Properties tmp = new Properties();
tmp.putAll(env);
tmp.setProperty(Context.SECURITY_CREDENTIALS, "***");
log.trace("Logging into LDAP server, env=" + tmp.toString());
}
InitialLdapContext ctx = new InitialLdapContext(env, null);
if( trace )
log.trace("Logged into LDAP server, " + ctx);
if( bindDN != null )
{
// Rebind the ctx to the bind dn/credentials for the roles searches
if( trace )
log.trace("Rebind SECURITY_PRINCIPAL to: "+bindDN);
env.setProperty(Context.SECURITY_PRINCIPAL, bindDN);
env.put(Context.SECURITY_CREDENTIALS, bindCredential);
ctx = new InitialLdapContext(env, null);
}
/* If a userRolesCtxDNAttributeName was speocified, see if there is a
user specific roles DN. If there is not, the default rolesCtxDN will
be used.
*/
String rolesCtxDN = (String) options.get(ROLES_CTX_DN_OPT);
String userRolesCtxDNAttributeName = (String) options.get(USER_ROLES_CTX_DN_ATTRIBUTE_ID_OPT);
if (userRolesCtxDNAttributeName != null)
{
// Query the indicated attribute for the roles ctx DN to use
String[] returnAttribute = {userRolesCtxDNAttributeName};
try
{
Attributes result = ctx.getAttributes(userDN, returnAttribute);
if (result.get(userRolesCtxDNAttributeName) != null)
{
rolesCtxDN = result.get(userRolesCtxDNAttributeName).get().toString();
super.log.trace("Found user roles context DN: " + rolesCtxDN);
}
}
catch (NamingException e)
{
super.log.debug("Failed to query userRolesCtxDNAttributeName", e);
}
}
// Search for any roles associated with the user
if (rolesCtxDN != null)
{
String uidAttrName = (String) options.get(UID_ATTRIBUTE_ID_OPT);
if (uidAttrName == null)
uidAttrName = "uid";
String roleAttrName = (String) options.get(ROLE_ATTRIBUTE_ID_OPT);
if (roleAttrName == null)
roleAttrName = "roles";
StringBuffer roleFilter = new StringBuffer("(");
roleFilter.append(uidAttrName);
roleFilter.append("={0})");
String userToMatch = username;
if (matchOnUserDN == true)
userToMatch = userDN;
String[] roleAttr = {roleAttrName};
// Is user's role attribute a DN or the role name
String roleAttributeIsDNOption = (String) options.get(ROLE_ATTRIBUTE_IS_DN_OPT);
boolean roleAttributeIsDN = Boolean.valueOf(roleAttributeIsDNOption).booleanValue();
// If user's role attribute is a DN, what is the role's name attribute
// Default to 'name' (Group name attribute in Active Directory)
String roleNameAttributeID = (String) options.get(ROLE_NAME_ATTRIBUTE_ID_OPT);
if (roleNameAttributeID == null)
roleNameAttributeID = "name";
int searchScope = SearchControls.SUBTREE_SCOPE;
int searchTimeLimit = 10000;
String timeLimit = (String) options.get(SEARCH_TIME_LIMIT_OPT);
if( timeLimit != null )
{
try
{
searchTimeLimit = Integer.parseInt(timeLimit);
}
catch(NumberFormatException e)
{
log.trace("Failed to parse: "+timeLimit+", using searchTimeLimit="+searchTimeLimit);
}
}
String scope = (String) options.get(SEARCH_SCOPE_OPT);
if( "OBJECT_SCOPE".equalsIgnoreCase(scope) )
searchScope = SearchControls.OBJECT_SCOPE;
else if( "ONELEVEL_SCOPE".equalsIgnoreCase(scope) )
searchScope = SearchControls.ONELEVEL_SCOPE;
if( "SUBTREE_SCOPE".equalsIgnoreCase(scope) )
searchScope = SearchControls.SUBTREE_SCOPE;
try
{
SearchControls controls = new SearchControls();
controls.setSearchScope(searchScope);
controls.setReturningAttributes(roleAttr);
controls.setTimeLimit(searchTimeLimit);
Object[] filterArgs = {userToMatch};
if( trace )
{
log.trace("searching rolesCtxDN="+rolesCtxDN+", roleFilter="+roleFilter
+", filterArgs="+userToMatch+", roleAttr="+roleAttr
+", searchScope="+searchScope+", searchTimeLimit="+searchTimeLimit
);
}
NamingEnumeration answer = ctx.search(rolesCtxDN, roleFilter.toString(),
filterArgs, controls);
while (answer.hasMore())
{
SearchResult sr = (SearchResult) answer.next();
if( trace )
{
log.trace("Checking answer: "+sr.getName());
}
Attributes attrs = sr.getAttributes();
Attribute roles = attrs.get(roleAttrName);
for (int r = 0; r < roles.size(); r++)
{
Object value = roles.get(r);
String roleName = null;
if (roleAttributeIsDN == true)
{
// Query the roleDN location for the value of roleNameAttributeID
String roleDN = value.toString();
String[] returnAttribute = {roleNameAttributeID};
if( trace )
log.trace("Following roleDN: " + roleDN);
try
{
Attributes result2 = ctx.getAttributes(roleDN, returnAttribute);
Attribute roles2 = result2.get(roleNameAttributeID);
if( roles2 != null )
{
for(int m = 0; m < roles2.size(); m ++)
{
roleName = (String) roles2.get(m);
addRole(roleName);
}
}
}
catch (NamingException e)
{
log.trace("Failed to query roleNameAttrName", e);
}
}
else
{
// The role attribute value is the role name
roleName = value.toString();
addRole(roleName);
}
}
}
answer.close();
}
catch (NamingException e)
{
if( trace )
log.trace("Failed to locate roles", e);
}
}
// Close the context to release the connection
ctx.close();
}