Bind-only LDAP security DAO, without user management

https://www.argeo.org/bugzilla/show_bug.cgi?id=168

git-svn-id: https://svn.argeo.org/commons/trunk@6838 4cfe0d0a-d680-48aa-b62c-e0a02a3f76cc

diff --git a/security/modules/org.argeo.security.auth.ldap/.project b/security/modules/org.argeo.security.auth.ldap/.project
index cd8b39380012fc6d33ac47333889e0cd956d6920..0c72d59143123d7ac4c8017ec1a8a0e9495e5260 100644 (file)
--- a/security/modules/org.argeo.security.auth.ldap/.project
+++ b/security/modules/org.argeo.security.auth.ldap/.project
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <projectDescription>
-       <name>org.argeo.security.dao.ldap</name>
+       <name>org.argeo.security.auth.ldap</name>
        <comment></comment>
        <projects>
        </projects>

diff --git a/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-osgi.xml b/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-osgi.xml
index aa3b67ac64e222245415f0eb39c7165ed812e8de..d817f96441a96d0dfddc9db6721a948e18a599f4 100644 (file)
--- a/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-osgi.xml
+++ b/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-osgi.xml
@@ -16,12 +16,12 @@
                context-class-loader="service-provider" />\r
 \r
        <!-- User management -->\r
-       <service ref="userDetailsManager"\r
-               interface="org.springframework.security.userdetails.UserDetailsService"\r
-               context-class-loader="service-provider" />\r
-       <service ref="userDetailsManager"\r
-               interface="org.springframework.security.userdetails.UserDetailsManager"\r
-               context-class-loader="service-provider" />\r
-       <service ref="userDetailsManager" interface="org.argeo.security.UserAdminService"\r
-               context-class-loader="service-provider" />\r
+<!--   <service ref="userDetailsManager" -->\r
+<!--           interface="org.springframework.security.userdetails.UserDetailsService" -->\r
+<!--           context-class-loader="service-provider" /> -->\r
+<!--   <service ref="userDetailsManager" -->\r
+<!--           interface="org.springframework.security.userdetails.UserDetailsManager" -->\r
+<!--           context-class-loader="service-provider" /> -->\r
+<!--   <service ref="userDetailsManager" interface="org.argeo.security.UserAdminService" -->\r
+<!--           context-class-loader="service-provider" /> -->\r
 </beans:beans>
\ No newline at end of file

diff --git a/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-services.xml b/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-services.xml
index 36dedf3891587823d384000e6f777dea902e1b01..0b9a8b8f0bfe1bec6a21368de84e6e894ea01d5d 100644 (file)
--- a/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-services.xml
+++ b/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap-services.xml
@@ -8,7 +8,7 @@
                <property name="providers">
                        <list>
                                <ref bean="authByAdapterProvider" />
-                               <ref bean="preAuthProvider" />
+<!--                           <ref bean="preAuthProvider" /> -->
                                <ref bean="anonymousAuthenticationProvider" />
                                <ref bean="rememberMeAuthenticationProvider" />
                                <ref bean="ldapAuthenticationProvider" />
@@ -23,16 +23,16 @@
                <property name="key" value="${argeo.security.systemKey}" />
        </bean>
 
-       <bean id="preAuthProvider"
-               class="org.springframework.security.providers.preauth.PreAuthenticatedAuthenticationProvider">
-               <description><![CDATA[Pre-authentication]]></description>
-               <property name="preAuthenticatedUserDetailsService">
-                       <bean id="userDetailsServiceWrapper"
-                               class="org.springframework.security.userdetails.UserDetailsByNameServiceWrapper">
-                               <property name="userDetailsService" ref="userDetailsManager" />
-                       </bean>
-               </property>
-       </bean>
+<!--   <bean id="preAuthProvider" -->
+<!--           class="org.springframework.security.providers.preauth.PreAuthenticatedAuthenticationProvider"> -->
+<!--           <description><![CDATA[Pre-authentication]]></description> -->
+<!--           <property name="preAuthenticatedUserDetailsService"> -->
+<!--                   <bean id="userDetailsServiceWrapper" -->
+<!--                           class="org.springframework.security.userdetails.UserDetailsByNameServiceWrapper"> -->
+<!--                           <property name="userDetailsService" ref="userDetailsManager" /> -->
+<!--                   </bean> -->
+<!--           </property> -->
+<!--   </bean> -->
 
        <bean id="anonymousAuthenticationProvider"
                class="org.springframework.security.providers.anonymous.AnonymousAuthenticationProvider">

diff --git a/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap.xml b/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap.xml
index 3777f8853d5e6ab1437d92f668b477697ca3cd0c..f367aba1d399ec262f30e5aa48e1a34085d8acba 100644 (file)
--- a/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap.xml
+++ b/security/modules/org.argeo.security.auth.ldap/META-INF/spring/security-ldap.xml
@@ -22,59 +22,59 @@
        </bean>
 
        <!-- PasswordComparisonAuthenticator doesn't work with SSHA -->
+<!--   <bean id="ldapAuthenticator" -->
+<!--           class="org.springframework.security.providers.ldap.authenticator.PasswordComparisonAuthenticator"> -->
+<!--           <constructor-arg ref="contextSource" /> -->
+<!--           <property name="userDnPatterns"> -->
+<!--                   <list> -->
+<!--                           <value><![CDATA[${argeo.ldap.usernameAttribute}={0},${argeo.ldap.userBase}]]></value> -->
+<!--                   </list> -->
+<!--           </property> -->
+<!--           <property name="passwordAttributeName" value="${argeo.ldap.passwordAttribute}" /> -->
+<!--           <property name="passwordEncoder" ref="passwordEncoder" /> -->
+<!--   </bean> -->
+
+       <!-- Bind authenticator doesn't work with Apache DS 1.0 -->
        <bean id="ldapAuthenticator"
-               class="org.springframework.security.providers.ldap.authenticator.PasswordComparisonAuthenticator">
+               class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">
                <constructor-arg ref="contextSource" />
                <property name="userDnPatterns">
                        <list>
                                <value><![CDATA[${argeo.ldap.usernameAttribute}={0},${argeo.ldap.userBase}]]></value>
                        </list>
                </property>
-               <property name="passwordAttributeName" value="${argeo.ldap.passwordAttribute}" />
-               <property name="passwordEncoder" ref="passwordEncoder" />
        </bean>
 
-       <!-- Bind authenticator doesn't work with Apache DS 1.0 -->
-       <!-- <bean id="ldapAuthenticator" -->
-       <!-- class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator"> -->
-       <!-- <constructor-arg ref="contextSource" /> -->
-       <!-- <property name="userDnPatterns"> -->
-       <!-- <list> -->
-       <!-- <value><![CDATA[${argeo.ldap.usernameAttribute}={0},${argeo.ldap.userBase}]]></value> -->
-       <!-- </list> -->
-       <!-- </property> -->
-       <!-- </bean> -->
-
        <!-- USER DETAILS -->
-       <bean id="userDetailsManager" class="org.argeo.security.ldap.ArgeoLdapUserDetailsManager">
-               <constructor-arg ref="contextSource" />
-               <property name="groupSearchBase" value="${argeo.ldap.groupBase}" />
-               <property name="groupMemberAttributeName" value="${argeo.ldap.groupMemberAttribute}" />
-               <property name="usernameMapper" ref="usernameMapper" />
-               <property name="userDetailsMapper" ref="jcrLdapSynchronizer" />
-               <property name="userAdminDao" ref="userAdminDao" />
-               <property name="passwordEncoder" ref="passwordEncoder" />
-               <property name="passwordAttributeName" value="${argeo.ldap.passwordAttribute}" />
-               <property name="superUsername" value="${argeo.security.superUsername}" />
-       </bean>
+<!--   <bean id="userDetailsManager" class="org.argeo.security.ldap.ArgeoLdapUserDetailsManager"> -->
+<!--           <constructor-arg ref="contextSource" /> -->
+<!--           <property name="groupSearchBase" value="${argeo.ldap.groupBase}" /> -->
+<!--           <property name="groupMemberAttributeName" value="${argeo.ldap.groupMemberAttribute}" /> -->
+<!--           <property name="usernameMapper" ref="usernameMapper" /> -->
+<!--           <property name="userDetailsMapper" ref="jcrLdapSynchronizer" /> -->
+<!--           <property name="userAdminDao" ref="userAdminDao" /> -->
+<!--           <property name="passwordEncoder" ref="passwordEncoder" /> -->
+<!--           <property name="passwordAttributeName" value="${argeo.ldap.passwordAttribute}" /> -->
+<!--           <property name="superUsername" value="${argeo.security.superUsername}" /> -->
+<!--   </bean> -->
 
-       <bean id="userAdminDao" class="org.argeo.security.ldap.ArgeoUserAdminDaoLdap">
-               <constructor-arg ref="contextSource" />
-               <property name="userBase" value="${argeo.ldap.userBase}" />
-               <property name="usernameAttribute" value="${argeo.ldap.usernameAttribute}" />
-               <property name="groupClasses">
-                       <list>
-                               <value>top</value>
-                               <value>${argeo.ldap.groupClass}</value>
-                       </list>
-               </property>
-               <property name="groupBase" value="${argeo.ldap.groupBase}" />
-               <property name="groupRoleAttribute" value="${argeo.ldap.groupRoleAttribute}" />
-               <property name="groupMemberAttribute" value="${argeo.ldap.groupMemberAttribute}" />
-               <property name="defaultRole" value="${argeo.security.defaultRole}" />
-               <property name="rolePrefix" value="${argeo.security.rolePrefix}" />
-               <property name="usernameMapper" ref="usernameMapper" />
-       </bean>
+<!--   <bean id="userAdminDao" class="org.argeo.security.ldap.ArgeoUserAdminDaoLdap"> -->
+<!--           <constructor-arg ref="contextSource" /> -->
+<!--           <property name="userBase" value="${argeo.ldap.userBase}" /> -->
+<!--           <property name="usernameAttribute" value="${argeo.ldap.usernameAttribute}" /> -->
+<!--           <property name="groupClasses"> -->
+<!--                   <list> -->
+<!--                           <value>top</value> -->
+<!--                           <value>${argeo.ldap.groupClass}</value> -->
+<!--                   </list> -->
+<!--           </property> -->
+<!--           <property name="groupBase" value="${argeo.ldap.groupBase}" /> -->
+<!--           <property name="groupRoleAttribute" value="${argeo.ldap.groupRoleAttribute}" /> -->
+<!--           <property name="groupMemberAttribute" value="${argeo.ldap.groupMemberAttribute}" /> -->
+<!--           <property name="defaultRole" value="${argeo.security.defaultRole}" /> -->
+<!--           <property name="rolePrefix" value="${argeo.security.rolePrefix}" /> -->
+<!--           <property name="usernameMapper" ref="usernameMapper" /> -->
+<!--   </bean> -->
 
        <bean id="usernameMapper"
                class="org.springframework.security.ldap.DefaultLdapUsernameToDnMapper">
@@ -96,8 +96,8 @@
                class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
                <constructor-arg
                        value="${argeo.ldap.protocol}://${argeo.ldap.host}:${argeo.ldap.port}/${argeo.ldap.rootdn}" />
-               <property name="userDn" value="${argeo.ldap.manager.userdn}" />
-               <property name="password" value="${argeo.ldap.manager.password}" />
+<!--           <property name="userDn" value="${argeo.ldap.manager.userdn}" /> -->
+<!--           <property name="password" value="${argeo.ldap.manager.password}" /> -->
        </bean>
 
        <bean id="ldapTemplate" class="org.springframework.ldap.core.LdapTemplate">

diff --git a/security/modules/org.argeo.security.auth.ldap/pom.xml b/security/modules/org.argeo.security.auth.ldap/pom.xml
index 6c3cf75f449145a9407b9e2c787dd5d12f8664c3..3f0dca9cfaff14113e1ec629cbb171a18267281a 100644 (file)
--- a/security/modules/org.argeo.security.auth.ldap/pom.xml
+++ b/security/modules/org.argeo.security.auth.ldap/pom.xml
@@ -6,8 +6,8 @@
                <artifactId>modules</artifactId>
                <relativePath>..</relativePath>
        </parent>
-       <artifactId>org.argeo.security.dao.ldap</artifactId>
-       <name>Commons Security DAO LDAP</name>
+       <artifactId>org.argeo.security.auth.ldap</artifactId>
+       <name>Commons Security Auth LDAP</name>
        <build>
                <plugins>
                        <plugin>

diff --git a/security/modules/pom.xml b/security/modules/pom.xml
index 5bbeba8fdec60a56d1c59e0bb64f5d40aa675cf1..38469edd79ae9875eb87ec5aab2437e5d913cb2c 100644 (file)
--- a/security/modules/pom.xml
+++ b/security/modules/pom.xml
@@ -15,6 +15,7 @@
                <module>org.argeo.security.dao.os</module>
                <module>org.argeo.security.dao.jackrabbit</module>
                <module>org.argeo.security.dao.ldap</module>
+               <module>org.argeo.security.auth.ldap</module>
                <module>org.argeo.security.webapp</module>
        </modules>
        <build>

diff --git a/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java b/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java
index 08c985c3b750577f09fe404f2a6ad6a5b39afc28..3e9e2cbfad23acc0bf8c0fb28869eee5935937ea 100644 (file)
--- a/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java
+++ b/security/runtime/org.argeo.security.ldap/src/main/java/org/argeo/security/ldap/jcr/JcrLdapSynchronizer.java
@@ -23,6 +23,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Random;
 import java.util.SortedSet;
+import java.util.UUID;
 
 import javax.jcr.Node;
 import javax.jcr.NodeIterator;
@@ -277,7 +278,8 @@ public class JcrLdapSynchronizer implements UserDetailsContextMapper,
                                .getAttributeSortedStringSet(passwordAttribute);
                String password;
                if (passwordAttributes == null || passwordAttributes.size() == 0) {
-                       throw new ArgeoException("No password found for user " + username);
+                       //throw new ArgeoException("No password found for user " + username);
+                       password = "NULL";
                } else {
                        byte[] arr = (byte[]) passwordAttributes.first();
                        password = new String(arr);