* @throws Exception If the authentication cannot be done
*/
// This will suppress PMD.EmptyCatchBlock warnings in this method
public void handleSimpleAuth( LdapSession ldapSession, BindRequest bindRequest ) throws Exception
{
DirectoryService directoryService = ldapServer.getDirectoryService();
// if the user is already bound, we have to unbind him
if ( ldapSession.isAuthenticated() )
{
// We already have a bound session for this user. We have to
// abandon it first.
ldapSession.getCoreSession().unbind();
}
// Set the status to SimpleAuthPending
ldapSession.setSimpleAuthPending();
// Now, bind the user
// create a new Bind context, with a null session, as we don't have
// any context yet.
BindOperationContext bindContext = new BindOperationContext( null );
// Stores the Dn of the user to check, and its password
bindContext.setDn( bindRequest.getDn() );
bindContext.setCredentials( bindRequest.getCredentials() );
bindContext.setIoSession( ldapSession.getIoSession() );
bindContext.setInterceptors( directoryService.getInterceptors( OperationEnum.BIND ) );
// Stores the request controls into the operation context
LdapProtocolUtils.setRequestControls( bindContext, bindRequest );
try
{
/*
* Referral handling as specified by RFC 3296 here:
*
* http://www.faqs.org/rfcs/rfc3296.html
*
* See section 5.6.1 where if the bind principal Dn is a referral
* we return an invalidCredentials result response. Optionally we
* could support delegated authentication in the future with this
* potential. See the following JIRA for more on this possibility:
*
* https://issues.apache.org/jira/browse/DIRSERVER-1217
*
* NOTE: if this is done then this handler should extend the
* a modified form of the ReferralAwareRequestHandler so it can
* detect conditions where ancestors of the Dn are referrals
* and delegate appropriately.
*/
Entry principalEntry = null;
try
{
principalEntry = directoryService.getAdminSession().lookup( bindRequest.getDn() );
}
catch ( LdapException le )
{
// this is OK
}
if ( principalEntry == null )
{
LOG.info( "The {} principalDN cannot be found in the server : bind failure.", bindRequest.getName() );
}
else if ( ( ( ClonedServerEntry ) principalEntry ).getOriginalEntry().contains(
SchemaConstants.OBJECT_CLASS_AT,
SchemaConstants.REFERRAL_OC ) )
{
LOG.info( "Bind principalDn points to referral." );
LdapResult result = bindRequest.getResultResponse().getLdapResult();
result.setDiagnosticMessage( "Bind principalDn points to referral." );
result.setResultCode( ResultCodeEnum.INVALID_CREDENTIALS );
ldapSession.getIoSession().write( bindRequest.getResultResponse() );
return;
}
// TODO - might cause issues since lookups are not returning all
// attributes right now - this is an optimization that can be
// enabled later after determining whether or not this will cause
// issues.
// reuse the looked up entry so we don't incur another lookup
// opContext.setEntry( principalEntry );
// And call the OperationManager bind operation.
bindContext.setInterceptors( directoryService.getInterceptors( OperationEnum.BIND ) );
directoryService.getOperationManager().bind( bindContext );
// As a result, store the created session in the Core Session
CoreSession coreSession = bindContext.getSession();
ldapSession.setCoreSession( coreSession );