SMSLdapObject.java revision ce4d3fddc8fe2eddd68a20af9570b3cc63ece5ab
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2005 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: SMSLdapObject.java,v 1.27 2009/11/20 23:52:56 ww203982 Exp $
*
* Portions Copyrighted 2011-2015 ForgeRock AS.
*/
/**
* This object represents an LDAP entry in the directory server. The UMS have an
* equivalent class called PersistentObject. The SMS could not integrate with
* PersistentObject, because of the its dependecy on the Session object. This
* would mean that, to instantiate an PersistentObject inside SMS, we need to
* create an UMS instance, which would be having directory parameters of SMS.
* <p>
* This class is used both to read and write information into the directory
* server. The appropriate constructors discusses it is done.
* <p>
* There can be only three types of SMS entries in the directory (i) entry with
* organizationUnit object class (attribute: ou) (ii) entry with sunService
* object class (attributes: ou, labeledURI, sunServiceSchema, sunPluginSchema,
* and sunKeyValue (sunXMLKeyValue, in the future) (iii) entry with
* sunServiceComponent object class (attributes: ou, sunServiceID,
* sunSMSPriority, sunKeyValue. All the schema, configuration and plugin entries
* will be stored using the above entries.
*/
// LDAP specific & retry paramters
static SMDataLayer smdlayer;
static int connNumRetry = 3;
static int connRetryInterval = 1000;
static int entriesPresentCacheSize = 1000;
static boolean initializedNotification;
// Other parameters
static ResourceBundle bundle;
boolean initialized;
static boolean enableProxy;
// Admin SSOToken
static Principal adminPrincipal;
/**
* Public constructor for SMSLdapObject
*/
public SMSLdapObject() throws SMSException {
// Initialized (should be called only once by SMSEntry)
initialize();
}
/**
* Synchronized initialized method
*/
private synchronized void initialize() throws SMSException {
if (initialized) {
return;
}
// Obtain the I18N resource bundle & Debug
if (debug.messageEnabled()) {
}
try {
if (enableProxy) {
// Initialize the principal, used only with AMSDK
// for proxy connections
// Get UMS datalayer
if (debug.messageEnabled()) {
+ "obtained.");
}
} else {
// Get SM datalayer
if (debug.messageEnabled()) {
+ "obtained.");
}
}
}
// Get connection retry parameters
// Need to check if the root nodes exists. If not, create them
if (!entryExists(serviceDN)) {
}
} catch (Exception e) {
// Unable to initialize (trouble!!)
}
initialized = true;
}
private void initializeNotification() {
if (!initializedNotification) {
// If cache is enabled, register for notification to maintian
// internal cache of entriesPresent
if (SMSNotificationManager.isCacheEnabled()) {
.registerCallbackHandler(this);
}
initializedNotification = true;
}
}
/**
* Reads in the object from persistent store, assuming that the guid and the
* SSOToken are valid
*/
// This must not be possible return an exception.
}
}
// Check if entry does not exist
return null;
}
int retry = 0;
while (retry <= connNumRetry) {
break;
} catch (LdapException e) {
// Add to not present Set
break;
} else {
throw new SMSException(e, "sms-entry-cannot-access");
}
}
retry++;
try {
} catch (InterruptedException ex) {
// ignored
}
}
}
if (debug.messageEnabled()) {
}
} else {
return null;
}
}
/**
* Create an entry in the directory
*/
throws SMSException, SSOException {
// Call the private method that takes the principal name
// Update entryPresent cache
}
/**
* Create an entry in the directory using the principal name
*/
throws SMSException, SSOException {
int retry = 0;
while (retry <= connNumRetry) {
break;
} catch (LdapException e) {
// During install time and other times,
// this error gets throws due to unknown issue. Issue:
// Hence mask it.
break;
}
throw new SMSException(e, "sms-entry-cannot-create");
}
retry++;
try {
} catch (InterruptedException ex) {
//ignored
}
}
}
}
/**
* Save the entry using the token provided. The principal provided will be
* used to get the proxy connection.
*/
throws SMSException, SSOException {
int retry = 0;
while (retry <= connNumRetry) {
break;
} catch (LdapException e) {
throw new SMSException(e, "sms-entry-cannot-modify");
}
retry++;
try {
} catch (InterruptedException ex) {
// ignored
}
}
}
}
/**
* Delete the entry in the directory. This will delete sub-entries also!
*/
// Check if there are sub-entries, delete if present
}
// Check if there are suborganizations, delete if present
// The recursive 'false' here has the scope SCOPE_ONE
// while searching for the suborgs.
// Loop through the suborg at the first level and if there
// is no next suborg, delete that.
}
// Get LDAP connection
// Update entriesPresent cache
}
throws SMSException {
// Delete the entry
try {
int retry = 0;
while (retry <= connNumRetry) {
if (debug.messageEnabled()) {
}
break;
} catch (LdapException e) {
throw e;
}
retry++;
try {
} catch (InterruptedException ex) {
// ignored
}
}
}
} catch (LdapException e) {
throw new SMSException(e, "sms-entry-cannot-delete");
}
}
/**
* Returns the sub-entry names. Returns a set of RDNs that are sub-entries.
* The paramter <code>numOfEntries</code> identifies the number of entries
* to return, if <code>0</code> returns all the entries.
*/
throws SMSException, SSOException {
filter = "*";
}
if (debug.messageEnabled()) {
}
// Construct the filter
// This is a workaround for Issue 3823, where DS returns an
// empty set if restarted during OpenSSO operation
}
return (answer);
}
throws SMSException, SSOException {
SearchRequest request = getSearchRequest(dn, filter, SearchScope.SINGLE_LEVEL, numOfEntries, 0, sortResults,
int retry = 0;
while (retry <= connNumRetry) {
// Get the sub entries
// Construct the results and return
try {
try {
if (results.isReference()) {
continue;
}
// Check if the attribute starts with "ou="
// Workaround for 3823, where (objectClass=*) is used
}
} catch (SearchResultReferenceIOException e) {
}
}
} catch (LdapException e) {
throw new SMSException(e, "sms-entry-cannot-obtain");
}
break;
} catch (LdapException e) {
break;
}
throw new SMSException(e, "sms-entry-cannot-search");
}
retry++;
try {
} catch (InterruptedException ex) {
// ignored
}
}
}
return answer;
}
/**
* Returns the sub-entry names. Returns a set of RDNs that are sub-entries.
* The paramter <code>numOfEntries</code> identifies the number of entries
* to return, if <code>0</code> returns all the entries.
*/
if (debug.messageEnabled()) {
}
// Construct the filter
}
return ("SMSLdapObject");
}
/**
* Returns a LDAPConnection for the given principal
*/
if (enableProxy) {
try {
} catch (LdapException e) {
}
} else {
}
}
return conn;
}
/**
* Returns LDAP entries that match the filter, using the start DN provided
* in method
*/
throws SSOException, SMSException {
}
) throws SSOException, SMSException {
int retry = 0;
SearchRequest request = getSearchRequest(startDN, filter, SearchScope.WHOLE_SUBTREE, numOfEntries, timeLimit,
while (retry <= connNumRetry) {
if (debug.messageEnabled()) {
}
try {
break;
} catch (LdapException e) {
break;
}
throw new SMSException(e, "sms-error-in-searching");
}
retry++;
try {
} catch (InterruptedException ex) {
//ignored
}
}
}
return results;
}
/**
* Returns LDAP entries that match the filter, using the start DN provided
* in method
*/
if (debug.messageEnabled()) {
}
// Convert LDAP results to DNs
try {
} else {
}
} catch (SearchResultReferenceIOException e) {
}
}
} catch (LdapException e) {
} else {
throw new SMSException(e, "sms-error-in-searching");
}
}
if (debug.messageEnabled()) {
}
return answer;
}
private ConnectionEntryReader searchObjects(
int numOfEntries,
int timeLimit,
boolean sortResults,
boolean ascendingOrder,
int retry = 0;
SearchRequest request = getSearchRequest(startDN, filter, SearchScope.WHOLE_SUBTREE, numOfEntries, timeLimit);
while (retry <= connNumRetry) {
if (debug.messageEnabled()) {
}
try {
return results;
} catch (LdapException e) {
throw new SMSException(e, "sms-error-in-searching");
}
retry++;
try {
} catch (InterruptedException ex) {
//ignored
}
}
}
return null;
}
/**
* Checks if the provided DN exists. Used by PolicyManager.
*
* @param token Admin token.
* @param dn The DN to check.
* @return <code>true</code> if the entry exists, <code>false</code> otherwise.
*/
if (debug.messageEnabled()) {
}
// Check the caches
if (SMSNotificationManager.isCacheEnabled()) {
if (debug.messageEnabled()) {
}
return true;
if (debug.messageEnabled()) {
}
return false;
}
}
try {
// Check if entry exists
// Update the cache
if (SMSNotificationManager.isCacheEnabled()) {
synchronized (cacheToUpdate) {
if (!cacheToUpdate.isEmpty()) {
}
}
}
}
return entryExists;
} catch (SMSException smse) {
return false;
}
}
/**
* Checks if the provided DN exists.
*/
boolean entryExists = false;
// Use the Admin Principal to check if entry exists
entryExists = true;
} catch (EntryNotFoundException e) {
} catch (LdapException e) {
throw new SMSException("Unable to find entry with DN: " + dn, e, IUMSConstants.SMS_LDAP_OPERATION_FAILED);
}
return entryExists;
}
/**
* Registration of Notification Callbacks
*/
throws SMSException {
}
}
// Method to convert Map to LDAPAttributeSet
}
return entry;
}
// Method to covert JNDI ModificationItems to LDAPModificationSet
private static ModifyRequest copyModItemsToModifyRequest(DN dn, ModificationItem mods[]) throws SMSException {
try {
}
switch (mod.getModificationOp()) {
case DirContext.ADD_ATTRIBUTE:
break;
case DirContext.REPLACE_ATTRIBUTE:
break;
case DirContext.REMOVE_ATTRIBUTE:
break;
}
}
} catch (NamingException nne) {
}
return modifyRequest;
}
// Remove from entriesPresent Set
// Remove from entriesNotPresent set
}
}
public void allObjectsChanged() {
// Not clear why this class is implemeting the SMSObjectListener
// interface.
"SMSLDAPObject: got notifications, all objects changed");
}
}
/**
* Returns the suborganization names. Returns a set of RDNs that are
* suborganization name. The paramter <code>numOfEntries</code> identifies
* the number of entries to return, if <code>0</code> returns all the
* entries.
*/
if (debug.messageEnabled()) {
}
/*
* Instead of constructing the filter in the framework(SMSEntry.java),
* Construct the filter here in SMSLdapObject or the plugin
* implementation to support JDBC or other data store.
*/
+ "={0}))";
return searchSubOrganizationNames(token, dn, sfilter, numOfEntries, sortResults, ascendingOrder, recursive);
}
int numOfEntries,
boolean sortResults,
boolean ascendingOrder,
boolean recursive
) throws SMSException, SSOException {
int retry = 0;
while (retry <= connNumRetry) {
if (debug.messageEnabled()) {
"SMSLdapObject.searchSubOrganizationNames() retry: " +
retry);
}
// Get the suborganization names
} catch (LdapException e) {
break;
} else {
throw new SMSException(e, "sms-suborg-cannot-search");
}
}
retry++;
try {
} catch (InterruptedException ex) {
// ignored
}
}
}
return Collections.emptySet();
}
private SearchRequest getSearchRequest(String dn, String filter, SearchScope scope, int numOfEntries, int timeLimit,
String... attributes) {
}
private SearchRequest getSearchRequest(String dn, String filter, SearchScope scope, int numOfEntries, int timeLimit,
if (numOfEntries > 0) {
}
if (sortResults) {
}
return request;
}
/**
* Returns the organization names. Returns a set of RDNs that are
* organization name. The paramter <code>numOfEntries</code> identifies
* the number of entries to return, if <code>0</code> returns all the
* entries.
*/
throws SMSException, SSOException {
if (debug.messageEnabled()) {
+ dn);
}
/*
* Instead of constructing the filter in the framework(SMSEntry.java),
* Construct the filter here in SMSLdapObject or the plugin
* implementation to support JDBC or other data store. To return
* organization names that match the given attribute name and values,
* only exact matching is supported, and if more than one value is
* provided the organization must have all these values for the
* attribute. Basically an AND is performed for attribute values for
* searching. The attributes can be under the service config as well
* under the Realm/Organization directly. For eg.,
* (|(&(objectclass=sunRealmService)(&
* (|(sunxmlkeyvalue=SERVICE_NAME-ATTR_NAME=VALUE1)
* (sunxmlkeyvalue=ATTR_NAME=VALUE1))
* (|(sunxmlkeyvalue=SERVICE_NAME-ATTR_NAME=VALUE2)
* (sunxmlkeyvalue=ATTR_NAME=VALUE2))(...))
* (&(objectclass=sunServiceComponent)(&
* (|(sunxmlkeyvalue=SERVICE_NAME-ATTR_NAME=VALUE1)
* (sunxmlkeyvalue=ATTR_NAME=VALUE1))
* (|(sunxmlkeyvalue=SERVICE_NAME-ATTR_NAME=VALUE2)
* (sunxmlkeyvalue=ATTR_NAME=VALUE2))(...))
*
*/
}
) {
// Include the OCs only for sunDS, not Active Directory.
//String FILTER_PATTERN_SEARCH_ORG = "(|(&(objectclass="
FILTER_PATTERN_SEARCH_ORG = "(|(&(objectclass="
}
if (debug.messageEnabled()) {
}
}
public void shutdown() {
}
// dlayer (from AMSDK) has dependecy on AMSDK
// and cannot be shutdown by SMS.
// Should be initialized by AMSDK
}
throws SMSException, SSOException {
int retry = 0;
SearchRequest request = getSearchRequest(dn, filter, SearchScope.WHOLE_SUBTREE, numOfEntries, 0, sortResults,
while (retry <= connNumRetry) {
if (debug.messageEnabled()) {
}
// Get the organization names
} catch (LdapException e) {
break;
} else {
throw new SMSException(e, "sms-org-cannot-search");
}
}
retry++;
try {
} catch (InterruptedException ex) {
// ignored
}
}
}
return Collections.emptySet();
}
}
}
throws SMSException {
// Construct the results and return
try {
try {
if (results.isReference()) {
continue;
}
} catch (SearchResultReferenceIOException e) {
}
}
} catch (LdapException e) {
throw new SMSException(e, errorCode);
}
debug.message("SMSLdapObject.searchSubOrganizationName: Successfully obtained suborganization names for {}: {}",
return answer;
}
}