Top Description Inners Methods
javax.security.enterprise.identitystore

public @Interface LdapIdentityStoreDefinition

extends Annotation
Annotations
@Retention:RUNTIME
@Target:TYPE
Imports
javax.security.enterprise.identitystore.IdentityStore, .IdentityStore.ValidationType, java.lang.annotation.Retention, .Target, javax.security.enterprise.credential.UsernamePasswordCredential
Annotation used to define a container-provided IdentityStore that stores caller credentials and identity attributes (together caller identities) in an LDAP store, and make that implementation available as an enabled CDI bean.

The container-provided IdentityStore must support validating UsernamePasswordCredential, and may support validating other credential types.

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static enum
LdapIdentityStoreDefinition.LdapSearchScope

Enum representing LDAP search scope values.

Method Summary

Modifier and TypeMethod and Description
public String

Returns:

The distinguished name for the application user.
bindDn()

Distinguished name for the application or administrative user that will be used to make the initial connection to the LDAP and to perform searches and lookups.

public String

Returns:

password for the application user.
bindDnPassword()

Password for the application/admin user defined by the bindDn member.

public String

Returns:

The base distinguished name for callers.
callerBaseDn()

Base distinguished name for callers in the LDAP store (e.g., "ou=caller,dc=jsr375,dc=net").

public String

Returns:

Name of the attribute that represents the caller name
callerNameAttribute()

Name of the attribute that contains the callers name in the person object (e.g., "uid").

public String

Returns:

Base DN for searching the LDAP tree for callers.
callerSearchBase()

Search base for looking up callers (e.g., "ou=caller,dc=jsr375,dc=net").

public String

Returns:

Search expression to find callers.
callerSearchFilter()

Search filter to find callers when callerSearchBase is set.

public LdapIdentityStoreDefinition.LdapSearchScope

Returns:

The search scope
callerSearchScope()

Search scope for caller searches: determines depth of the search in the LDAP tree.

public String

Returns:

the callerSearchScope EL expression
callerSearchScopeExpression()

Allow callerSearchScope to be specified as an EL expression.

public String

Returns:

Attribute for the group members
groupMemberAttribute()

Name of the attribute in a group object that identifies the members of the group (e.g., "member").

public String

Returns:

Attribute for group membership
groupMemberOfAttribute()

Name of the attribute in a person object that identifies the groups the caller belongs to (e.g., "memberOf").

public String

Returns:

Name of the attribute that represents the group name
groupNameAttribute()

Name of the attribute of a group object that represents the group name (e.g., "cn")

public String

Returns:

Base DN for searching the LDAP tree for groups.
groupSearchBase()

Search base for looking up groups (e.g., "ou=group,dc=jsr375,dc=net").

public String

Returns:

Search expression to find groups.
groupSearchFilter()

Search filter to find groups when groupSearchBase is set.

public LdapIdentityStoreDefinition.LdapSearchScope

Returns:

The search scope
groupSearchScope()

Search scope for group searches, determines depth of the search in the LDAP tree.

public String

Returns:

the groupSearchScope EL expression
groupSearchScopeExpression()

Allow groupSearchScope to be specified as an EL expression.

public int

Returns:

The maximum number of results the LDAP server should return.
maxResults()

Set the maximum number of results (objects) the server should return in response to a search.

public String

Returns:

The maxResults EL expression
maxResultsExpression()

Allow maxResults to be specified as an EL expression.

public int

Returns:

The priority.
priority()

Determines the order in case multiple IdentityStores are found.

public String

Returns:

The priority EL expression
priorityExpression()

Allow priority to be specified as an EL expression.

public int

Returns:

The readTimeout value.
readTimeout()

Set the timeout value that should be used when waiting for the LDAP server to return results.

public String

Returns:

The readTimeout EL expression
readTimeoutExpression()

Allow readTimeout to be specified as an EL expression.

public String

Returns:

URL where the LDAP server can be reached
url()

URL where the LDAP server can be reached.

public IdentityStore.ValidationType[]

Returns:

The type the identity store is used for
useFor()

Determines what the identity store is used for

public String

Returns:

The useFor EL expression
useForExpression()

Allow useFor to be specified as an EL expression.

Inherited from java.lang.annotation.Annotation:
annotationTypeequalshashCodetoString

Method Detail

bindDnback to summary
public String bindDn()

Distinguished name for the application or administrative user that will be used to make the initial connection to the LDAP and to perform searches and lookups.

This value is needed if caller or group lookup will be done. It is not needed if the store will be used only to authenticate callers using direct binding (see callerBaseDn).

This user needs search permission in the LDAP for persons and/or groups.

E.g.: uid=ldap,ou=apps,dc=jsr375,dc=net

Returns:String

The distinguished name for the application user.

bindDnPasswordback to summary
public String bindDnPassword()

Password for the application/admin user defined by the bindDn member. Only used when the member bindDn is filled in.

Returns:String

password for the application user.

callerBaseDnback to summary
public String callerBaseDn()

Base distinguished name for callers in the LDAP store (e.g., "ou=caller,dc=jsr375,dc=net").

When this member value is specified, and callerSearchBase is not, direct binding is attempted.

The callerNameAttribute must be specified along with this attribute so that the runtime can create the "leaf" RDN needed to concatenate with the base DN to create the full DN of the caller.

Returns:String

The base distinguished name for callers.

callerNameAttributeback to summary
public String callerNameAttribute()

Name of the attribute that contains the callers name in the person object (e.g., "uid").

This attribute will be used, with callerBaseDn, to construct caller DNs for direct binding. It is also used to retrieve the caller's name when the caller object is instead looked up using search.

The value of this attribute is returned as the caller principal name for a successful credential validation.

The following gives an example in ldif format: 


dn: uid=peter,ou=caller,dc=jsr375,dc=net
objectclass: top
objectclass: uidObject
objectclass: person
uid: peter
cn: Peter Smith
sn: Peter
userPassword: secret1
Returns:String

Name of the attribute that represents the caller name

callerSearchBaseback to summary
public String callerSearchBase()

Search base for looking up callers (e.g., "ou=caller,dc=jsr375,dc=net").

Overrides callerBaseDn, if configured, causing caller search to be used instead of direct binding. Requires that the bindDn member be filled in.

Returns:String

Base DN for searching the LDAP tree for callers.

callerSearchFilterback to summary
public String callerSearchFilter()

Search filter to find callers when callerSearchBase is set. The search is performed starting from the callerSearchBase DN with the scope specified by callerSearchScope.

Returns:String

Search expression to find callers.

callerSearchScopeback to summary
public LdapIdentityStoreDefinition.LdapSearchScope callerSearchScope()

Search scope for caller searches: determines depth of the search in the LDAP tree.

Returns:LdapIdentityStoreDefinition.LdapSearchScope

The search scope

callerSearchScopeExpressionback to summary
public String callerSearchScopeExpression()

Allow callerSearchScope to be specified as an EL expression. If set, overrides any value set with callerSearchScope.

Returns:String

the callerSearchScope EL expression

groupMemberAttributeback to summary
public String groupMemberAttribute()

Name of the attribute in a group object that identifies the members of the group (e.g., "member").

The value of this attribute must be the full DN of the caller. The following gives an example entry in ldif format: 


dn: cn=foo,ou=group,dc=jsr375,dc=net
objectclass: top
objectclass: groupOfNames
cn: foo
member: uid=pete,ou=caller,dc=jsr375,dc=net
member: uid=john,ou=caller,dc=jsr375,dc=net
Returns:String

Attribute for the group members

groupMemberOfAttributeback to summary
public String groupMemberOfAttribute()

Name of the attribute in a person object that identifies the groups the caller belongs to (e.g., "memberOf").

This attribute is used only if: a) group search is not configured (i.e., no groupSearchBase and groupSearchFilter configured); and, b) the caller's DN is available, either because groups are being returned during the credential validation phase by an identity store that performs both validation and group lookup, or because the DN is available in the CredentialValidationResult passed to the IdentityStore#getCallerGroups(CredentialValidationResult) method.

The value of this attribute must be the full DN of the group. The following gives an example entry in ldif format: 


dn: uid=peter,ou=caller,dc=jsr375,dc=net
objectclass: top
objectclass: uidObject
objectclass: person
uid: peter
cn: Peter Smith
memberOf: cn=foo,ou=group,dc=jsr375,dc=net
memberOf: cn=bar,ou=group,dc=jsr375,dc=net
Returns:String

Attribute for group membership

groupNameAttributeback to summary
public String groupNameAttribute()

Name of the attribute of a group object that represents the group name (e.g., "cn")

Returns:String

Name of the attribute that represents the group name

groupSearchBaseback to summary
public String groupSearchBase()

Search base for looking up groups (e.g., "ou=group,dc=jsr375,dc=net").

Needed only for a store that performs group lookup. Requires that the bindDn member be filled in.

Returns:String

Base DN for searching the LDAP tree for groups.

groupSearchFilterback to summary
public String groupSearchFilter()

Search filter to find groups when groupSearchBase is set. The search is performed starting from the groupSearchBase DN with the scope specified by groupSearchScope.

Returns:String

Search expression to find groups.

groupSearchScopeback to summary
public LdapIdentityStoreDefinition.LdapSearchScope groupSearchScope()

Search scope for group searches, determines depth of the search in the LDAP tree.

Returns:LdapIdentityStoreDefinition.LdapSearchScope

The search scope

groupSearchScopeExpressionback to summary
public String groupSearchScopeExpression()

Allow groupSearchScope to be specified as an EL expression. If set, overrides any value set with groupSearchScope.

Returns:String

the groupSearchScope EL expression

maxResultsback to summary
public int maxResults()

Set the maximum number of results (objects) the server should return in response to a search.

The default value is set to 1000, which corresponds to the maximum number of results most LDAP servers will return for in a single response. Most LDAP servers support paging through result sets larger than 1000, but doing so should rarely be necessary for normal validation and group lookup use cases. Implementations of the built-in LDAP IdentityStore MAY support paging through larger result sets, but are NOT REQUIRED to.

Returns:int

The maximum number of results the LDAP server should return.

maxResultsExpressionback to summary
public String maxResultsExpression()

Allow maxResults to be specified as an EL expression. If set, overrides any value set with maxResults.

Returns:String

The maxResults EL expression

priorityback to summary
public int priority()

Determines the order in case multiple IdentityStores are found.

Returns:int

The priority.

priorityExpressionback to summary
public String priorityExpression()

Allow priority to be specified as an EL expression. If set, overrides any value set with priority.

Returns:String

The priority EL expression

readTimeoutback to summary
public int readTimeout()

Set the timeout value that should be used when waiting for the LDAP server to return results. Note that this is different from the connection timeout for the underlying socket connection;

The default value of 0 means wait forever (assuming the connection itself does not time out).

Returns:int

The readTimeout value.

readTimeoutExpressionback to summary
public String readTimeoutExpression()

Allow readTimeout to be specified as an EL expression. If set, overrides any value set with readTimeout.

Returns:String

The readTimeout EL expression

urlback to summary
public String url()

URL where the LDAP server can be reached.

E.g.: ldap://localhost:33389

Returns:String

URL where the LDAP server can be reached

useForback to summary
public IdentityStore.ValidationType[] useFor()

Determines what the identity store is used for

Returns:IdentityStore.ValidationType[]

The type the identity store is used for

useForExpressionback to summary
public String useForExpression()

Allow useFor to be specified as an EL expression. If set, overrides any value set with useFor.

Returns:String

The useFor EL expression

javax.security.enterprise.identitystore back to summary

public final Enum LdapIdentityStoreDefinition.LdapSearchScope

extends Enum<LdapIdentityStoreDefinition.LdapSearchScope>
Class Inheritance
Enum representing LDAP search scope values.

Field Summary

Modifier and TypeField and Description
public static final LdapIdentityStoreDefinition.LdapSearchScope
ONE_LEVEL

public static final LdapIdentityStoreDefinition.LdapSearchScope
SUBTREE

Constructor Summary

AccessConstructor and Description
private
LdapSearchScope()

Method Summary

Modifier and TypeMethod and Description
public static LdapIdentityStoreDefinition.LdapSearchScope
valueOf(String name)

public static LdapIdentityStoreDefinition.LdapSearchScope[]
values()

Inherited from java.lang.Enum:
clonecompareTodescribeConstableequalsfinalizegetDeclaringClasshashCodenameordinaltoStringvalueOf

Field Detail

ONE_LEVELback to summary
public static final LdapIdentityStoreDefinition.LdapSearchScope ONE_LEVEL
SUBTREEback to summary
public static final LdapIdentityStoreDefinition.LdapSearchScope SUBTREE

Constructor Detail

LdapSearchScopeback to summary
private LdapSearchScope()

Method Detail

valueOfback to summary
public static LdapIdentityStoreDefinition.LdapSearchScope valueOf(String name)
valuesback to summary
public static LdapIdentityStoreDefinition.LdapSearchScope[] values()