Top Description Fields Constructors Methods
org.mortbay.jetty.plus.jaas.spi

public Class LdapLoginModule

extends AbstractLoginModule
Class Inheritance
Imports
java.io.IOException, java.util.ArrayList, .Hashtable, .List, .Map, .Properties, javax.naming.Context, .NamingEnumeration, .NamingException, javax.naming.directory.Attribute, .Attributes, .DirContext, .InitialDirContext, .SearchControls, .SearchResult, javax.security.auth.Subject, javax.security.auth.callback.Callback, .CallbackHandler, .NameCallback, .UnsupportedCallbackException, javax.security.auth.login.LoginException, org.mortbay.jetty.plus.jaas.callback.ObjectCallback, org.mortbay.jetty.security.Credential, org.mortbay.log.Log
A LdapLoginModule for use with JAAS setups

The jvm should be started with the following parameter:

-Djava.security.auth.login.config=etc/ldap-loginModule.conf

and an example of the ldap-loginModule.conf would be: 

ldaploginmodule {
   org.mortbay.jetty.plus.jaas.spi.LdapLoginModule required
   debug="true"
   contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
   hostname="ldap.example.com"
   port="389"
   bindDn="cn=Directory Manager"
   bindPassword="directory"
   authenticationMethod="simple"
   forceBindingLogin="false"
   userBaseDn="ou=people,dc=alcatel"
   userRdnAttribute="uid"
   userIdAttribute="uid"
   userPasswordAttribute="userPassword"
   userObjectClass="inetOrgPerson"
   roleBaseDn="ou=groups,dc=example,dc=com"
   roleNameAttribute="cn"
   roleMemberAttribute="uniqueMember"
   roleObjectClass="groupOfUniqueNames";
   };
Authors
Jesse McConnell , Frederic Nizery , Trygve Laugstol

Field Summary

Modifier and TypeField and Description
private String
_authenticationMethod

Context.SECURITY_AUTHENTICATION

private String
_bindDn

root DN used to connect to

private String
_bindPassword

password used to connect to the root ldap context

private String
_contextFactory

Context.INITIAL_CONTEXT_FACTORY

private boolean
_debug

private boolean
_forceBindingLogin

if the getUserInfo can pull a password off of the user then password comparison is an option for authn, to force binding login checks, set this to true

private String
_hostname

hostname of the ldap server

private int
_port

port of the ldap server

private String
_roleBaseDn

base DN where role membership is to be searched from

private String
_roleMemberAttribute

name of the attribute that a username would be under a role class

private String
_roleNameAttribute

the name of the attribute that a role would be stored under

private String
_roleObjectClass

object class of roles

private DirContext
_rootContext

private String
_userBaseDn

base DN where users are to be searched from

private String
_userIdAttribute

attribute that the principal is located

private String
_userObjectClass

object class of a user

private String
_userPasswordAttribute

name of the attribute that a users password is stored under

Note

not always accessible, see force binding login

private String
_userRdnAttribute

attribute that the principal is located

Constructor Summary

AccessConstructor and Description
public
LdapLoginModule()

Method Summary

Modifier and TypeMethod and Description
public boolean
abort()

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.abort.

Implements javax.security.auth.spi.LoginModule.abort.

Method to abort the authentication process (phase 2).
protected boolean
bindingLogin(String username, Object password)

binding authentication check This methode of authentication works only if the user branch of the DIT (ldap tree) has an ACI (acces control instruction) that allow the access to any user or at least for the user that logs in.

public boolean
commit()

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.commit.

Implements javax.security.auth.spi.LoginModule.commit.

Method to commit the authentication process (phase 2).
public static String
convertCredentialJettyToLdap(String encryptedPassword)

public static String
convertCredentialLdapToJetty(String encryptedPassword)

protected boolean
credentialLogin(Object webCredential)

password supplied authentication check

protected String
doRFC2254Encoding(String inputString)

private SearchResult
findUser(String username)

public Hashtable<Object, Object>
getEnvironment()

get the context for connection

private String
getOption(Map<K, V> options, String key, String defaultValue)

private String
getUserCredentials(String username)

attempts to get the users credentials from the users context

Note

this is not an user authenticated operation

public UserInfo
getUserInfo(String username)

Implements abstract org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.getUserInfo.

get the available information about the user

for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario

roles are also an optional concept if required

private List<E>
getUserRoles(DirContext dirContext, String username)

attempts to get the users roles from the root context

Note

this is not an user authenticated operation

private List<E>
getUserRolesByDn(DirContext dirContext, String userDn)

public void
initialize(Subject subject, CallbackHandler callbackHandler, Map<K, V> sharedState, Map<K, V> options)

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.initialize.

Implements javax.security.auth.spi.LoginModule.initialize.

Init LoginModule.
public boolean
login()

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.login.

Implements javax.security.auth.spi.LoginModule.login.

since ldap uses a context bind for valid authentication checking, we override login()

if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic

Inherited from org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule:
configureCallbacksgetCallbackHandlergetCurrentUsergetSubjectisAuthenticatedisCommittedlogoutsetAuthenticatedsetCallbackHandlersetCommittedsetCurrentUsersetSubject

Field Detail

_authenticationMethodback to summary
private String _authenticationMethod

Context.SECURITY_AUTHENTICATION

_bindDnback to summary
private String _bindDn

root DN used to connect to

_bindPasswordback to summary
private String _bindPassword

password used to connect to the root ldap context

_contextFactoryback to summary
private String _contextFactory

Context.INITIAL_CONTEXT_FACTORY

_debugback to summary
private boolean _debug
_forceBindingLoginback to summary
private boolean _forceBindingLogin

if the getUserInfo can pull a password off of the user then password comparison is an option for authn, to force binding login checks, set this to true

_hostnameback to summary
private String _hostname

hostname of the ldap server

_portback to summary
private int _port

port of the ldap server

_roleBaseDnback to summary
private String _roleBaseDn

base DN where role membership is to be searched from

_roleMemberAttributeback to summary
private String _roleMemberAttribute

name of the attribute that a username would be under a role class

_roleNameAttributeback to summary
private String _roleNameAttribute

the name of the attribute that a role would be stored under

_roleObjectClassback to summary
private String _roleObjectClass

object class of roles

_rootContextback to summary
private DirContext _rootContext
_userBaseDnback to summary
private String _userBaseDn

base DN where users are to be searched from

_userIdAttributeback to summary
private String _userIdAttribute

attribute that the principal is located

_userObjectClassback to summary
private String _userObjectClass

object class of a user

_userPasswordAttributeback to summary
private String _userPasswordAttribute

name of the attribute that a users password is stored under

Note

not always accessible, see force binding login

_userRdnAttributeback to summary
private String _userRdnAttribute

attribute that the principal is located

Constructor Detail

LdapLoginModuleback to summary
public LdapLoginModule()

Method Detail

abortback to summary
public boolean abort() throws LoginException

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.abort.

Implements javax.security.auth.spi.LoginModule.abort.

Doc from javax.security.auth.spi.LoginModule.abort.

Method to abort the authentication process (phase 2).

This method is called if the LoginContext's overall authentication failed. (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules did not succeed).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method cleans up any state that was originally saved.

Returns:boolean

true if this method succeeded, or false if this LoginModule should be ignored.

Exceptions
LoginException:
if the abort fails
bindingLoginback to summary
protected boolean bindingLogin(String username, Object password) throws LoginException, NamingException

binding authentication check This methode of authentication works only if the user branch of the DIT (ldap tree) has an ACI (acces control instruction) that allow the access to any user or at least for the user that logs in.

commitback to summary
public boolean commit() throws LoginException

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.commit.

Implements javax.security.auth.spi.LoginModule.commit.

Doc from javax.security.auth.spi.LoginModule.commit.

Method to commit the authentication process (phase 2).

This method is called if the LoginContext's overall authentication succeeded (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules succeeded).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method associates relevant Principals and Credentials with the Subject located in the LoginModule. If this LoginModule's own authentication attempted failed, then this method removes/destroys any state that was originally saved.

Exceptions
LoginException:
if the commit fails
convertCredentialJettyToLdapback to summary
public static String convertCredentialJettyToLdap(String encryptedPassword)
convertCredentialLdapToJettyback to summary
public static String convertCredentialLdapToJetty(String encryptedPassword)
credentialLoginback to summary
protected boolean credentialLogin(Object webCredential) throws LoginException

password supplied authentication check

doRFC2254Encodingback to summary
protected String doRFC2254Encoding(String inputString)
findUserback to summary
private SearchResult findUser(String username) throws NamingException, LoginException
getEnvironmentback to summary
public Hashtable<Object, Object> getEnvironment()

get the context for connection

getOptionback to summary
private String getOption(Map<K, V> options, String key, String defaultValue)
getUserCredentialsback to summary
private String getUserCredentials(String username) throws LoginException

attempts to get the users credentials from the users context

Note

this is not an user authenticated operation

getUserInfoback to summary
public UserInfo getUserInfo(String username) throws Exception

Implements abstract org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.getUserInfo.

get the available information about the user

for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario

roles are also an optional concept if required

getUserRolesback to summary
private List<E> getUserRoles(DirContext dirContext, String username) throws LoginException, NamingException

attempts to get the users roles from the root context

Note

this is not an user authenticated operation

getUserRolesByDnback to summary
private List<E> getUserRolesByDn(DirContext dirContext, String userDn) throws LoginException, NamingException
initializeback to summary
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<K, V> sharedState, Map<K, V> options)

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.initialize.

Implements javax.security.auth.spi.LoginModule.initialize.

Init LoginModule. Called once by JAAS after new instance is created.

loginback to summary
public boolean login() throws LoginException

Overrides org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.login.

Implements javax.security.auth.spi.LoginModule.login.

since ldap uses a context bind for valid authentication checking, we override login()

if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic

Exceptions
LoginException:

Doc from javax.security.auth.spi.LoginModule.login.

if the authentication fails