// Now, bind the user
// create a new Bind context, with a null session, as we don't have
// any context yet.
BindOperationContext opContext = new BindOperationContext( null );
// Stores the DN of the user to check, and its password
opContext.setDn( bindRequest.getName() );
opContext.setCredentials( bindRequest.getCredentials() );
// Stores the request controls into the operation context
LdapProtocolUtils.setRequestControls( opContext, bindRequest );
try
{
/*
* Referral handling as specified by RFC 3296 here:
*
* http://www.faqs.org/rfcs/rfc3296.html
*
* See section 5.6.1 where if the bind principal DN is a referral
* we return an invalidCredentials result response. Optionally we
* could support delegated authentication in the future with this
* potential. See the following JIRA for more on this possibility:
*
* https://issues.apache.org/jira/browse/DIRSERVER-1217
*
* NOTE: if this is done then this handler should extend the
* a modified form of the ReferralAwareRequestHandler so it can
* detect conditions where ancestors of the DN are referrals
* and delegate appropriately.
*/
ClonedServerEntry principalEntry = null;
try
{
principalEntry = getLdapServer().getDirectoryService().getAdminSession().lookup( bindRequest.getName() );
}
catch ( NameNotFoundException e )
{
// this is OK
}
if ( principalEntry == null )
{
LOG.info( "The {} principalDN cannot be found in the server : bind failure.", bindRequest.getName() );
InternalLdapResult result = bindRequest.getResultResponse().getLdapResult();
result.setErrorMessage( "cannot bind the principalDn." );
result.setResultCode( ResultCodeEnum.INVALID_CREDENTIALS );
ldapSession.getIoSession().write( bindRequest.getResultResponse() );
return;
}
if ( principalEntry.getOriginalEntry().contains( SchemaConstants.OBJECT_CLASS_AT,
SchemaConstants.REFERRAL_OC ) )
{
LOG.info( "Bind principalDn points to referral." );
InternalLdapResult result = bindRequest.getResultResponse().getLdapResult();
result.setErrorMessage( "Bind principalDn points to referral." );
result.setResultCode( ResultCodeEnum.INVALID_CREDENTIALS );
ldapSession.getIoSession().write( bindRequest.getResultResponse() );
return;
}
// TODO - might cause issues since lookups are not returning all
// attributes right now - this is an optimization that can be
// enabled later after determining whether or not this will cause
// issues.
// reuse the looked up entry so we don't incur another lookup
// opContext.setEntry( principalEntry );
// And call the OperationManager bind operation.
getLdapServer().getDirectoryService().getOperationManager().bind( opContext );
// As a result, store the created session in the Core Session
ldapSession.setCoreSession( opContext.getSession() );
// And set the current state accordingly
if ( !ldapSession.getCoreSession().isAnonymous() )
{
ldapSession.setAuthenticated();