LDAPGroups.java revision bee2440354b4bc8796e1de0b6cbd60e1f68deba0
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: LDAPGroups.java,v 1.8 2009/11/20 23:52:55 ww203982 Exp $
*
* Portions Copyrighted 2011-2015 ForgeRock AS.
* Portions Copyrighted 2012 Open Source Solution Technology Corporation
*/
/**
* This class respresents a group of LDAP groups
*/
public class LDAPGroups implements Subject {
// Variables
private boolean initialized = false;
private String groupSearchFilter;
private String userSearchFilter;
private String groupRDNAttrName;
private String userRDNAttrName;
private int timeLimit;
private int maxResults;
private boolean sslEnabled = false;
private int minPoolSize;
private int maxPoolSize;
private ConnectionFactory connPool;
private boolean localDS;
private boolean aliasEnabled;
private String ldapServer;
// Debug
/**
* no argument constructor.
*/
public LDAPGroups() {
// do nothing
}
/**
* Initialize the LDAPGroup object by using the configuration
* information passed by the Policy Framework.
* @param configParams the configuration information
* @exception PolicyException if an error occured during
* initialization of the instance
*/
if (configParams == null) {
}
if (configuredLdapServer == null) {
+ "server name. If you enter more than one server name "
+ "in the policy config service's Primary LDAP Server "
+ "field, please make sure the ldap server name is preceded "
+ "with the local server name.");
}
}
} else {
}
} else {
}
try {
} catch (NumberFormatException nfe) {
throw (new PolicyException(nfe));
}
sslEnabled = true;
} else {
sslEnabled = false;
}
// get the organization name
}
if (debug.messageEnabled()) {
+ "\nldapServer: " + ldapServer
+ "\nauthid: " + authid
+ "\nbaseDN: " + baseDN
+ "\ngroupSearchFilter: " + groupSearchFilter
+ "\ngroupRDNAttrName: " + groupRDNAttrName
+ "\nuserSearchFilter: " + userSearchFilter
+ "\nuserRDNAttrName: " + userRDNAttrName
+ "\ntimeLimit: " + timeLimit
+ "\nmaxResults: " + maxResults
+ "\nminPoolSize: " + minPoolSize
+ "\nmaxPoolSize: " + maxPoolSize
+ "\nSSLEnabled: " + sslEnabled
+ "\nOrgName: " + orgName);
}
// initialize the connection pool for the ldap server
LDAPConnectionPools.initConnectionPool(ldapServer, authid, authpw, sslEnabled, minPoolSize, maxPoolSize,
options);
initialized = true;
}
/**
* Returns the syntax of the values the <code>LDAPGroups</code>
* @see com.sun.identity.policy.Syntax
* @param token the <code>SSOToken</code> that will be used
* to determine the syntax
* @return set of of valid names for the user collection.
* @exception SSOException if <code>SSOToken</code> is not valid
*/
return (Syntax.MULTIPLE_CHOICE);
}
/**
* Returns a list of possible values for the <code>LDAPGroups
* </code>.
*
* @param token the <code>SSOToken</code> that will be used
* to determine the possible values
*
* @return <code>ValidValues</code> object
*
* @exception SSOException if <code>SSOToken</code> is not valid
* @exception PolicyException if unable to get the list of valid
* names.
*/
}
/**
* Returns a list of possible values for the <code>LDAPGroups
* </code> that satisfy the given <code>pattern</code>.
*
* @param token the <code>SSOToken</code> that will be used
* to determine the possible values
* @param pattern search pattern that will be used to narrow
* the list of valid names.
*
* @return <code>ValidValues</code> object
*
* @exception SSOException if <code>SSOToken</code> is not valid
* @exception PolicyException if unable to get the list of valid
* names.
*/
throws SSOException, PolicyException {
if (!initialized) {
throw new PolicyException(ResBundleUtils.rbName, "ldapgroups_subject_not_yet_initialized", null, null);
}
} else {
}
SearchRequest searchRequest = Requests.newSearchRequest(baseDN, groupSearchScope, searchFilter, attrs);
if (reader.isReference()) {
//Ignore
} else {
}
}
}
} catch (ErrorResultException lde) {
}
if (additionalMsg != null) {
} else {
throw new PolicyException(errorMsg);
}
} catch (Exception e) {
throw new PolicyException(e);
}
}
/**
* Returns the display name for the value for the given locale.
* For all the valid values obtained through the methods
* <code>getValidValues</code> this method must be called
* by GUI and CLI to get the corresponding display name.
* The <code>locale</code> variable could be used by the
* plugin to customize the display name for the given locale.
* The <code>locale</code> variable could be <code>null</code>,
* in which case the plugin must use the default locale (most probabily
* en_US).
* Alternatively, if the plugin does not have to localize
* the value, it can just return the <code>value</code> as is.
*
* @param value one of the valid value for the plugin
* @param locale locale for which the display name must be customized
*
* @exception NameNotFoundException if the given <code>value</code>
* is not one of the valid values for the plugin
*/
throws NameNotFoundException {
}
/**
* Returns the values that was set using the
* method <code>setValues</code>.
*
* @return values that have been set for the user collection
*/
if (debug.messageEnabled()) {
}
return selectedGroupDNs;
}
/**
* Sets the names for the instance of the <code>LDAPGroups</code>
* object. The names are obtained from the policy object,
* usually configured when a policy is created.
*
* @param names names selected for the instance of
* the user collection object.
*
* @exception InvalidNameException if the given names are not valid
*/
"ldapgroups_subject_invalid_group_names", null,
}
selectedGroupDNs = new HashSet();
if (debug.messageEnabled()) {
"LDAPGroups.setValues(): selected group names="
+ selectedGroupDNs);
}
// add to the RFC Set now
selectedRFCGroupDNs = new HashSet();
}
}
/**
* Determines if the user belongs to this instance
* of the <code>LDAPGroups</code> object.
*
* @param token single-sign-on token of the user
*
* @return <code>true</code> if the user is memeber of the
* given subject; <code>false</code> otherwise.
*
* @exception SSOException if <code>SSOToken>/code> is not valid
* @exception PolicyException if an error occured while
* checking if the user is a member of this subject
*/
throws SSOException, PolicyException {
return false;
}
boolean listenerAdded = false;
if (debug.messageEnabled()) {
+ userLocalDN);
}
while (groupsIter.hasNext()) {
boolean result = matchFound;
if (result) {
return true;
} else {
continue;
}
}
// got here so entry not in subject evalauation cache
if (debug.messageEnabled()) {
+ "directory server.", groupDN);
}
}
} else {
// try to figure out the user name from the local
// user DN
}
return false;
}
}
if (!listenerAdded) {
listenerAdded = true;
}
}
return true;
}
}
}
return false;
}
/**
* Find out if a user belongs to a particular group
* @param groupName the ldap DN of the group
* @param userDN the ldap DN of the user
* @return <code>true</code> if the user is member of the group;
* <code>false</code> otherwise.
*/
throws SSOException, PolicyException {
if (debug.messageEnabled()) {
+ " entering with groupName = " + groupName
+ ",userDN = " + userDN);
}
return false;
}
boolean groupMatch = false;
} catch (Exception e) {
return false;
}
groupMatch = true;
break;
}
}
}
if (!groupMatch) {
debug.message("LDAPGroups.isMemberOfGroup(): get {} group attribute", STATIC_GROUP_MEMBER_ALT_ATTR);
groupMatch = true;
break;
}
}
}
}
if (!groupMatch) {
try {
groupMatch = true;
break;
}
}
} catch (LocalizedIllegalArgumentException e) {
throw new PolicyException(e);
}
}
}
}
debug.message("LDAPGroups.isMemberOfGroup():adding entry {} {} {} {} in subject evaluation cache.", tokenID,
return groupMatch;
}
/**
* Finds the dynamic group member DNs
* @param url the url to be used for the group member search
* @return the set of group member DNs satisfied the search url
*/
throws PolicyException {
// Need to pass the user dn in the filter
if (index != 0) {
} else {
}
if (reader.isReference()) {
//Ignore
} else {
}
}
}
} catch (ErrorResultException le) {
} else {
throw new PolicyException(le);
}
} catch (Exception e) {
throw new PolicyException(e);
}
return groupMemberDNs;
}
/**
* Return a hash code for this <code>LDAPGroups</code>.
*
* @return a hash code for this <code>LDAPGroups</code> object.
*/
public int hashCode() {
return selectedGroupDNs.hashCode();
}
/**
* Indicates whether some other object is "equal to" this one.
*
* @param o another object that will be compared with this one
*
* @return <code>true</code> if eqaul; <code>false</code>
* otherwise
*/
if (o instanceof LDAPGroups) {
LDAPGroups g = (LDAPGroups) o;
if ((selectedGroupDNs != null)
&& (g.selectedGroupDNs != null)
return true;
}
}
return false;
}
/**
* Creates and returns a copy of this object.
*
* @return a copy of this object
*/
try {
} catch (CloneNotSupportedException e) {
// this should never happen
throw new InternalError();
}
if (selectedGroupDNs != null) {
}
if (selectedRFCGroupDNs != null) {
}
return theClone;
}
/**
* Get the full DN for the user using the RDN against the
* LDAP server configured in the policy config service.
*/
if ((userSearchFilter != null)
} else {
}
if (debug.messageEnabled()) {
"LDAPGroups.getUserDN(): search filter is: "
+ searchFilter);
}
SearchRequest searchRequest = Requests.newSearchRequest(baseDN, userSearchScope, searchFilter, attrs);
if (reader.isReference()) {
//Ignore
} else {
}
}
}
} catch (ErrorResultException le) {
}
if (additionalMsg != null) {
} else {
throw new PolicyException(errorMsg);
}
} catch (Exception e) {
throw new PolicyException(e);
}
// check if the user belongs to any of the selected groups
// we only take the first qualified DN if the DN
}
}
return userDN;
}
}