ldap/ArgeoSecurityDaoLdap.java

   1 /*
   2  * Copyright (C) 2010 Mathieu Baudier <mbaudier@argeo.org>
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *         http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 package org.argeo.security.ldap;
  18
  19 import static org.argeo.security.core.ArgeoUserDetails.createSimpleArgeoUser;
  20
  21 import java.security.NoSuchAlgorithmException;
  22 import java.security.SecureRandom;
  23 import java.util.ArrayList;
  24 import java.util.List;
  25 import java.util.Random;
  26
  27 import javax.naming.Name;
  28 import javax.naming.NamingException;
  29 import javax.naming.directory.DirContext;
  30
  31 import org.argeo.security.ArgeoSecurityDao;
  32 import org.argeo.security.ArgeoUser;
  33 import org.argeo.security.SimpleArgeoUser;
  34 import org.argeo.security.core.ArgeoUserDetails;
  35 import org.springframework.beans.factory.InitializingBean;
  36 import org.springframework.ldap.core.ContextExecutor;
  37 import org.springframework.ldap.core.ContextMapper;
  38 import org.springframework.ldap.core.DirContextAdapter;
  39 import org.springframework.ldap.core.DistinguishedName;
  40 import org.springframework.ldap.core.LdapTemplate;
  41 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
  42 import org.springframework.security.context.SecurityContextHolder;
  43 import org.springframework.security.ldap.DefaultLdapUsernameToDnMapper;
  44 import org.springframework.security.ldap.LdapAuthoritiesPopulator;
  45 import org.springframework.security.ldap.LdapUsernameToDnMapper;
  46 import org.springframework.security.ldap.LdapUtils;
  47 import org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator;
  48 import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
  49 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
  50 import org.springframework.security.providers.ldap.authenticator.LdapShaPasswordEncoder;
  51 import org.springframework.security.userdetails.UserDetails;
  52 import org.springframework.security.userdetails.UserDetailsManager;
  53 import org.springframework.security.userdetails.UserDetailsService;
  54 import org.springframework.security.userdetails.ldap.LdapUserDetailsManager;
  55 import org.springframework.security.userdetails.ldap.LdapUserDetailsService;
  56 import org.springframework.security.userdetails.ldap.UserDetailsContextMapper;
  57
  58 public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean {
  59         // private final static Log log = LogFactory.getLog(UserDaoLdap.class);
  60
  61         private UserDetailsManager userDetailsManager;
  62         private LdapAuthoritiesPopulator authoritiesPopulator;
  63         private String userBase = "ou=People";
  64         private String usernameAttributeName = "uid";
  65         private String groupBase = "ou=Roles";
  66         private String[] groupClasses = { "top", "groupOfNames" };
  67         private String groupRoleAttributeName = "cn";
  68         private String groupMemberAttributeName = "member";
  69         private String defaultRole = "ROLE_USER";
  70         private String rolePrefix = "ROLE_";
  71
  72         private final BaseLdapPathContextSource contextSource;
  73         private final LdapTemplate ldapTemplate;
  74
  75         private LdapUsernameToDnMapper usernameMapper = null;
  76
  77         private UserDetailsContextMapper userDetailsMapper;
  78         private LdapUserDetailsService ldapUserDetailsService;
  79         private List<UserNatureMapper> userNatureMappers;
  80
  81         private LdapShaPasswordEncoder ldapShaPasswordEncoder = new LdapShaPasswordEncoder();
  82         private Random random;
  83
  84         public ArgeoSecurityDaoLdap(BaseLdapPathContextSource contextSource) {
  85                 this.contextSource = contextSource;
  86                 ldapTemplate = new LdapTemplate(this.contextSource);
  87                 try {
  88                         random = SecureRandom.getInstance("SHA1PRNG");
  89                 } catch (NoSuchAlgorithmException e) {
  90                         random = new Random(System.currentTimeMillis());
  91                 }
  92         }
  93
  94         public void afterPropertiesSet() throws Exception {
  95                 if (usernameMapper == null)
  96                         usernameMapper = new DefaultLdapUsernameToDnMapper(userBase,
  97                                         usernameAttributeName);
  98
  99                 if (authoritiesPopulator == null) {
 100                         DefaultLdapAuthoritiesPopulator ap = new DefaultLdapAuthoritiesPopulator(
 101                                         ldapTemplate.getContextSource(), groupBase);
 102                         ap.setDefaultRole(defaultRole);
 103                         ap.setGroupSearchFilter(groupMemberAttributeName + "={0}");
 104                         authoritiesPopulator = ap;
 105                 }
 106
 107                 if (userDetailsMapper == null) {
 108                         ArgeoUserDetailsContextMapper audm = new ArgeoUserDetailsContextMapper();
 109                         audm.setUserNatureMappers(userNatureMappers);
 110                         userDetailsMapper = audm;
 111                 }
 112
 113                 if (userDetailsManager == null) {
 114                         LdapUserDetailsManager ludm = new LdapUserDetailsManager(
 115                                         ldapTemplate.getContextSource());
 116                         ludm.setGroupSearchBase(groupBase);
 117                         ludm.setUserDetailsMapper(userDetailsMapper);
 118                         ludm.setUsernameMapper(usernameMapper);
 119                         ludm.setGroupMemberAttributeName(groupMemberAttributeName);
 120                         userDetailsManager = ludm;
 121                 }
 122
 123                 if (ldapUserDetailsService == null) {
 124                         FilterBasedLdapUserSearch ldapUserSearch = new FilterBasedLdapUserSearch(
 125                                         userBase, "(" + usernameAttributeName + "={0})",
 126                                         contextSource);
 127                         ldapUserDetailsService = new LdapUserDetailsService(ldapUserSearch,
 128                                         authoritiesPopulator);
 129                         ldapUserDetailsService.setUserDetailsMapper(userDetailsMapper);
 130                 }
 131         }
 132
 133         public synchronized void create(ArgeoUser user) {
 134                 userDetailsManager.createUser(new ArgeoUserDetails(user));
 135         }
 136
 137         public synchronized ArgeoUser getUser(String uname) {
 138                 SimpleArgeoUser user = createSimpleArgeoUser(getDetails(uname));
 139                 user.setPassword(null);
 140                 return user;
 141         }
 142
 143         public synchronized ArgeoUser getUserWithPassword(String uname) {
 144                 return createSimpleArgeoUser(getDetails(uname));
 145         }
 146
 147         // public ArgeoUser getCurrentUser() {
 148         // ArgeoUser argeoUser = ArgeoUserDetails.securityContextUser();
 149         // if (argeoUser == null)
 150         // return null;
 151         // if (argeoUser.getRoles().contains(defaultRole))
 152         // argeoUser.getRoles().remove(defaultRole);
 153         // return argeoUser;
 154         // }
 155
 156         @SuppressWarnings("unchecked")
 157         public synchronized List<ArgeoUser> listUsers() {
 158                 List<String> usernames = (List<String>) ldapTemplate.listBindings(
 159                                 new DistinguishedName(userBase), new ContextMapper() {
 160                                         public Object mapFromContext(Object ctxArg) {
 161                                                 DirContextAdapter ctx = (DirContextAdapter) ctxArg;
 162                                                 return ctx.getStringAttribute(usernameAttributeName);
 163                                         }
 164                                 });
 165
 166                 List<ArgeoUser> lst = new ArrayList<ArgeoUser>();
 167                 for (String username : usernames) {
 168                         lst.add(createSimpleArgeoUser(getDetails(username)));
 169                 }
 170                 return lst;
 171         }
 172
 173         @SuppressWarnings("unchecked")
 174         public List<String> listEditableRoles() {
 175                 return (List<String>) ldapTemplate.listBindings(groupBase,
 176                                 new ContextMapper() {
 177                                         public Object mapFromContext(Object ctxArg) {
 178                                                 String groupName = ((DirContextAdapter) ctxArg)
 179                                                                 .getStringAttribute(groupRoleAttributeName);
 180                                                 String roleName = convertGroupToRole(groupName);
 181                                                 return roleName;
 182                                         }
 183                                 });
 184         }
 185
 186         public synchronized void update(ArgeoUser user) {
 187                 ArgeoUserDetails argeoUserDetails = new ArgeoUserDetails(user);
 188                 userDetailsManager.updateUser(new ArgeoUserDetails(user));
 189                 // refresh logged in user
 190                 if (ArgeoUserDetails.securityContextUser().getUsername()
 191                                 .equals(argeoUserDetails.getUsername())) {
 192                         SecurityContextHolder.getContext().setAuthentication(
 193                                         new UsernamePasswordAuthenticationToken(argeoUserDetails,
 194                                                         null, argeoUserDetails.getAuthorities()));
 195                 }
 196         }
 197
 198         public synchronized void delete(String username) {
 199                 userDetailsManager.deleteUser(username);
 200         }
 201
 202         public synchronized Boolean userExists(String username) {
 203                 return userDetailsManager.userExists(username);
 204         }
 205
 206         public void createRole(String role, final String superuserName) {
 207                 String group = convertRoleToGroup(role);
 208                 DistinguishedName superuserDn = (DistinguishedName) ldapTemplate
 209                                 .executeReadWrite(new ContextExecutor() {
 210                                         public Object executeWithContext(DirContext ctx)
 211                                                         throws NamingException {
 212                                                 return LdapUtils.getFullDn(
 213                                                                 usernameMapper.buildDn(superuserName), ctx);
 214                                         }
 215                                 });
 216
 217                 Name groupDn = buildGroupDn(group);
 218                 DirContextAdapter context = new DirContextAdapter();
 219                 context.setAttributeValues("objectClass", groupClasses);
 220                 context.setAttributeValue("cn", group);
 221
 222                 // Add superuser because cannot create empty group
 223                 context.setAttributeValue(groupMemberAttributeName,
 224                                 superuserDn.toString());
 225
 226                 ldapTemplate.bind(groupDn, context, null);
 227         }
 228
 229         public void deleteRole(String role) {
 230                 String group = convertRoleToGroup(role);
 231                 Name dn = buildGroupDn(group);
 232                 ldapTemplate.unbind(dn);
 233         }
 234
 235         public Boolean isPasswordValid(String encoded, String raw) {
 236                 return ldapShaPasswordEncoder.isPasswordValid(encoded, raw, null);
 237         }
 238
 239         public String encodePassword(String raw) {
 240                 byte[] salt = null;
 241                 // TODO: check that Linux auth supports SSHA
 242                 // byte[] salt = new byte[16];
 243                 // random.nextBytes(salt);
 244                 return ldapShaPasswordEncoder.encodePassword(raw, salt);
 245         }
 246
 247         protected String convertRoleToGroup(String role) {
 248                 String group = role;
 249                 if (group.startsWith(rolePrefix)) {
 250                         group = group.substring(rolePrefix.length());
 251                         group = group.toLowerCase();
 252                 }
 253                 return group;
 254         }
 255
 256         public String convertGroupToRole(String groupName) {
 257                 groupName = groupName.toUpperCase();
 258
 259                 return rolePrefix + groupName;
 260         }
 261
 262         protected Name buildGroupDn(String name) {
 263                 return new DistinguishedName(groupRoleAttributeName + "=" + name + ","
 264                                 + groupBase);
 265         }
 266
 267         public void setUserDetailsManager(UserDetailsManager userDetailsManager) {
 268                 this.userDetailsManager = userDetailsManager;
 269         }
 270
 271         public void setUserBase(String userBase) {
 272                 this.userBase = userBase;
 273         }
 274
 275         public void setUsernameAttributeName(String usernameAttribute) {
 276                 this.usernameAttributeName = usernameAttribute;
 277         }
 278
 279         public void setAuthoritiesPopulator(
 280                         LdapAuthoritiesPopulator authoritiesPopulator) {
 281                 this.authoritiesPopulator = authoritiesPopulator;
 282         }
 283
 284         protected UserDetails getDetails(String username) {
 285                 return userDetailsManager.loadUserByUsername(username);
 286         }
 287
 288         public void setGroupBase(String groupBase) {
 289                 this.groupBase = groupBase;
 290         }
 291
 292         public void setGroupRoleAttributeName(String groupRoleAttributeName) {
 293                 this.groupRoleAttributeName = groupRoleAttributeName;
 294         }
 295
 296         public void setGroupMemberAttributeName(String groupMemberAttributeName) {
 297                 this.groupMemberAttributeName = groupMemberAttributeName;
 298         }
 299
 300         public void setDefaultRole(String defaultRole) {
 301                 this.defaultRole = defaultRole;
 302         }
 303
 304         public void setRolePrefix(String rolePrefix) {
 305                 this.rolePrefix = rolePrefix;
 306         }
 307
 308         public void setUsernameMapper(LdapUsernameToDnMapper usernameMapper) {
 309                 this.usernameMapper = usernameMapper;
 310         }
 311
 312         public void setUserDetailsMapper(UserDetailsContextMapper userDetailsMapper) {
 313                 this.userDetailsMapper = userDetailsMapper;
 314         }
 315
 316         public LdapAuthoritiesPopulator getAuthoritiesPopulator() {
 317                 return authoritiesPopulator;
 318         }
 319
 320         public UserDetailsContextMapper getUserDetailsMapper() {
 321                 return userDetailsMapper;
 322         }
 323
 324         public void setUserNatureMappers(List<UserNatureMapper> userNatureMappers) {
 325                 this.userNatureMappers = userNatureMappers;
 326         }
 327
 328         public String getDefaultRole() {
 329                 return defaultRole;
 330         }
 331
 332         public void setGroupClasses(String[] groupClasses) {
 333                 this.groupClasses = groupClasses;
 334         }
 335
 336         public UserDetailsService getUserDetailsService() {
 337                 return ldapUserDetailsService;
 338         }
 339
 340 }