Top Description Inners Fields Constructors Methods
org.eclipse.jetty.security.jaas.spi

public Class LdapLoginModule

extends AbstractLoginModule
Class Inheritance
Imports
java.io.IOException, java.util.ArrayList, .Base64, .Hashtable, .List, .Locale, .Map, .Properties, javax.naming.AuthenticationException, .Context, .NamingEnumeration, .NamingException, javax.naming.directory.Attribute, .Attributes, .DirContext, .InitialDirContext, .SearchControls, .SearchResult, javax.security.auth.Subject, javax.security.auth.callback.Callback, .CallbackHandler, .NameCallback, .UnsupportedCallbackException, javax.security.auth.login.FailedLoginException, .LoginException, org.eclipse.jetty.security.UserPrincipal, org.eclipse.jetty.security.jaas.callback.ObjectCallback, org.eclipse.jetty.util.StringUtil, .TypeUtil, org.eclipse.jetty.util.security.Credential, org.slf4j.Logger, .LoggerFactory
A LdapLoginModule for use with JAAS setups

The jvm should be started with the following parameter: 

-Djava.security.auth.login.config=etc/ldap-loginModule.conf
and an example of the ldap-loginModule.conf would be: 
ldaploginmodule {
   org.eclipse.jetty.server.server.plus.jaas.spi.LdapLoginModule required
   debug="true"
   useLdaps="false"
   contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
   hostname="ldap.example.com"
   port="389"
   bindDn="cn=Directory Manager"
   bindPassword="directory"
   authenticationMethod="simple"
   forceBindingLogin="false"
   userBaseDn="ou=people,dc=alcatel"
   userRdnAttribute="uid"
   userIdAttribute="uid"
   userPasswordAttribute="userPassword"
   userObjectClass="inetOrgPerson"
   roleBaseDn="ou=groups,dc=example,dc=com"
   roleNameAttribute="cn"
   roleMemberAttribute="uniqueMember"
   roleObjectClass="groupOfUniqueNames";
   };

Nested and Inner Type Summary

Modifier and TypeClass and Description
public class
LdapLoginModule.LDAPBindingUser

public class
LdapLoginModule.LDAPUser

Field Summary

Modifier and TypeField and Description
private String
_authenticationMethod

Context.SECURITY_AUTHENTICATION

private String
_bindDn

root DN used to connect to

private String
_bindPassword

password used to connect to the root ldap context

private String
_contextFactory

Context.INITIAL_CONTEXT_FACTORY

private boolean
_debug

private boolean
_forceBindingLogin

if the getUserInfo can pull a password off of the user then password comparison is an option for authn, to force binding login checks, set this to true

private String
_hostname

hostname of the ldap server

private int
_port

port of the ldap server

private String
_roleBaseDn

base DN where role membership is to be searched from

private String
_roleMemberAttribute

name of the attribute that a username would be under a role class

private String
_roleNameAttribute

the name of the attribute that a role would be stored under

private String
_roleObjectClass

object class of roles

private DirContext
_rootContext

private boolean
_useLdaps

When true changes the protocol to ldaps

private String
_userBaseDn

base DN where users are to be searched from

private String
_userIdAttribute

attribute that the principal is located

private String
_userObjectClass

object class of a user

private String
_userPasswordAttribute

name of the attribute that a users password is stored under

Note

not always accessible, see force binding login

private String
_userRdnAttribute

attribute that the principal is located

private static final Logger
LOG

Constructor Summary

AccessConstructor and Description
public
LdapLoginModule()

Method Summary

Modifier and TypeMethod and Description
public boolean
abort()

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.abort.

Implements javax.security.auth.spi.LoginModule.abort.

Method to abort the authentication process (phase 2).

private static String
base64ToHex(String src)

public boolean

Returns:

true always
bindingLogin(String
the user name
username, Object
the password
password)

binding authentication check This method of authentication works only if the user branch of the DIT (ldap tree) has an ACI (access control instruction) that allow the access to any user or at least for the user that logs in.

public boolean
commit()

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.commit.

Implements javax.security.auth.spi.LoginModule.commit.

Method to commit the authentication process (phase 2).

public static String
convertCredentialLdapToJetty(String encryptedPassword)

protected boolean

Returns:

true if authenticated
credentialLogin(Object
the web credential
webCredential)

password supplied authentication check

protected String
doRFC2254Encoding(String inputString)

private SearchResult
findUser(String username)

private SearchResult
findUser(DirContext dirContext, String filter, Object[] filterArguments)

public Hashtable<Object, Object>

Returns:

the environment details for the context
getEnvironment()

get the context for connection

private String
getOption(Map<String, ?> options, String key, String defaultValue)

public AbstractLoginModule.JAASUser

Returns:

the userinfo for the username
getUser(String
the user name
username)

Implements abstract org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.getUser.

get the available information about the user

for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario

roles are also an optional concept if required

private Attributes

Returns:

the Attributes from the user
getUserAttributes(String username)

attempts to get the users LDAP attributes from the users context

Note

this is not an user authenticated operation

private String
getUserCredentials(Attributes attributes)

private List<String>
getUserRoles(DirContext dirContext, String username, Attributes attributes)

attempts to get the users roles from the root context

Note

this is not an user authenticated operation

private List<String>
getUserRolesByDn(DirContext dirContext, String userDn)

private static String
hexToBase64(String src)

public void
initialize(Subject
the subect
subject, CallbackHandler
the callback handler
callbackHandler, Map<String, ?>
the shared state map
sharedState, Map<String, ?>
the option map
options)

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.initialize.

Implements javax.security.auth.spi.LoginModule.initialize.

Init LoginModule.

public boolean

Returns:

true if authenticated, false otherwise
login()

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.login.

Implements javax.security.auth.spi.LoginModule.login.

since ldap uses a context bind for valid authentication checking, we override login()

if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic

Inherited from org.eclipse.jetty.security.jaas.spi.AbstractLoginModule:
configureCallbacksgetCallbackHandlergetCurrentUsergetSubjectisAuthenticatedisCommittedisIgnoredlogoutsetAuthenticatedsetCallbackHandlersetCommittedsetCurrentUsersetSubject

Field Detail

_authenticationMethodback to summary
private String _authenticationMethod

Context.SECURITY_AUTHENTICATION

_bindDnback to summary
private String _bindDn

root DN used to connect to

_bindPasswordback to summary
private String _bindPassword

password used to connect to the root ldap context

_contextFactoryback to summary
private String _contextFactory

Context.INITIAL_CONTEXT_FACTORY

_debugback to summary
private boolean _debug
_forceBindingLoginback to summary
private boolean _forceBindingLogin

if the getUserInfo can pull a password off of the user then password comparison is an option for authn, to force binding login checks, set this to true

_hostnameback to summary
private String _hostname

hostname of the ldap server

_portback to summary
private int _port

port of the ldap server

_roleBaseDnback to summary
private String _roleBaseDn

base DN where role membership is to be searched from

_roleMemberAttributeback to summary
private String _roleMemberAttribute

name of the attribute that a username would be under a role class

_roleNameAttributeback to summary
private String _roleNameAttribute

the name of the attribute that a role would be stored under

_roleObjectClassback to summary
private String _roleObjectClass

object class of roles

_rootContextback to summary
private DirContext _rootContext
_useLdapsback to summary
private boolean _useLdaps

When true changes the protocol to ldaps

_userBaseDnback to summary
private String _userBaseDn

base DN where users are to be searched from

_userIdAttributeback to summary
private String _userIdAttribute

attribute that the principal is located

_userObjectClassback to summary
private String _userObjectClass

object class of a user

_userPasswordAttributeback to summary
private String _userPasswordAttribute

name of the attribute that a users password is stored under

Note

not always accessible, see force binding login

_userRdnAttributeback to summary
private String _userRdnAttribute

attribute that the principal is located

LOGback to summary
private static final Logger LOG

Constructor Detail

LdapLoginModuleback to summary
public LdapLoginModule()

Method Detail

abortback to summary
public boolean abort() throws LoginException

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.abort.

Implements javax.security.auth.spi.LoginModule.abort.

Doc from javax.security.auth.spi.LoginModule.abort.

Method to abort the authentication process (phase 2).

This method is called if the LoginContext's overall authentication failed. (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules did not succeed).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method cleans up any state that was originally saved.

Returns:boolean

true if this method succeeded, or false if this LoginModule should be ignored.

Annotations
@Override
Exceptions
LoginException:
if the abort fails
base64ToHexback to summary
private static String base64ToHex(String src)
bindingLoginback to summary
public boolean bindingLogin(String username, Object password) throws LoginException

binding authentication check This method of authentication works only if the user branch of the DIT (ldap tree) has an ACI (access control instruction) that allow the access to any user or at least for the user that logs in.

Parameters
username:String

the user name

password:Object

the password

Returns:boolean

true always

Exceptions
LoginException:
if unable to bind the login
commitback to summary
public boolean commit() throws LoginException

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.commit.

Implements javax.security.auth.spi.LoginModule.commit.

Doc from javax.security.auth.spi.LoginModule.commit.

Method to commit the authentication process (phase 2).

This method is called if the LoginContext's overall authentication succeeded (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules succeeded).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method associates relevant Principals and Credentials with the Subject located in the LoginModule. If this LoginModule's own authentication attempted failed, then this method removes/destroys any state that was originally saved.

Returns:boolean

Doc from org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.commit.

true if committed, false if not (likely not authenticated)

Annotations
@Override
Exceptions
LoginException:

Doc from org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.commit.

if unable to commit

convertCredentialLdapToJettyback to summary
public static String convertCredentialLdapToJetty(String encryptedPassword)
credentialLoginback to summary
protected boolean credentialLogin(Object webCredential) throws LoginException

password supplied authentication check

Parameters
webCredential:Object

the web credential

Returns:boolean

true if authenticated

Exceptions
LoginException:
if unable to login
doRFC2254Encodingback to summary
protected String doRFC2254Encoding(String inputString)
findUserback to summary
private SearchResult findUser(String username) throws LoginException
findUserback to summary
private SearchResult findUser(DirContext dirContext, String filter, Object[] filterArguments) throws LoginException
getEnvironmentback to summary
public Hashtable<Object, Object> getEnvironment()

get the context for connection

Returns:Hashtable<Object, Object>

the environment details for the context

getOptionback to summary
private String getOption(Map<String, ?> options, String key, String defaultValue)
getUserback to summary
public AbstractLoginModule.JAASUser getUser(String username) throws Exception

Implements abstract org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.getUser.

get the available information about the user

for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario

roles are also an optional concept if required

Parameters
username:String

the user name

Returns:AbstractLoginModule.JAASUser

the userinfo for the username

Annotations
@Override
Exceptions
Exception:
if unable to get the user info
getUserAttributesback to summary
private Attributes getUserAttributes(String username) throws LoginException

attempts to get the users LDAP attributes from the users context

Note

this is not an user authenticated operation

Returns:Attributes

the Attributes from the user

getUserCredentialsback to summary
private String getUserCredentials(Attributes attributes) throws LoginException
getUserRolesback to summary
private List<String> getUserRoles(DirContext dirContext, String username, Attributes attributes) throws LoginException, NamingException

attempts to get the users roles from the root context

Note

this is not an user authenticated operation

getUserRolesByDnback to summary
private List<String> getUserRolesByDn(DirContext dirContext, String userDn) throws NamingException
hexToBase64back to summary
private static String hexToBase64(String src)
initializeback to summary
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options)

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.initialize.

Implements javax.security.auth.spi.LoginModule.initialize.

Init LoginModule.

Called once by JAAS after new instance is created.

Parameters
subject:Subject

the subect

callbackHandler:CallbackHandler

the callback handler

sharedState:Map<String, ?>

the shared state map

options:Map<String, ?>

the option map

Annotations
@Override
loginback to summary
public boolean login() throws LoginException

Overrides org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.login.

Implements javax.security.auth.spi.LoginModule.login.

since ldap uses a context bind for valid authentication checking, we override login()

if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic

Returns:boolean

true if authenticated, false otherwise

Annotations
@Override
Exceptions
LoginException:
if unable to login
org.eclipse.jetty.security.jaas.spi back to summary

public Class LdapLoginModule.LDAPBindingUser

extends JAASUser
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv DirContext
_context

pack-priv String
_userDn

Constructor Summary

AccessConstructor and Description
public
LDAPBindingUser(UserPrincipal user, DirContext context, String userDn)

Method Summary

Modifier and TypeMethod and Description
public List<String>
doFetchRoles()

Implements abstract org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.JAASUser.doFetchRoles.

Inherited from org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.JAASUser:
checkCredentialfetchRolesgetUserNamesetJAASInfounsetJAASInfo

Field Detail

_contextback to summary
pack-priv DirContext _context
_userDnback to summary
pack-priv String _userDn

Constructor Detail

LDAPBindingUserback to summary
public LDAPBindingUser(UserPrincipal user, DirContext context, String userDn)

Method Detail

doFetchRolesback to summary
public List<String> doFetchRoles() throws Exception

Implements abstract org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.JAASUser.doFetchRoles.

Annotations
@Override
org.eclipse.jetty.security.jaas.spi back to summary

public Class LdapLoginModule.LDAPUser

extends JAASUser
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv Attributes
attributes

Constructor Summary

AccessConstructor and Description
public
LDAPUser(UserPrincipal user, Attributes attributes)

Method Summary

Modifier and TypeMethod and Description
public List<String>
doFetchRoles()

Implements abstract org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.JAASUser.doFetchRoles.

Inherited from org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.JAASUser:
checkCredentialfetchRolesgetUserNamesetJAASInfounsetJAASInfo

Field Detail

attributesback to summary
pack-priv Attributes attributes

Constructor Detail

LDAPUserback to summary
public LDAPUser(UserPrincipal user, Attributes attributes)

Method Detail

doFetchRolesback to summary
public List<String> doFetchRoles() throws Exception

Implements abstract org.eclipse.jetty.security.jaas.spi.AbstractLoginModule.JAASUser.doFetchRoles.

Annotations
@Override