Top Description Fields Constructors Methods
org.apache.derby.impl.jdbc.authentication

public final Class LDAPAuthenticationSchemeImpl

extends JNDIAuthenticationSchemeBase
Class Inheritance
Imports
java.io.FileOutputStream, .IOException, java.util.Properties, javax.naming.*, javax.naming.directory.*, org.apache.derby.authentication.UserAuthenticator, org.apache.derby.shared.common.reference.MessageId, org.apache.derby.iapi.services.monitor.Monitor, org.apache.derby.shared.common.sanity.SanityManager, org.apache.derby.iapi.util.StringUtil
This is the Derby LDAP authentication scheme implementation. JNDI system/environment properties can be set at the database level as database properties. They will be picked-up and set in the JNDI initial context if any are found. We do connect first to the LDAP server in order to retrieve the user's distinguished name (DN) and then we reconnect and try to authenticate with the user's DN and passed-in password. In 2.0 release, we first connect to do a search (user full DN lookup). This initial lookup can be done through anonymous bind or using special LDAP search credentials that the user may have configured on the LDAP settings for the database or the system. It is a typical operation with LDAP servers where sometimes it is hard to tell/guess in advance a users' full DN's.

Note

In a future release, we will cache/maintain the user DN within the the Derby database or system to avoid the initial lookup. Also note that LDAP search/retrieval operations are usually very fast. The default LDAP url is ldap:/// (ldap://localhost:389/)

See Also
org.apache.derby.authentication.UserAuthenticator

Field Summary

Modifier and TypeField and Description
private static final String[]
attrDN

private static final String
dfltLDAPURL

private static final String
LDAP_LOCAL_USER_DN

private static final String
LDAP_SEARCH_AUTH_DN

private static final String
LDAP_SEARCH_AUTH_PW

private static final String
LDAP_SEARCH_BASE

private static final String
LDAP_SEARCH_FILTER

private static final String
LDAP_SEARCH_FILTER_USERNAME

private String
leftSearchFilter

private String
rightSearchFilter

private String
searchAuthDN

private String
searchAuthPW

private String
searchBaseDN

private boolean
useUserPropertyAsDN

Inherited from org.apache.derby.impl.jdbc.authentication.JNDIAuthenticationSchemeBase:
authenticationServiceinitDirContextEnvproviderURL

Constructor Summary

AccessConstructor and Description
public
LDAPAuthenticationSchemeImpl(JNDIAuthenticationService as, Properties dbProperties)

Method Summary

Modifier and TypeMethod and Description
public boolean
authenticateUser(String
The user's name used to connect to JBMS system
userName, String
The user's password used to connect to JBMS system
userPassword, String
The database which the user wants to connect to.
databaseName, Properties
Additional jdbc connection info.
info)

Implements org.apache.derby.authentication.UserAuthenticator.authenticateUser.

Authenticate the passed-in user's credentials.

protected String

Returns:

String the escaped/encoded result
doFilterEscaping(String
string to escape according to RFC 2254 guidelines
inString)

Given an LDAP search string, returns the string with certain characters escaped according to RFC 2254 guidelines.

private String
getDNFromUID(String uid)

Search for the full user's DN in the LDAP server.

private DirContext

Returns:

an initial DirContext using the supplied environment.
privInitialDirContext(final Properties
environment used to create the initial DirContext. Null indicates an empty environment.
env)

Call new InitialDirContext in a privilege block

protected void
setJNDIProviderProperties()

Implements abstract org.apache.derby.impl.jdbc.authentication.JNDIAuthenticationSchemeBase.setJNDIProviderProperties.

This method basically tests and sets default/expected JNDI properties for the JNDI provider scheme (here it is LDAP).

Inherited from org.apache.derby.impl.jdbc.authentication.JNDIAuthenticationSchemeBase:
getLoginSQLException

Field Detail

attrDNback to summary
private static final String[] attrDN
dfltLDAPURLback to summary
private static final String dfltLDAPURL
LDAP_LOCAL_USER_DNback to summary
private static final String LDAP_LOCAL_USER_DN
LDAP_SEARCH_AUTH_DNback to summary
private static final String LDAP_SEARCH_AUTH_DN
LDAP_SEARCH_AUTH_PWback to summary
private static final String LDAP_SEARCH_AUTH_PW
LDAP_SEARCH_BASEback to summary
private static final String LDAP_SEARCH_BASE
LDAP_SEARCH_FILTERback to summary
private static final String LDAP_SEARCH_FILTER
LDAP_SEARCH_FILTER_USERNAMEback to summary
private static final String LDAP_SEARCH_FILTER_USERNAME
leftSearchFilterback to summary
private String leftSearchFilter
rightSearchFilterback to summary
private String rightSearchFilter
searchAuthDNback to summary
private String searchAuthDN
searchAuthPWback to summary
private String searchAuthPW
searchBaseDNback to summary
private String searchBaseDN
useUserPropertyAsDNback to summary
private boolean useUserPropertyAsDN

Constructor Detail

LDAPAuthenticationSchemeImplback to summary
public LDAPAuthenticationSchemeImpl(JNDIAuthenticationService as, Properties dbProperties)

Method Detail

authenticateUserback to summary
public boolean authenticateUser(String userName, String userPassword, String databaseName, Properties info) throws SQLException

Implements org.apache.derby.authentication.UserAuthenticator.authenticateUser.

Authenticate the passed-in user's credentials. We authenticate against a LDAP Server.

Parameters
userName:String

The user's name used to connect to JBMS system

userPassword:String

The user's password used to connect to JBMS system

databaseName:String

The database which the user wants to connect to.

info:Properties

Additional jdbc connection info.

Returns:boolean

Doc from org.apache.derby.authentication.UserAuthenticator.authenticateUser.

false if the connection request should be denied, true if the connection request should proceed. If false is returned the connection attempt will receive a SQLException with SQL State 08004.

Exceptions
SQLException:

Doc from org.apache.derby.authentication.UserAuthenticator.authenticateUser.

An exception processing the request, connection request will be denied. The SQL exception will be returned to the connection attempt.

doFilterEscapingback to summary
protected String doFilterEscaping(String inString)

Given an LDAP search string, returns the string with certain characters escaped according to RFC 2254 guidelines. Cribbed from org.apache.catalina.realm.JNDIRealm. The character mapping is as follows: char -> Replacement --------------------------- * -> \2a ( -> \28 ) -> \29 \ -> \5c \0 -> \00

Parameters
inString:String

string to escape according to RFC 2254 guidelines

Returns:String

String the escaped/encoded result

getDNFromUIDback to summary
private String getDNFromUID(String uid) throws NamingException

Search for the full user's DN in the LDAP server. LDAP server bind may or not be anonymous. If the admin does not want us to do anonymous bind/search, then we must have been given principal/credentials in order to successfully bind to perform the user's DN search.

Exceptions
NamingException:
if could not retrieve the user DN.
privInitialDirContextback to summary
private DirContext privInitialDirContext(final Properties env) throws NamingException

Call new InitialDirContext in a privilege block

Parameters
env:Properties

environment used to create the initial DirContext. Null indicates an empty environment.

Returns:DirContext

an initial DirContext using the supplied environment.

setJNDIProviderPropertiesback to summary
protected void setJNDIProviderProperties()

Implements abstract org.apache.derby.impl.jdbc.authentication.JNDIAuthenticationSchemeBase.setJNDIProviderProperties.

This method basically tests and sets default/expected JNDI properties for the JNDI provider scheme (here it is LDAP).