public class JettyCachingLdapLoginModule
extends org.eclipse.jetty.jaas.spi.AbstractLoginModule
-Djava.security.auth.login.config=etc/ldap-loginModule.conf
ldaploginmodule {
com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule required
debug="true"
contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
hostname="ldap.example.com"
port="389"
timeoutRead="5000"
timeoutConnect="30000"
bindDn="cn=Directory Manager"
bindPassword="directory"
authenticationMethod="simple"
forceBindingLogin="false"
forceBindingLoginUseRootContextForRoles="false"
userBaseDn="ou=people,dc=alcatel"
userRdnAttribute="uid"
userIdAttribute="uid"
userPasswordAttribute="userPassword"
userObjectClass="inetOrgPerson"
roleBaseDn="ou=groups,dc=example,dc=com"
roleNameAttribute="cn"
roleMemberAttribute="uniqueMember"
roleUsernameMemberAttribute="memberUid"
roleObjectClass="groupOfUniqueNames"
rolePrefix="rundeck"
cacheDurationMillis="500"
reportStatistics="true"
nestedGroups="false";
};
| Modifier and Type | Field and Description |
|---|---|
protected java.lang.String |
_authenticationMethod
Context.SECURITY_AUTHENTICATION
|
protected java.lang.String |
_bindDn
root DN used to connect to
|
protected java.lang.String |
_bindPassword
password used to connect to the root ldap context
|
protected int |
_cacheDuration
Duration of storing the user in memory.
|
protected java.lang.String |
_contextFactory
Context.INITIAL_CONTEXT_FACTORY
|
protected boolean |
_debug |
protected boolean |
_forceBindingLogin
if the getUserInfo can pull a password off of the user then password
comparison is an option for authn, to force binding login checks, set
this to true
|
protected boolean |
_forceBindingLoginUseRootContextForRoles
if _forceFindingLogin is true, and _forceBindingLoginUseRootContextForRoles
is true, then role memberships are obtained using _rootContext
|
protected java.lang.String |
_hostname
hostname of the ldap server
|
protected boolean |
_ldapsVerifyHostname |
protected boolean |
_nestedGroups |
protected int |
_port
port of the ldap server
|
protected java.lang.String |
_providerUrl
Provider URL
|
protected boolean |
_reportStatistics |
protected java.lang.String |
_roleBaseDn
base DN where role membership is to be searched from
|
protected java.lang.String |
_roleMemberAttribute
name of the attribute that a user DN would be under a role class
|
protected java.lang.String |
_roleMemberFilter |
protected java.lang.String |
_roleNameAttribute
the name of the attribute that a role would be stored under
|
protected java.lang.String |
_roleObjectClass
object class of roles
|
protected java.lang.String |
_rolePrefix
Role prefix to remove from ldap group name.
|
protected java.lang.String |
_roleUsernameMemberAttribute
name of the attribute that a username would be under a role class
|
protected javax.naming.directory.DirContext |
_rootContext |
protected java.util.List<java.lang.String> |
_supplementalRoles
List of supplemental roles provided in config file that get added to
all users.
|
protected long |
_timeoutConnect
timeout for LDAP connection
|
protected long |
_timeoutRead
timeout for LDAP read
|
protected java.lang.String |
_userBaseDn
base DN where users are to be searched from
|
protected java.lang.String |
_userEmailAttribute
attribute of user email
|
protected java.lang.String |
_userFirstNameAttribute
attribute of user first name
|
protected java.lang.String |
_userIdAttribute
attribute that the principal is located
|
protected java.lang.String |
_userLastNameAttribute
attribute of user last name
|
protected java.lang.String |
_userObjectClass
object class of a user
|
protected java.lang.String |
_userPasswordAttribute
name of the attribute that a users password is stored under
NOTE: not always accessible, see force binding login |
protected java.lang.String |
_userRdnAttribute
attribute that the principal is located
|
protected static long |
loginAttempts
The number of login attempts for this particular module.
|
static java.lang.String |
OBJECT_CLASS_FILTER |
protected static java.util.concurrent.ConcurrentHashMap<java.lang.String,com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule.CachedUserInfo> |
USERINFOCACHE |
protected static long |
userInfoCacheHits
The number of cache hits for UserInfo objects.
|
| Constructor and Description |
|---|
JettyCachingLdapLoginModule() |
| Modifier and Type | Method and Description |
|---|---|
boolean |
abort() |
protected void |
addSupplementalRoles(java.util.List<java.lang.String> roleList) |
protected boolean |
authenticate(java.lang.String webUserName,
java.lang.Object webCredential)
since ldap uses a context bind for valid authentication checking, we
override login()
if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic |
protected boolean |
bindingLogin(java.lang.String username,
java.lang.Object password)
binding authentication check This methode of authentication works only if
the user branch of the DIT (ldap tree) has an ACI (acces control
instruction) that allow the access to any user or at least for the user
that logs in.
|
boolean |
commit() |
protected boolean |
credentialLogin(java.lang.Object webCredential)
password supplied authentication check
|
protected void |
debug(java.lang.String message)
Default behavior to emit to System.err
|
protected java.lang.String |
doRFC2254Encoding(java.lang.String inputString) |
protected java.lang.Object[] |
getCallBackAuth() |
java.util.Hashtable |
getEnvironment()
get the context for connection
|
protected java.lang.String |
getOption(java.util.Map options,
java.lang.String key,
java.lang.String defaultValue) |
org.eclipse.jetty.jaas.spi.UserInfo |
getUserInfo(java.lang.String username)
get the available information about the user
for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario roles are also an optional concept if required |
protected java.util.List |
getUserRoles(javax.naming.directory.DirContext dirContext,
java.lang.String username)
attempts to get the users roles from the root context
NOTE: this is not an user authenticated operation
|
void |
initialize(javax.security.auth.Subject subject,
javax.security.auth.callback.CallbackHandler callbackHandler,
java.util.Map<java.lang.String,?> sharedState,
java.util.Map<java.lang.String,?> options) |
void |
initializeOptions(java.util.Map options) |
protected boolean |
isDebug() |
boolean |
login()
Gets credentials by calling
getCallBackAuth(), then performs authenticate(String, Object) |
public static final java.lang.String OBJECT_CLASS_FILTER
protected final java.lang.String _roleMemberFilter
protected java.lang.String _providerUrl
protected java.lang.String _rolePrefix
protected int _cacheDuration
protected java.lang.String _hostname
protected int _port
protected java.lang.String _authenticationMethod
protected java.lang.String _contextFactory
protected java.lang.String _bindDn
protected java.lang.String _bindPassword
protected java.lang.String _userObjectClass
protected java.lang.String _userRdnAttribute
protected java.lang.String _userIdAttribute
protected java.lang.String _userPasswordAttribute
protected java.lang.String _userBaseDn
protected java.lang.String _userFirstNameAttribute
protected java.lang.String _userLastNameAttribute
protected java.lang.String _userEmailAttribute
protected java.lang.String _roleBaseDn
protected java.lang.String _roleObjectClass
protected java.lang.String _roleMemberAttribute
protected java.lang.String _roleUsernameMemberAttribute
protected java.lang.String _roleNameAttribute
protected boolean _debug
protected boolean _ldapsVerifyHostname
protected boolean _forceBindingLogin
protected boolean _forceBindingLoginUseRootContextForRoles
protected javax.naming.directory.DirContext _rootContext
protected boolean _reportStatistics
protected java.util.List<java.lang.String> _supplementalRoles
protected boolean _nestedGroups
protected long _timeoutRead
protected long _timeoutConnect
protected static final java.util.concurrent.ConcurrentHashMap<java.lang.String,com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule.CachedUserInfo> USERINFOCACHE
protected static long userInfoCacheHits
protected static long loginAttempts
public org.eclipse.jetty.jaas.spi.UserInfo getUserInfo(java.lang.String username)
throws java.lang.Exception
getUserInfo in class org.eclipse.jetty.jaas.spi.AbstractLoginModuleusername - java.lang.Exceptionprotected java.lang.String doRFC2254Encoding(java.lang.String inputString)
protected java.util.List getUserRoles(javax.naming.directory.DirContext dirContext,
java.lang.String username)
throws javax.security.auth.login.LoginException,
javax.naming.NamingException
dirContext - username - javax.security.auth.login.LoginExceptionjavax.naming.NamingExceptionprotected void addSupplementalRoles(java.util.List<java.lang.String> roleList)
protected boolean isDebug()
protected void debug(java.lang.String message)
message - messagepublic boolean login()
throws javax.security.auth.login.LoginException
getCallBackAuth(), then performs authenticate(String, Object)login in interface javax.security.auth.spi.LoginModulelogin in class org.eclipse.jetty.jaas.spi.AbstractLoginModulejavax.security.auth.login.LoginExceptionprotected java.lang.Object[] getCallBackAuth()
throws java.io.IOException,
javax.security.auth.callback.UnsupportedCallbackException,
javax.security.auth.login.LoginException
java.io.IOExceptionjavax.security.auth.callback.UnsupportedCallbackExceptionjavax.security.auth.login.LoginExceptionprotected boolean authenticate(java.lang.String webUserName,
java.lang.Object webCredential)
throws javax.security.auth.login.LoginException
webUserName - userwebCredential - passwordjavax.security.auth.login.LoginExceptionprotected boolean credentialLogin(java.lang.Object webCredential)
throws javax.security.auth.login.LoginException
webCredential - javax.security.auth.login.LoginExceptionprotected boolean bindingLogin(java.lang.String username,
java.lang.Object password)
throws javax.security.auth.login.LoginException,
javax.naming.NamingException
username - password - javax.security.auth.login.LoginExceptionjavax.naming.NamingExceptionpublic void initialize(javax.security.auth.Subject subject,
javax.security.auth.callback.CallbackHandler callbackHandler,
java.util.Map<java.lang.String,?> sharedState,
java.util.Map<java.lang.String,?> options)
initialize in interface javax.security.auth.spi.LoginModuleinitialize in class org.eclipse.jetty.jaas.spi.AbstractLoginModulepublic void initializeOptions(java.util.Map options)
public boolean commit()
throws javax.security.auth.login.LoginException
commit in interface javax.security.auth.spi.LoginModulecommit in class org.eclipse.jetty.jaas.spi.AbstractLoginModulejavax.security.auth.login.LoginExceptionpublic boolean abort()
throws javax.security.auth.login.LoginException
abort in interface javax.security.auth.spi.LoginModuleabort in class org.eclipse.jetty.jaas.spi.AbstractLoginModulejavax.security.auth.login.LoginExceptionprotected java.lang.String getOption(java.util.Map options,
java.lang.String key,
java.lang.String defaultValue)
public java.util.Hashtable getEnvironment()