
@@ -130,31 +131,35 @@ public CredentialValidationResult(String callerName, Set<String> groups) {
130131
* @param groups Groups associated with the caller from the identity store
131132
*/
132133
public CredentialValidationResult(CallerPrincipal callerPrincipal, Set<String> groups) {
133-
this(null, callerPrincipal, null, groups);
134+
this(null, callerPrincipal, null, null, groups);
134135
}
135136

136137
/**
137138
* Constructor for a VALID result.
138139
*
139140
* @param storeId Identity store unique ID
140141
* @param callerName Name of the validated caller
142+
* @param callerDn Caller's LDAP DN (distinguished name)
141143
* @param callerUniqueId Caller's unique identifier from the identity store
142144
* @param groups Groups associated with the caller from the identity store
143145
*/
144-
public CredentialValidationResult(String storeId, String callerName, String callerUniqueId, Set<String> groups) {
145-
this(storeId, new CallerPrincipal(callerName), callerUniqueId, groups);
146+
public CredentialValidationResult(String storeId, String callerName,
147+
String callerDn, String callerUniqueId, Set<String> groups) {
148+
this(storeId, new CallerPrincipal(callerName), callerDn, callerUniqueId, groups);
146149
}
147150

148151
/**
149152
* Constructor for a VALID result.
150153
*
151154
* @param storeId Identity store unique ID
152155
* @param callerPrincipal CallerPrincipal of validated caller
156+
* @param callerDn Caller's LDAP DN (distinguished name)
153157
* @param callerUniqueId Caller's unique identifier from the identity store
154158
* @param groups Groups associated with the caller from the identity store
155159
*/
156-
public CredentialValidationResult(String storeId, CallerPrincipal callerPrincipal, String callerUniqueId, Set<String> groups) {
157-
this(VALID, storeId, callerPrincipal, callerUniqueId, groups);
160+
public CredentialValidationResult(String storeId, CallerPrincipal callerPrincipal,
161+
String callerDn, String callerUniqueId, Set<String> groups) {
162+
this(VALID, storeId, callerPrincipal, callerDn, callerUniqueId, groups);
158163
}
159164

160165
/**
@@ -163,13 +168,15 @@ public CredentialValidationResult(String storeId, CallerPrincipal callerPrincipa
163168
* @param status The result status
164169
* @param storeId Identity store unique ID
165170
* @param callerPrincipal CallerPrincipal of validated caller
171+
* @param callerDn Caller's LDAP DN (distinguished name)
166172
* @param callerUniqueId Caller's unique identifier from the identity store
167173
* @param groups Groups associated with the caller from the identity store
168174
*/
169175
private CredentialValidationResult(Status status, String storeId,
170-
CallerPrincipal callerPrincipal, String callerUniqueId, Set<String> groups) {
176+
CallerPrincipal callerPrincipal, String callerDn, String callerUniqueId, Set<String> groups) {
171177

172-
if (status != VALID && (storeId != null || callerPrincipal != null || callerUniqueId != null || groups != null)) {
178+
if (status != VALID && (storeId != null || callerPrincipal != null ||
179+
callerDn != null || callerUniqueId != null || groups != null)) {
173180
throw new IllegalArgumentException("Bad status");
174181
}
175182
if (status == VALID && (callerPrincipal == null || callerPrincipal.getName().trim().isEmpty())) {
@@ -179,6 +186,7 @@ private CredentialValidationResult(Status status, String storeId,
179186
this.status = status;
180187
this.storeId = storeId;
181188
this.callerPrincipal = callerPrincipal;
189+
this.callerDn = callerDn;
182190
this.callerUniqueId = callerUniqueId;
183191
this.groups = groups != null ? unmodifiableSet(new HashSet<String>(groups)) : emptySet();
184192
}
@@ -220,6 +228,15 @@ public String getCallerUniqueId() {
220228
return callerUniqueId;
221229
}
222230

231+
/**
232+
* Return the CallerPrincipal for the validated credential.
233+
*
234+
* @return The CallerPrincipal.
235+
*/
236+
public String getCallerDn() {
237+
return callerDn;
238+
}
239+
223240
/**
224241
* Determines the set of groups that the specified Caller is in, based on
225242
* the associated identity store.

‎src/main/java/javax/security/enterprise/identitystore/LdapIdentityStoreDefinition.java‎

Lines changed: 124 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -69,30 +69,53 @@
6969
* @return URL where the LDAP server can be reached
7070
*/
7171
String url() default "";
72+
73+
/**
74+
* Distinguished name for the application or administrative user that will be used to
75+
* make the initial connection to the LDAP and perform searches and lookups.
76+
*
77+
* This value is needed if user or group lookup will be done. If the
78+
* store will be used only to authenticate users or lookup groups
79+
* using an explicit DN (see callerBaseDn and groupMemberOfAttribute),
80+
* it is not needed. When this member is filled in, the value of callerBaseDn is ignored.
81+
*
82+
* This user needs search permission in the LDAP for persons and/or groups.
83+
* <p>
84+
* E.g. <code>uid=ldap,ou=apps,dc=jsr375,dc=net</code>
85+
*
86+
* @return The distinguished name for the application user.
87+
*/
88+
String bindDn() default "";
7289

7390
/**
74-
* Base of the distinguished name that contains the caller name.
91+
* Password for the application/admin user defined by the bindDn member.
92+
* Only used when the member bindDn is filled in.
93+
*
94+
* @return password for the application user.
95+
*/
96+
String bindDnPassword() default "";
97+
98+
/**
99+
* Base distinguished name for users in the LDAP store.
75100
* E.g. <code>ou=caller,dc=jsr375,dc=net</code>
76-
* When this member value is specified, direct binding is attempted, see also baseDn
101+
* When this member value is specified, and bindDn is not, direct binding is attempted.
102+
* See also bindDn.
103+
*
104+
* The callerNameAttribute must be specified along with this attribute so that the
105+
* runtime can create the "leaf" RDN to concatenate with this base DN to create the
106+
* full DN for the caller.
77107
*
78-
* @return Base of the distinguished name that contains the caller name
108+
* @return Base of the distinguished name that contains the caller name.
79109
*/
80110
String callerBaseDn() default "";
81111

82112
/**
83-
* Name of the attribute that contains the caller name in the node
84-
* just below the one identified by {@link #callerBaseDn()}.
113+
* Name of the attribute that contains the callers name in the person object.
85114
* E.g. <code>uid</code>
86115
* <p>
87-
* Example for the relationship with {@link #callerBaseDn()} and the name
88-
* of the caller that needs to be authenticated:
89-
* <br>
90-
* Given the DN <code>uid=peter,ou=caller,dc=jsr375,dc=net</code>,
91-
* <ul>
92-
* <li> {@link #callerNameAttribute()} corresponds to <code>uid</code> </li>
93-
* <li> {@link #callerBaseDn()} corresponds to <code>ou=caller,dc=jsr375,dc=net</code> </li>
94-
* <li> <code>peter</code> is the caller name that needs to be authenticated </li>
95-
* </ul>
116+
* This attribute will be used, with callerBaseDn, to construct user DNs for direct binding.
117+
* and to retrieve the caller's name when the person object is obtained via search. The value
118+
* of this attribute is returned in the {@link CallerPrincipal} following a successful validation.
96119
* <p>
97120
* The following gives an example in ldif format:
98121
* <pre>
@@ -113,36 +136,77 @@
113136
String callerNameAttribute() default "uid";
114137

115138
/**
116-
* Base of the distinguished name that contains the groups
139+
* Search base for finding the user.
140+
* Only used when the member bindDn is filled in.
141+
* Overrides callerBaseDn, if configured, causing caller search
142+
* to be used instead of direct binding.
143+
*
144+
* @return Base for searching the LDAP tree for callers.
145+
*/
146+
String callerSearchBase() default "";
147+
148+
/**
149+
* Search expression to find callers when callerSearchBase is set.
150+
* Only used when the member bindDn is filled in.
151+
*
152+
* @return Search expression to find callers.
153+
*/
154+
String callerSearchExpression() default "";
155+
156+
/**
157+
* Search scope for caller searches, determines depth
158+
* of the search in the LDAP tree.
159+
* Only used when the member bindDn is filled in.
160+
*
161+
* Legal values are "subtree", "onelevel".
162+
*
163+
* @return The search scope
164+
*/
165+
String callerSearchScope() default "subtree";
166+
167+
/**
168+
* Base distinguished name that contains groups
117169
* E.g. <code>ou=group,dc=jsr375,dc=net</code>
170+
*
171+
* For a store that performs group lookup
172+
*
173+
* @return Base for searching the LDAP tree for groups
174+
*/
175+
String groupSearchBase() default "";
176+
177+
/**
178+
* Search expression to find groups when groupSearchBase is set.
179+
* Only used when the member bindDn is filled in.
118180
*
119-
* @return Base of the distinguished name that contains the groups
181+
* @return Search expression to find the user.
182+
*/
183+
String groupSearchExpression() default "";
184+
185+
/**
186+
* Search scope for group searches, determines depth
187+
* of the search in the LDAP tree.
188+
* Only used when the member bindDn is filled in.
189+
*
190+
* Legal values are "subtree", "onelevel".
191+
*
192+
* @return The search scope
120193
*/
121-
String groupBaseDn() default "";
194+
String groupSearchScope() default "subtree";
122195

123196
/**
124-
* Name of the attribute that contains the group name in the node
125-
* just below the one identified by {@link #groupBaseDn()}.
197+
* Name of the attribute of a group object that represents the group name.
126198
* E.g. <code>cn</code>
127-
* <p>
128-
* Example for the relationship with {@link #groupBaseDn()} and the role name
129-
* <br>
130-
* Given the DN <code>cn=foo,ou=group,dc=jsr375,dc=net</code>,
131-
* <ul>
132-
* <li> {@link #groupNameAttribute()} corresponds to <code>cn</code> </li>
133-
* <li> {@link #groupBaseDn()} corresponds to <code>ou=group,dc=jsr375,dc=net</code> </li>
134-
* <li> <code>foo</code> is the group name that will be returned by the store when authentication succeeds</li>
135-
* </ul>
136199
*
137-
* @return Name of the attribute that contains the group name
200+
* @return Name of the attribute that represents the group name
138201
*/
139202
String groupNameAttribute() default "cn";
140203

141204
/**
142-
* DN attribute for the group DN that identifies the callers that are in that group.
205+
* Name of the attribute in a group object that identifies the
206+
* members of the group.
143207
* E.g. <code>member</code>
144208
* <p>
145-
* The value of this attribute has to the full DN of the caller. The following gives an example
209+
* The value of this attribute must be the full DN of the caller. The following gives an example
146210
* entry in ldif format:
147211
* <pre>
148212
* <code>
@@ -155,44 +219,41 @@
155219
* </code>
156220
* </pre>
157221
*
158-
* @return DN attribute for the group DN
222+
* @return Attribute for the group members
159223
*/
160-
String groupCallerDnAttribute() default "member";
224+
String groupMemberAttribute() default "member";
161225

162226
/**
163-
* Base of the distinguished name for the application user that will be used to make the initial connection to the LDAP.
164-
* This account needs search persons in the LDAP to find the actual DN of the user who we need to authenticate.
165-
* When this member is filled in, the value in callerBaseDn is ignored.
227+
* Name of the attribute in a person object that identifies the groups
228+
* the caller belongs to.
229+
* E.g. <code>memberOf</code>
166230
* <p>
167-
* E.g. <code>uid=ldap,ou=apps,dc=jsr375,dc=net</code>
168-
*
169-
* @return The distinguished name for the application user.
170-
*/
171-
String baseDn() default "";
172-
173-
/**
174-
* Password for the application user defined by the baseDn member.
175-
* Only used when the member baseDN is filled in.
176-
*
177-
* @return password for the application user.
178-
*/
179-
String password() default "";
180-
181-
/**
182-
* Search base for finding the user.
183-
* Only used when the member baseDN is filled in.
184-
*
185-
* @return base for searching the LDAP tree for the user.
186-
*/
187-
String searchBase() default "";
188-
189-
/**
190-
* Search expression to find
191-
* Only used when the member baseDN is filled in.
231+
* This attribute is used only if: a) group search is not configured
232+
* (i.e., no groupSearchBase and groupSearchExpression configured); and,
233+
* b) the user's DN is available, either because groups are being returned
234+
* during the credential validation phase by an identity store that performs
235+
* both validation and group lookup, or because the DN is available in the
236+
* {@link CredentialValidationResult} passed to the
237+
* {@link IdentityStore#getCallerGroups(CredentialValidationResult)} method.
238+
* <p>
239+
* The value of this attribute must be the full DN of the group. The following gives an example
240+
* entry in ldif format:
241+
* <pre>
242+
* <code>
243+
* dn: uid=peter,ou=caller,dc=jsr375,dc=net
244+
* objectclass: top
245+
* objectclass: uidObject
246+
* objectclass: person
247+
* uid: peter
248+
* cn: Peter Smith
249+
* memberOf: cn=foo,ou=group,dc=jsr375,dc=net
250+
* memberOf: cn=bar,ou=group,dc=jsr375,dc=net
251+
* </code>
252+
* </pre>
192253
*
193-
* @return Search expression to find the user.
254+
* @return Attribute for group membership
194255
*/
195-
String searchExpression() default "";
256+
String groupMemberOfAttribute() default "memberOf";
196257

197258
/**
198259
* Determines the order in case multiple IdentityStores are found.

0 commit comments

Comments
 (0)