Imported from JIRA [DS-50] created by kipkorir2008
Thanks, Stuart -
I'll submit the patch to the queue.
You can grab a zip file that includes only the
changed files here:
http://erwg.lib.auburn.edu/dspace-ldap_20080828.zip
The main changes were:
*. Our A.D. setup does not allow anonymous bind,
and also has user info scattered around the LDAP tree.
To bind an arbitrary user, we pass a distinguished name
of:
DOMAIN\USER-ID
rather than some LDAP path like cn=USER&ou=People&dc=...
We detect this case by allowing the admin
to specify
windows_domain:domain-name
(something like that) as the LDAP object-context in dspace.cfg.
*. Since our user info is scattered through an LDAP tree -
I patched the "lookup user info" part of the code
to specify a recursive JNDI search.
Your last patch may have done the same thing.
*. We would like a user that successfully authenticates against A.D.
to automatically be given certain privileges.
I setup the getSpecialGroups function to accept a list of group-ids in
the
"ldap.dspace.autogroup"
dspace.cfg parameter.
*. I wanted to be able to run a standalone test case against the LDAP
authenticate and search code, so I split out the 'DataFromLDAP'
nested class to an external interface, and include a junit test case.
Also added a few lines to pom.xml to help run the test with verbose
logging, etc.
Cheers,
Reuben
>>> Stuart Lewis 9/6/2008 7:57 AM >>>
Hi Reuben,
Thanks for getting in touch. I¹ve got that email sitting in my inbox
waiting
for me to get around to replying to it - sorry it has taken a little
while.
What changes have you made to make it work with Active Directory?
It would be great if you could formally submit your patch to the DSpace
patch queue
(http://sourceforge.net/tracker/?atid=319984&group_id=19984&func=browse).
There are a few of us working on a generic LDAP authenticator which will
hopefully work with any AD / LDAP system, so it would be good to see what
changes you¹ve made to see if we can incorporate them too.
Thanks,
Stuart
On 28/08/2008 16:14, "Reuben Pasquini" wrote:
> Hello!
>
> I've put together a set of patches to the LDAPAuthentication
> code to get it working against Active Directory at Auburn
> University, support implicit-group member-ids in dspace.cfg,
> and add a JUnit regression test.
> I think the changes are backward compatable and generic,
> but I've only tested the code in my environment.
>
> I hope that we can check this patch into the dspace repository.
> An overview and svn diff follow, and a zip file with
> the modified files is available here:
> http://erwg.lib.auburn.edu/dspace-ldap_20080828.zip
> Please take a look, and let me know what you think.
>
> Cheers,
> Reuben
>
> -----------------------------------
>
> Changes under dspace-api org.dspace.authentication.
>
> *. Moved the
> LDAPAuthentication.SpeakerToLDAP
> nested class out to its own non-nested interface
> with a DefaultSpeakerToLDAP implementation.
>
> *. Refactored SpeakerToLDAP#ldapAuthenticate(...)
> to return a DataFromLDAP POJO data object
> rather than set object member variables.
>
> *. Implemented SpeakerToLDAPCase JUnit test-case
> and PackageTestSuite classes to support simple
> regression tests against SpeakerToLDAP implementations.
> Modified pom.xml so that
> 'mvn test'
> runs with a verbose log4j setting.
>
> *. Modified the way SpeakToLDAP handles the
> ldap.object_context
> dspace.cfg configuration property so that
> if the ldap.object_context matches
> 'WINDOWS_DOMAIN:DOMAIN_NAME',
> then LDAP attempts to bind with
> 'DOMAIN_NAME\NETID'
> rather than
> 'cn=NETID,ldap.object_context'
> . This change allows us to configure LDAP
> to bind with Active Directory out of the box.
>
> *. Modifed the LDAP search for user-info to take a SearchControls
> parameter that specifies a recursive tree-search under the
> ldap.search_context
> tree for a single user-object result.
> Once again - this allows LDAPAuthenticate to work
> with an Active Directory tree that has user objects
> organized into different folders under a tree.
>
> *. Modified LDAPAuthentication.getSpecialGroups
> to access the
> ldap.dspace.autogroup
> dspace.cfg configuration property
> to get the group-ids that an LDAP-authenticated
> user should be an implicit member of.
> This makes it easy to configure a system where
> every user that can authenticate can also
> submit material to some collections.
>
> *. Changed some of the if/else nesting in
> LDAPAuthentication.authenticate
> so that instead of having something like
> if ()
{
> ...
> return bla;
> } else {
> we have
> if () {> ...> return bla;> }
> ... // no else
> and instead of
> } else {
> if ()
{
> return goo
> }
> }
> we just have
> } else if () {
> just to make the control flow a little
> easier to look at.
>
> ----------------------------------
>
> $ svn diff pom.xml src/test src/main/java/org/dspace/authenticate >
> /tmp/bla
>
> Index: pom.xml
> ===================================================================
> — pom.xml (revision 2942)
> +++ pom.xml (working copy)
> @@ -61,6 +61,7 @@
>
>
http://dspace.svn.sourceforge.net/viewvc/dspace/branches/dspace-1_5_x/
dsp
> ace
>
>
> +
>
> @@ -188,6 +189,23 @@
> com.ibm.icu
> icu4j
>
> +
> + junit
> + junit
> + 3.8.1
> + test
> +
>
>
> -
> \ No newline at end of file
> +
> +
> +
> + src/test/resources
> +
> + log4j.properties
> +
> +
> +
> +
> +
> +
> Index: src/test/java/org/dspace/authenticate/SpeakerToLDAPCase.java
> ===================================================================
> —
> src/test/java/org/dspace/authenticate/SpeakerToLDAPCase.java (revision
> 0)
> +++
> src/test/java/org/dspace/authenticate/SpeakerToLDAPCase.java (revision
> 0)
> @@ -0,0 +1,56 @@
> +package org.dspace.authenticate;
> +
> +
> +import junit.framework.TestCase;
> +
> +import org.apache.log4j.Logger;
> +
> +/**
> + * Generic test runner for SpeakerToLDAP implementations.
> + */
> +public class SpeakerToLDAPCase extends TestCase {
> + private static final Logger olog = Logger.getLogger(
> SpeakerToLDAPCase.class );
> +
> + private SpeakerToLDAP oldap;
> + private String os_netid;
> + private String os_password;
> +
> +
> + /**
> + * Inject the test dependencies - initializes test properties
> + *
> + * @param s_name of test - pass to super
> + * @param ldap instance to authenticate agains
> + * @param s_netid user-id to authenticate as
> + * @param s_password for s_netid
> + */
> + public SpeakerToLDAPCase ( String s_name, SpeakerToLDAP ldap,
> + String s_netid, String s_password
> + )
{
> + super( s_name );
> + oldap = ldap;
> + os_netid = s_netid;
> + os_password = s_password;
> + }
> +
> + /**
> + * Try to authenticate against the constructor-supplied
> + * (SpeakerToLDAP, s_netid, s_password)
> + */
> + public void testAuthenticate() {
> + try
{
> + DataFromLDAP ldap_info = oldap.ldapAuthenticate( os_netid,
> os_password );
> + assertTrue( "Test user logged in ok: " + os_netid,
> + null != ldap_info
> + );
> + // need e-mail to key into eperson database
> + olog.info( "Got e-mail for " + os_netid + ": " +
> ldap_info.getEmail () );
> + assertTrue( "Got e-mail info for " + os_netid + " from
> ldap",
> + null != ldap_info.getEmail ()
> + );
> + }
catch ( Exception e )
{
> + olog.info( "Failed to authenticate user: " + os_netid, e
> );
> + assertTrue( "Failed to authenticate user: " + os_netid +
> ", caught: " + e, false );
> + }
> + }
> +}
> Index: src/test/java/org/dspace/authenticate/PackageTest.java
> ===================================================================
> —
> src/test/java/org/dspace/authenticate/PackageTest.java (revision
> 0)
> +++
> src/test/java/org/dspace/authenticate/PackageTest.java (revision
> 0)
> @@ -0,0 +1,40 @@
> +package org.dspace.authenticate;
> +
> +
> +import junit.framework.TestCase;
> +import junit.framework.TestSuite;
> +
> +import org.apache.log4j.Logger;
> +
> +/**
> + * Specialization of AbstactSpeakerToLDAPTest configured
> + * to run a DefaultSpeakerToLDAPTest through a test.
> + */
> +public class PackageTest extends TestCase {
> + private static final Logger olog = Logger.getLogger(
> PackageTest.class );
> +
> +
> + /**
> + * Build up the batch of tests to run for the
> org.dspace.authenticate
> + * package. You'll have to modify the properties injected into
> the
> + * test SpeakerToLDAP to work with your environment
> + */
> + public static TestSuite suite ()
{
> + TestSuite suite = new TestSuite( PackageTest.class.getName
> () );
> + SpeakerToLDAP ldap = new DefaultSpeakerToLDAP (
> "ldap://ldaps.university.edu",
> + "cn",
> +
> "OU=People,OU=AUMain,DC=auburn,DC=edu",
> +
> "WINDOWS_DOMAIN:AUBURN",
> + "mail",
> + "givenName",
> + "sn",
> +
> "telephoneNumber"
> + );
> + suite.addTest ( new SpeakerToLDAPCase( "testAuthenticate",
> ldap,
> + "USER", "PASSWORD"
> + )
> + );
> + return suite;
> + }
> +
> +}
> Index: src/test/resources/log4j.properties
> ===================================================================
> — src/test/resources/log4j.properties (revision 0)
> +++ src/test/resources/log4j.properties (revision 0)
> @@ -0,0 +1,9 @@
> +# Set root logger level to DEBUG and its only appender to A1.
> +log4j.rootLogger=DEBUG, A1
> +
> +# A1 is set to be a ConsoleAppender.
> +log4j.appender.A1=org.apache.log4j.ConsoleAppender
> +
> +# A1 uses PatternLayout.
> +log4j.appender.A1.layout=org.apache.log4j.PatternLayout
> +log4j.appender.A1.layout.ConversionPattern=%-4r [%t] %-5p %c %x -
> %m%n
> Index: src/main/java/org/dspace/authenticate/LDAPAuthentication.java
> ===================================================================
> —
> src/main/java/org/dspace/authenticate/LDAPAuthentication.java (revision
> 3054)
> +++
> src/main/java/org/dspace/authenticate/LDAPAuthentication.java (working
> copy)
> @@ -40,17 +40,11 @@
> package org.dspace.authenticate;
>
> import java.sql.SQLException;
> +import java.util.ArrayList;
> +import java.util.List;
> import java.util.Hashtable;
>
> -import javax.naming.NamingEnumeration;
> import javax.naming.NamingException;
> -import javax.naming.directory.Attribute;
> -import javax.naming.directory.Attributes;
> -import javax.naming.directory.BasicAttribute;
> -import javax.naming.directory.BasicAttributes;
> -import javax.naming.directory.DirContext;
> -import javax.naming.directory.InitialDirContext;
> -import javax.naming.directory.SearchResult;
> import javax.servlet.http.HttpServletRequest;
> import javax.servlet.http.HttpServletResponse;
>
> @@ -60,6 +54,7 @@
> import org.dspace.core.Context;
> import org.dspace.core.LogManager;
> import org.dspace.eperson.EPerson;
> +import org.dspace.eperson.Group;
>
> /**
> * Authentication module to authenticate against a flat LDAP tree
> where
> @@ -72,9 +67,66 @@
> implements AuthenticationMethod {
>
> /** log4j category */
> - private static Logger log =
> Logger.getLogger(LDAPAuthentication.class);
> + private static final Logger olog =
> Logger.getLogger(LDAPAuthentication.class);
>
> + private final SpeakerToLDAP oldap;
> +
> /**
> + * Constructor injects SpeakerToLDAP dependency
> + *
> + * @param ldap SpeakerToLDAP knows how to authenticate
> + * against and query the LDAP directory
> + * @param b_autoregister set true to auto-register an eperson
> + * for a new user that succesfully authenticates
> + * with LDAP
> + * @param v_special_group ids of user groups that an
> LDAP-authenticated
> + * user should be considered an implicit member of
> + */
> + public LDAPAuthentication ( SpeakerToLDAP ldap,
> + boolean b_autoregister,
> + int[] v_special_group
> + )
{
> + oldap = ldap;
> + ob_autoregister = b_autoregister;
> + ov_special_group = v_special_group;
> + }
> +
> + /**
> + * Constructor invoked by dspace.cfg based configuration
> + * engine sets up DefaultSpeakerToLDAP,
> + * checks ldap.autoregister and ldap.dspace.autogroup
> + * configuration values to determine canSelfRegister
> + * and getSpecialGroups property values.
> + */
> + public LDAPAuthentication () {
> + String s_groups =
> ConfigurationManager.getProperty("ldap.dspace.autogroup");
> +
> + List v_group_id = new ArrayList();
> + if ( null != s_groups ) {
> + String[] v_group_name = s_groups.trim ().split(
> ",
s*" );
> + for ( int i=0; i < v_group_name.length; ++i ) {
> + String s_group = v_group_name[i].trim ();
> + if ( s_group.length () > 0 ) {
> + try
{
> + v_group_id.add ( Integer.parseInt( s_group )
> );
> + }
catch ( Exception e )
{
> + olog.warn( "Exception parsing group " +
> s_group, e );
> + }
> + }
> + }
> + }
> + oldap = new DefaultSpeakerToLDAP ();
> + ob_autoregister =
> ConfigurationManager.getBooleanProperty("webui.ldap.autoregister");
> + ov_special_group = new int[ v_group_id.size () ];
> + int i_count = 0;
> + for ( Integer i_group_id : v_group_id )
{
> + ov_special_group[ i_count ] = i_group_id;
> + ++i_count;
> + }
> + }
> +
> + private final boolean ob_autoregister;
> + /**
> * Let a real auth method return true if it wants.
> */
> public boolean canSelfRegister(Context context,
> @@ -83,8 +135,7 @@
> throws SQLException
>
{
> // XXX might also want to check that username exists in LDAP.
> -
> - return
> ConfigurationManager.getBooleanProperty("webui.ldap.autoregister");
> + return ob_autoregister;
> }
>
> /**
> @@ -118,12 +169,10 @@
> return false;
> }
>
> - /*
> - * Nothing here.
> - */
> + private final int[] ov_special_group;
> public int[] getSpecialGroups(Context context, HttpServletRequest
> request)
>
{
> - return new int[0];
> + return ov_special_group;
> }
>
> /*
> @@ -139,261 +188,140 @@
> HttpServletRequest request)
> throws SQLException
> {
> - log.info(LogManager.getHeader(context, "auth", "attempting
> trivial auth of user="+netid));
> + olog.info(LogManager.getHeader(context, "auth", "attempting
> auth of user="+netid));
>
> // Skip out when no netid or password is given.
> - if (netid == null || password == null)
> - return BAD_ARGS;
> + if (netid == null || password == null)
{
> + return BAD_ARGS;
> + }
>
> // Locate the eperson
> - EPerson eperson = null;
> + EPerson eperson = null;
> try
>
{
> - eperson = EPerson.findByNetid(context,
> netid.toLowerCase());
> + eperson = EPerson.findByNetid(context,
> netid.toLowerCase());
> }
> catch (SQLException e)
>
{
> }
> - boolean loggedIn = false;
> - SpeakerToLDAP ldap = new SpeakerToLDAP(log);
>
> + olog.debug( "Found eperson for " + netid );
> +
> // if they entered a netid that matches an eperson
> if (eperson != null)
> {
> // e-mail address corresponds to active account
> - if (eperson.getRequireCertificate())
> + if (eperson.getRequireCertificate())
{
> return CERT_REQUIRED;
> - else if (!eperson.canLogIn())
> + }
else if (!eperson.canLogIn()) {
> return BAD_ARGS;
> - {
> - if (ldap.ldapAuthenticate(netid, password, context))
> -
{
> + }
> + try {
> + // authenticate
> + olog.debug( "Attempting LDAP auth-1 for " + netid );
> + DataFromLDAP ldap_info = oldap.ldapAuthenticate(
> netid, password );
> + if ( null != ldap_info )
{
> context.setCurrentUser(eperson =
> EPerson.findByNetid(context, netid.toLowerCase()));
> - log.info(LogManager
> - .getHeader(context, "authenticate",
> "type=ldap"));
> + olog.info(LogManager
> + .getHeader(context, "authenticate",
> "type=ldap"));
> return SUCCESS;
> - }
> - else
> - return BAD_CREDENTIALS;
> + }
> + } catch ( NamingException e )
{
> + olog.warn( "Failed to authenticate user: " + netid, e
> );
> }
> + //else
{
> + return BAD_CREDENTIALS;
> + }
> + // eperson == null
> + if ( null != eperson )
{
> + throw new AssertionError( "eperson should be null here!"
> );
> }
> -
> - // the user does not already exist so try and authenticate
> them
> - // with ldap and create an eperson for them
> - else
> - {
> - if (ldap.ldapAuthenticate(netid, password, context))
> - {
> - // Register the new user automatically
> - log.info(LogManager.getHeader(context,
> - "autoregister", "netid=" + netid));
> -
> - if
> ((ldap.ldapEmail!=null)&&(!ldap.ldapEmail.equals("")))
> - {
> - try
> - {
> - eperson = EPerson.findByEmail(context,
> ldap.ldapEmail);
> - if (eperson!=null)
> -
{
> - log.info(LogManager.getHeader(context,
> - "type=ldap-login",
> "type=ldap_but_already_email"));
> - context.setIgnoreAuthorization(true);
> - eperson.setNetid(netid);
> - eperson.update();
> - context.commit();
> - context.setIgnoreAuthorization(false);
> - context.setCurrentUser(eperson);
> - return SUCCESS;
> - }
> - else
> - {
> - if (canSelfRegister(context, request,
> netid))
> - {
> - // TEMPORARILY turn off
> authorisation
> - try
> -
{
> -
> context.setIgnoreAuthorization(true);
> - eperson =
> EPerson.create(context);
> - if
> ((ldap.ldapEmail!=null)&&(!ldap.ldapEmail.equals("")))
> eperson.setEmail(ldap.ldapEmail);
> - else eperson.setEmail(netid);
> - if
> ((ldap.ldapGivenName!=null)&&(!ldap.ldapGivenName.equals("")))
> eperson.setFirstName(ldap.ldapGivenName);
> - if
> ((ldap.ldapSurname!=null)&&(!ldap.ldapSurname.equals("")))
> eperson.setLastName(ldap.ldapSurname);
> - if
> ((ldap.ldapPhone!=null)&&(!ldap.ldapPhone.equals("")))
> eperson.setMetadata("phone", ldap.ldapPhone);
> - eperson.setNetid(netid);
> - eperson.setCanLogIn(true);
> -
> AuthenticationManager.initEPerson(context, request, eperson);
> - eperson.update();
> - context.commit();
> - context.setCurrentUser(eperson);
> - }
> - catch (AuthorizeException e)
> -
{
> - return NO_SUCH_USER;
> - }
> - finally
> -
{
> -
> context.setIgnoreAuthorization(false);
> - }
> -
> -
> log.info(LogManager.getHeader(context, "authenticate",
> - "type=ldap-login,
> created ePerson"));
> - return SUCCESS;
> - }
> - else
> -
{
> - // No auto-registration for valid
> certs
> -
> log.info(LogManager.getHeader(context,
> - "failed_login",
> "type=ldap_but_no_record"));
> - return NO_SUCH_USER;
> - }
> - }
> - }
> - catch (AuthorizeException e)
> -
{
> - eperson = null;
> - }
> - finally
> -
{
> - context.setIgnoreAuthorization(false);
> - }
> - }
> - }
> + olog.debug( "Attempting LDAP auth-2 for " + netid );
> + DataFromLDAP ldap_info = null;
> + try
{
> + ldap_info = oldap.ldapAuthenticate( netid, password );
> + }
catch ( NamingException e )
{
> + olog.warn( "Failed to authenticate user: " + netid, e );
> }
> - return BAD_ARGS;
> - }
> -
> - /**
> - * Internal class to manage LDAP query and results, mainly
> - * because there are multiple values to return.
> - */
> - public class SpeakerToLDAP {
> -
> - private Logger log = null;
> -
> - /** ldap email result */
> - protected String ldapEmail = null;
> -
> - /** ldap name result */
> - protected String ldapGivenName = null;
> - protected String ldapSurname = null;
> - protected String ldapPhone = null;
> -
> - SpeakerToLDAP(Logger thelog)
> - {
> - log = thelog;
> + if ( (null == ldap_info)
> + || (ldap_info.getEmail()==null)
> + || ldap_info.getEmail().equals("")
> + )
{
> + return BAD_ARGS; // failed to authenticate or get e-mail
> address
> }
>
> - /**
> - * contact the ldap server and attempt to authenticate
> - */
> - protected boolean ldapAuthenticate(String netid, String
> password, Context context)
> - {
> - if (!password.equals(""))
> - {
> - String ldap_provider_url =
> ConfigurationManager.getProperty("ldap.provider_url");
> - String ldap_id_field =
> ConfigurationManager.getProperty("ldap.id_field");
> - String ldap_search_context =
> ConfigurationManager.getProperty("ldap.search_context");
> - String ldap_object_context =
> ConfigurationManager.getProperty("ldap.object_context");
> -
> - // Set up environment for creating initial context
> - Hashtable env = new Hashtable(11);
> - env.put(javax.naming.Context.INITIAL_CONTEXT_FACTORY,
> "com.sun.jndi.ldap.LdapCtxFactory");
> - env.put(javax.naming.Context.PROVIDER_URL,
> ldap_provider_url);
> -
> - // Authenticate
> - env.put(javax.naming.Context.SECURITY_AUTHENTICATION,
> "simple");
> - env.put(javax.naming.Context.SECURITY_PRINCIPAL,
> ldap_id_field+"="netid","+ldap_object_context);
> - env.put(javax.naming.Context.SECURITY_CREDENTIALS,
> password);
> -
> - DirContext ctx = null;
> - try
> - {
> - // Create initial context
> - ctx = new InitialDirContext(env);
> -
> - String ldap_email_field =
> ConfigurationManager.getProperty("ldap.email_field");
> - String ldap_givenname_field =
> ConfigurationManager.getProperty("ldap.givenname_field");
> - String ldap_surname_field =
> ConfigurationManager.getProperty("ldap.surname_field");
> - String ldap_phone_field =
> ConfigurationManager.getProperty("ldap.phone_field");
> -
> - Attributes matchAttrs = new
> BasicAttributes(true);
> - matchAttrs.put(new BasicAttribute(ldap_id_field,
> netid));
> -
> - String attlist[] =
{ldap_email_field,
> ldap_givenname_field, ldap_surname_field, ldap_phone_field}
;
> -
> - // look up attributes
> - try
> - {
> - NamingEnumeration answer =
> ctx.search(ldap_search_context, matchAttrs, attlist);
> - while(answer.hasMore()) {
> - SearchResult sr =
> (SearchResult)answer.next();
> - Attributes atts = sr.getAttributes();
> - Attribute att;
> -
> - if (attlist[0]!=null)
> -
{
> - att = atts.get(attlist[0]);
> - if (att != null) ldapEmail =
> (String)att.get();
> - }
> -
> - if (attlist[1]!=null)
> -
{
> - att = atts.get(attlist[1]);
> - if (att != null) ldapGivenName =
> (String)att.get();
> - }
> -
> - if (attlist[2]!=null)
> -
{
> - att = atts.get(attlist[2]);
> - if (att != null) ldapSurname =
> (String)att.get();
> - }
> -
> - if (attlist[3]!=null)
> -
{
> - att = atts.get(attlist[3]);
> - if (att != null) ldapPhone =
> (String)att.get();
> - }
> - }
> + //
> + // autoregister the ldap-authenticated user
> + //
> + olog.info(LogManager.getHeader(context,
> + "autoregister", "netid=" +
> netid)
> + );
> +
> + try {
> + eperson = EPerson.findByEmail(context,
> ldap_info.getEmail());
> + if (eperson!=null)
{
> + // Just need to set the netid on the eperson record
> + olog.info(LogManager.getHeader(context,
> + "type=ldap-login",
> "type=ldap_but_already_email"));
> + context.setIgnoreAuthorization(true);
> + eperson.setNetid(netid);
> + eperson.update();
> + context.commit();
> + context.setIgnoreAuthorization(false);
> + context.setCurrentUser(eperson);
> + return SUCCESS;
> + }
else if (canSelfRegister(context, request, netid)) {
> + // TEMPORARILY turn off authorisation
> + try {
> + context.setIgnoreAuthorization(true);
> + eperson = EPerson.create(context);
> + eperson.setEmail(ldap_info.getEmail());
> + if ((ldap_info.getGivenName()!=null)
> + &&(!ldap_info.getGivenName().equals(""))
> + )
{
> +
> eperson.setFirstName(ldap_info.getGivenName());
> }
> - catch (NamingException e)
> - {
> - // if the lookup fails go ahead and create a
> new record for them because the authentication
> - // succeeded
> - log.warn(LogManager.getHeader(context,
> - "ldap_attribute_lookup",
> "type=failed_search "+e));
> - return true;
> + if ((ldap_info.getSurname()!=null)
> + &&(!ldap_info.getSurname().equals(""))
> + )
{
> + eperson.setLastName(ldap_info.getSurname());
> }
> - }
> - catch (NamingException e)
> -
{
> - log.warn(LogManager.getHeader(context,
> - "ldap_authentication",
> "type=failed_auth "+e));
> - return false;
> - }
> - finally
> - {
> - // Close the context when we're done
> - try
> - {
> - if (ctx != null)
> - ctx.close();
> + if ((ldap_info.getPhone()!=null)
> + &&(!ldap_info.getPhone().equals(""))
> + )
{
> + eperson.setMetadata("phone",
> ldap_info.getPhone());
> }
> - catch (NamingException e)
> -
{
> - }
> + eperson.setNetid(ldap_info.getNetId());
> + eperson.setCanLogIn(true);
> + AuthenticationManager.initEPerson(context,
> request, eperson);
> + eperson.update();
> + context.commit();
> + context.setCurrentUser(eperson);
> + } catch (AuthorizeException e)
{
> + return NO_SUCH_USER;
> + }
finally
{
> + context.setIgnoreAuthorization(false);
> }
> + olog.info(LogManager.getHeader(context,
> "authenticate",
> + "type=ldap-login,
> created ePerson"));
> + return SUCCESS;
> + } else {
> + // No auto-registration for valid certs
> + olog.info(LogManager.getHeader(context,
> + "failed_login",
> "type=ldap_but_no_record"));
> + return NO_SUCH_USER;
> }
> - else
> - {
> - return false;
> - }
> -
> - return true;
> + } catch (AuthorizeException e) {
> + eperson = null;
> + // authentication failed
> + return BAD_ARGS;
> + } finally {> + context.setIgnoreAuthorization(false);> }
> -
> -
> + // Unreachable!
> }
>
> +
> /*
> * Returns URL to which to redirect to obtain credentials (either
> password
> * prompt or e.g. HTTPS port for client cert.); null means no
> redirect.
> @@ -430,4 +358,4 @@
>
{
> return "org.dspace.eperson.LDAPAuthentication.title";
> }
> -}
> \ No newline at end of file
> +}
> Index: src/main/java/org/dspace/authenticate/DefaultSpeakerToLDAP.java
> ===================================================================
> —
> src/main/java/org/dspace/authenticate/DefaultSpeakerToLDAP.java
(revision
> 0)
> +++
> src/main/java/org/dspace/authenticate/DefaultSpeakerToLDAP.java
(revision
> 0)
> @@ -0,0 +1,183 @@
> +package org.dspace.authenticate;
> +
> +import java.util.Hashtable;
> +
> +import javax.naming.NamingEnumeration;
> +import javax.naming.NamingException;
> +import javax.naming.directory.Attribute;
> +import javax.naming.directory.Attributes;
> +import javax.naming.directory.BasicAttribute;
> +import javax.naming.directory.BasicAttributes;
> +import javax.naming.directory.DirContext;
> +import javax.naming.directory.InitialDirContext;
> +import javax.naming.directory.SearchControls;
> +import javax.naming.directory.SearchResult;
> +
> +import org.apache.log4j.Logger;
> +import org.dspace.core.ConfigurationManager;
> +
> +/**
> + * Internal class to manage LDAP query and results, mainly
> + * because there are multiple values to return.
> + */
> +public class DefaultSpeakerToLDAP implements SpeakerToLDAP {
> + private static final Logger olog =
> Logger.getLogger(DefaultSpeakerToLDAP.class);
> + private final String os_provider_url;
> + private final String os_id_field;
> + private final String os_search_context;
> + private final String os_object_context;
> + private final String os_email_field;
> + private final String os_givenname_field;
> + private final String os_surname_field;
> + private final String os_phone_field;
> +
> +
> + /**
> + * Constructor allows injection of
> + * configuration parameters.
> + *
> + * @param s_provider_url to the server - we assume simple
> authentication
> + * @param s_id_field attribute of user object - usually cn
> + * @param s_search_context subtree under which to search for user
> info,
> + * ex: ou=People,dc=myschool,dc=edu
> + * @param s_object_context of user bind-path -
> + * ex: ou=People,dc=myschool,dc=edu leads to bind attempt
> + * againt cn=username,ou=People,dc=myschool,dc=edu
> + * @param s_email_field in user record
> + * @param s_givenname_field in user record
> + * @param s_surname_field in user record, usually sn
> + * @param s_phone_field in user record
> + */
> + public DefaultSpeakerToLDAP( String s_provider_url,
> + String s_id_field,
> + String s_search_context,
> + String s_object_context,
> + String s_email_field,
> + String s_givenname_field,
> + String s_surname_field,
> + String s_phone_field
> + )
> +
{
> + os_provider_url = s_provider_url;
> + os_id_field = s_id_field;
> + os_search_context = s_search_context;
> + os_object_context = s_object_context;
> + os_email_field = s_email_field;
> + os_givenname_field = s_givenname_field;
> + os_surname_field = s_surname_field;
> + os_phone_field = s_phone_field;
> + }
> +
> + /**
> + * Default constructor extracts LDAP-server parameters
> + * from ConfigurationManager (dspace.cfg):
> + * ldap.provider_url, ldap_id_field,
> + * ldap_search_contect, ldap_object_context
> + */
> + public DefaultSpeakerToLDAP()
{
> + os_provider_url =
> ConfigurationManager.getProperty("ldap.provider_url");
> + os_id_field =
> ConfigurationManager.getProperty("ldap.id_field");
> + os_search_context =
> ConfigurationManager.getProperty("ldap.search_context");
> + os_object_context =
> ConfigurationManager.getProperty("ldap.object_context");
> + os_email_field =
> ConfigurationManager.getProperty("ldap.email_field");
> + os_givenname_field =
> ConfigurationManager.getProperty("ldap.givenname_field");
> + os_surname_field =
> ConfigurationManager.getProperty("ldap.surname_field");
> + os_phone_field =
> ConfigurationManager.getProperty("ldap.phone_field");
> + }
> +
> + /**
> + * contact the ldap server and attempt to authenticate
> + */
> + public DataFromLDAP ldapAuthenticate(String s_netid, String
> s_password ) throws NamingException
> + {
> + if (s_password.equals(""))
> +
{
> + return null;
> + }
> + // Set up environment for creating initial context
> + Hashtable env = new Hashtable(11);
> + env.put(javax.naming.Context.INITIAL_CONTEXT_FACTORY,
> "com.sun.jndi.ldap.LdapCtxFactory");
> + env.put(javax.naming.Context.PROVIDER_URL, os_provider_url);
> +
> + // Authenticate
> + env.put(javax.naming.Context.SECURITY_AUTHENTICATION,
> "simple");
> + final String s_ad_key = "WINDOWS_DOMAIN:";
> + if ( os_object_context.toUpperCase ().startsWith( s_ad_key ) )
>
{
> + // Active Directory bind
> + String s_principal = os_object_context.substring(
> s_ad_key.length () ) + "\\" + s_netid;
> + olog.debug( "Binding principal to: " + s_principal );
> + env.put(javax.naming.Context.SECURITY_PRINCIPAL,
> s_principal );
> + }
else
{
> + env.put(javax.naming.Context.SECURITY_PRINCIPAL,
> os_id_field+"="+s_netid+","+os_object_context);
> + }
> + env.put(javax.naming.Context.SECURITY_CREDENTIALS,
> s_password);
> +
> + DirContext ctx = new InitialDirContext(env);
> + try {
> + Attributes search_attributes = new BasicAttributes(true);
> + search_attributes.put(new BasicAttribute(os_id_field,
> s_netid));
> +
> + String[] v_result_atts =
{os_email_field,
> os_givenname_field, os_surname_field, os_phone_field}
;
> +
> + olog.debug( "Searching LDAP for " + os_id_field + "=" +
> s_netid
> + + " under " + os_search_context
> + );
> +
> + NamingEnumeration answer = ctx.search(os_search_context,
> + "(" + os_id_field +
> "=" + s_netid + ")",
> + new SearchControls(
> SearchControls.SUBTREE_SCOPE,
> +
> 1, 20000,
> +
> v_result_atts,
> +
> false, false
> +
> )
> + );
> + if( ! answer.hasMore())
{
> + olog.info( "Able to bind as " + s_netid + ", but
> unable to find LDAP record" );
> + return null;
> + }
> + // look up attributes
> + String ldapEmail = null;
> + String ldapGivenName = null;
> + String ldapSurname = null;
> + String ldapPhone = null;
> + SearchResult sr = (SearchResult)answer.next();
> + Attributes atts = sr.getAttributes();
> + Attribute att;
> +
> + if (v_result_atts[0]!=null)
{
> + att = atts.get(v_result_atts[0]);
> + if (att != null) ldapEmail = (String)att.get();
> + }
> +
> + if (v_result_atts[1]!=null) {
> + att = atts.get(v_result_atts[1]);
> + if (att != null)
{
> + ldapGivenName = (String)att.get();
> + }
> + }
> +
> + if (v_result_atts[2]!=null) {
> + att = atts.get(v_result_atts[2]);
> + if (att != null)
{
> + ldapSurname = (String)att.get();
> + }
> + }
> +
> + if (v_result_atts[3]!=null) {
> + att = atts.get(v_result_atts[3]);
> + if (att != null)
{
> + ldapPhone = (String)att.get();
> + }
> + }
> + return new SimpleDataFromLDAP( ldapEmail, ldapGivenName,
> ldapSurname, ldapPhone, s_netid );
> + } finally {
> + // Close the context when we're done
> + try {
> + if (ctx != null)
{
> + ctx.close();
> + }
> + } catch (NamingException e) { }
> + }
> + // Unreachable
> + }
> +}
> Index: src/main/java/org/dspace/authenticate/SimpleDataFromLDAP.java
> ===================================================================
> —
> src/main/java/org/dspace/authenticate/SimpleDataFromLDAP.java (revision
> 0)
> +++
> src/main/java/org/dspace/authenticate/SimpleDataFromLDAP.java (revision
> 0)
> @@ -0,0 +1,48 @@
> +package org.dspace.authenticate;
> +
> +
> +/**
> + * Simple implementation of DataFromLDAP
> + */
> +public class SimpleDataFromLDAP implements DataFromLDAP {
> + /**
> + * Constructor injects all the property values
> + */
> + public SimpleDataFromLDAP ( String s_email,
> + String s_given_name,
> + String s_surname,
> + String s_phone,
> + String s_netid
> + )
{
> + os_email = s_email;
> + os_given_name = s_given_name;
> + os_surname = s_surname;
> + os_phone = s_phone;
> + os_netid = s_netid;
> + }
> +
> + private final String os_email;
> + public String getEmail ()
{
> + return os_email;
> + }
> +
> + private final String os_given_name;
> + public String getGivenName ()
{
> + return os_given_name;
> + }
> +
> + private final String os_surname;
> + public String getSurname()
{
> + return os_surname;
> + }
> +
> + private final String os_phone;
> + public String getPhone ()
{
> + return os_phone;
> + }
> +
> + private final String os_netid;
> + public String getNetId ()
{
> + return os_netid;
> + }
> +}
> Index: src/main/java/org/dspace/authenticate/SpeakerToLDAP.java
> ===================================================================
> —
> src/main/java/org/dspace/authenticate/SpeakerToLDAP.java (revision
> 0)
> +++
> src/main/java/org/dspace/authenticate/SpeakerToLDAP.java (revision
> 0)
> @@ -0,0 +1,20 @@
> +package org.dspace.authenticate;
> +
> +import javax.naming.NamingException;
> +
> +/**
> + * Interface for LDAP interaction handler
> + */
> +public interface SpeakerToLDAP
{
> + /**
> + * Authenticate the given user with LDAP,
> + * and get some data about him/her from the directory.
> + *
> + *
@param s_netid cn of the user to authenticate
> + *
@param s_password
> + *
@return user info
> + */
> + public DataFromLDAP ldapAuthenticate( String s_netid,
> + String s_password
> + ) throws NamingException;
> +}
> Index: src/main/java/org/dspace/authenticate/DataFromLDAP.java
> ===================================================================
> —
> src/main/java/org/dspace/authenticate/DataFromLDAP.java (revision
> 0)
> +++
> src/main/java/org/dspace/authenticate/DataFromLDAP.java (revision
> 0)
> @@ -0,0 +1,15 @@
> +package org.dspace.authenticate;
> +
> +
> +/**
> + * POJO data bucket interface for user-data obtained during
> + * LDAP authentication
> + */
> +public interface DataFromLDAP
{
> + public String getEmail ();
> + public String getGivenName ();
> + public String getSurname();
> + public String getPhone ();
> + /** LDAP common name (cn) for the user */
> + public String getNetId ();
> +}
>
>
>
>
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent