LDAPRoles.java revision a82d04bc19fee9d5e34b41ccd7641da1f62ab634
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2006 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: LDAPRoles.java,v 1.8 2009/11/20 23:52:55 ww203982 Exp $
*
* Portions Copyrighted 2011-2015 ForgeRock AS.
* Portions Copyrighted 2012 Open Source Solution Technology Corporation
*/
/**
* This class represents a group of LDAP roles
*/
/*
* Cache for user's LDAPRoles based on the
* external directory server where the
* LDAPRoles are retrieved from.
* key for this cache would be token ID and
* value would be Map of ldap server to an array of 2 Objects,
* one being the timeToLive
* 2 being the Set of all the user roles
* tokenID ----> ldapServer1 --> [timeToLive, set of rolesDNS]
* ldapServer2 --> [timeToLive, set of rolesDNS]
* ....
* ....
*/
public static Map userLDAPRoleCache =
// Variables
private boolean initialized = false;
private String roleSearchFilter;
private String userSearchFilter;
private String roleRDNAttrName;
private String userRDNAttrName;
private int timeLimit;
private int maxResults;
private boolean sslEnabled = false;
private int minPoolSize;
private int maxPoolSize;
private ConnectionFactory connPool;
private boolean localDS;
private boolean aliasEnabled;
private String ldapServer;
// Debug
/**
* Constructor with no parameter
*/
public LDAPRoles() {
// do nothing
}
/**
* Initialize the LDAPGroup object by using the configuration
* information passed by the Policy Framework.
* @param configParams the configuration information
* @exception PolicyException if an error occured during
* initialization of the instance
*/
if (configParams == null) {
}
if (configuredLdapServer == null) {
+ "server name. If you enter more than one server name "
+ "in the policy config service's Primary LDAP Server "
+ "field, please make sure the ldap server name is preceded "
+ "with the local server name.");
}
}
} else {
}
try {
} catch (NumberFormatException nfe) {
throw (new PolicyException(nfe));
}
sslEnabled = true;
} else {
sslEnabled = false;
}
// get the organization name
}
if (debug.messageEnabled()) {
+ "\nldapServer: " + ldapServer
+ "\nauthid: " + authid
+ "\nbaseDN: " + baseDN
+ "\nroleSearchFilter: " + roleSearchFilter
+ "\nroleRDNAttrName: " + roleRDNAttrName
+ "\nuserSearchFilter: " + userSearchFilter
+ "\nuserRDNAttrName: " + userRDNAttrName
+ "\ntimeLimit: " + timeLimit
+ "\nmaxResults: " + maxResults
+ "\nminPoolSize: " + minPoolSize
+ "\nmaxPoolSize: " + maxPoolSize
+ "\nSSLEnabled: " + sslEnabled
+ "\nOrgName: " + orgName);
}
// initialize the connection pool for the ldap server
LDAPConnectionPools.initConnectionPool(ldapServer, authid, authpw, sslEnabled, minPoolSize, maxPoolSize,
options);
initialized = true;
}
/**
* Returns the syntax of the values the <code>LDAPRoles</code>
* @see com.sun.identity.policy.Syntax
* @param token the <code>SSOToken</code> that will be used
* to determine the syntax
* @return set of of valid names for the user collection.
* @exception SSOException if <code>SSOToken></code> is not valid
*/
return (Syntax.MULTIPLE_CHOICE);
}
/**
* Returns a list of possible values for the <code>LDAPRoles
* </code>.
*
* @param token the <code>SSOToken</code> that will be used
* to determine the possible values
*
* @return <code>ValidValues</code> object
*
* @exception SSOException if <code>SSOToken></code> is not valid
* @exception PolicyException if unable to get the list of valid
* names.
*/
}
/**
* Returns a list of possible values for the <code>LDAPRoles
* </code> that satisfy the given <code>pattern</code>.
*
* @param token the <code>SSOToken</code> that will be used
* to determine the possible values
* @param pattern search pattern that will be used to narrow
* the list of valid names.
*
* @return <code>ValidValues</code> object
*
* @exception SSOException if <code>SSOToken></code> is not valid
* @exception PolicyException if unable to get the list of valid
* names.
*/
throws SSOException, PolicyException {
if (!initialized) {
}
} else {
}
if (debug.messageEnabled()) {
+ searchFilter);
}
SearchRequest searchRequest = LDAPRequests.newSearchRequest(baseDN, roleSearchScope, searchFilter, attrs);
if (reader.isReference()) {
//Ignore
} else {
}
}
}
} catch (LdapException le) {
}
if (additionalMsg != null) {
} else {
throw new PolicyException(errorMsg);
}
} catch (Exception e) {
throw new PolicyException(e);
}
}
/**
* Returns the display name for the value for the given locale.
* For all the valid values obtained through the methods
* <code>getValidValues</code> this method must be called
* by GUI and CLI to get the corresponding display name.
* The <code>locale</code> variable could be used by the
* plugin to customize the display name for the given locale.
* The <code>locale</code> variable could be <code>null</code>,
* in which case the plugin must use the default locale (most probabily
* en_US).
* Alternatively, if the plugin does not have to localize
* the value, it can just return the <code>value</code> as is.
*
* @param value one of the valid value for the plugin
* @param locale locale for which the display name must be customized
*
* @exception NameNotFoundException if the given <code>value</code>
* is not one of the valid values for the plugin
*/
throws NameNotFoundException {
}
/**
* Returns the values that was set using the
* method <code>setValues</code>.
*
* @return <code>Set</code> of values that have been set for the
* user collection.
*/
if (debug.messageEnabled()) {
}
return selectedRoleDNs;
}
/**
* Sets the names for the instance of the <code>LDAPRoles</code>
* object. The names are obtained from the policy object,
* usually configured when a policy is created.
*
* @param names names selected for the instance of
* the user collection object.
*
* @exception InvalidNameException if the given names are not valid
*/
"ldaproles_subject_invalid_group_names", null,
}
selectedRoleDNs = new HashSet<>();
if (debug.messageEnabled()) {
}
selectedRFCRoleDNs = new HashSet<>();
// add to the RFC Set now
toLowerCase());
}
}
/**
* Determines if the user identified by the token,
* belongs to this instance of the <code>LDAPRoles</code> object.
*
* @param token single-sign-on token of the user
*
* @return <code>true</code> if the user is member of the
* given subject; <code>false</code> otherwise.
*
* @exception SSOException if <code>SSOToken</code> is not valid
* @exception PolicyException if an error occured while
* checking if the user is a member of this subject
*/
throws SSOException, PolicyException {
boolean roleMatch = false;
boolean listenerAdded = false;
if (debug.messageEnabled()) {
}
if (result) {
return result;
} else {
continue;
}
}
// came here so no entry in subject eval cache
if (debug.messageEnabled()) {
+ "cache, getting from LDAPRole cache");
}
if (debug.messageEnabled()) {
+ " is not found in the directory");
}
return false;
}
}
}
if (!listenerAdded) {
tokenID))
{
if (debug.messageEnabled()) {
+ "added .\n");
}
listenerAdded = true;
}
}
// check if the user belongs to any of the selected roles
roleMatch = true;
}
}
if (debug.messageEnabled()) {
"is not a member of";
+", adding to Subject eval cache");
}
if (roleMatch) {
break;
}
}
}
if (debug.messageEnabled()) {
if (!roleMatch) {
+ " is not a member of this LDAPRoles object");
} else {
+ " is a member of this LDAPRoles object");
}
}
return roleMatch;
}
/**
* Return a hash code for this <code>LDAPRoles</code>.
*
* @return a hash code for this <code>LDAPRoles</code> object.
*/
public int hashCode() {
return selectedRoleDNs.hashCode();
}
/**
* Indicates whether some other object is "equal to" this one.
*
* @param o another object that will be compared with this one
*
* @return <code>true</code> if eqaul; <code>false</code>
* otherwise
*/
if (o instanceof LDAPRoles) {
if ((selectedRoleDNs != null)
return true;
}
}
return false;
}
/**
* Creates and returns a copy of this object.
*
* @return a copy of this object
*/
try {
} catch (CloneNotSupportedException e) {
// this should never happen
throw new InternalError();
}
if (selectedRoleDNs != null) {
}
if (selectedRFCRoleDNs != null) {
}
return theClone;
}
/**
* returns user's roles from userLDAPRoleCache if found,
* else gets users roles from the directory
* @return <code>Set</code> of Role DNs.
*/
{
return null;
}
if (timeToLive > currentTime) {
if (debug.messageEnabled()) {
+ " get the nsrole values from cache.\n");
}
}
}
}
// add or update the cache entry.
// we come here either the token is not registered with the
// cache or the cache element is out of date.
// get the user DN from the directory server.
}
}
// If the cache is enabled
== null)
{
} else {
}
}
}
return roles;
}
/**
* Gets the <code>LDAPEntry</code> for a user identified
* by the token. The base DN used to perform the user search
* is the DN of the user if the user is local to speed
* up the search, but if user is not local then the base DN as
* configured in the policy config service is used.
*/
{
if (debug.messageEnabled()) {
+ userLocalDN);
}
// if it is local, then we search the user entry only
}
// try to figure out the user name from the local user DN
(beginIndex >= endIndex)) {
}
if ((userSearchFilter != null)
} else {
}
if (debug.messageEnabled()) {
+ searchFilter);
}
// search the remote ldap and find out the user DN
SearchRequest searchRequest = LDAPRequests.newSearchRequest(searchBaseDN, userSearchScope, searchFilter,
myAttrs);
if (reader.isReference()) {
//Ignore
} else {
}
}
} catch (LdapException le) {
}
if (additionalMsg != null) {
} else {
throw new PolicyException(errorMsg);
}
} catch (Exception e) {
throw new PolicyException(e);
}
// we only take the first qualified DN
}
return null;
}
}