LDAP user admin
[lgpl/argeo-commons.git] / org.argeo.security.core / src / org / argeo / osgi / useradmin / LdapUserAdmin.java
index 22d9a54227b383d629f13e6be760731bd01b972d..c2e26ca4cfc09b610cc9880679f9175c8da7ea83 100644 (file)
@@ -40,26 +40,21 @@ public class LdapUserAdmin extends AbstractUserDirectory {
                super(properties);
                try {
                        Hashtable<String, Object> connEnv = new Hashtable<String, Object>();
-                       connEnv.put(Context.INITIAL_CONTEXT_FACTORY,
-                                       "com.sun.jndi.ldap.LdapCtxFactory");
+                       connEnv.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
                        connEnv.put(Context.PROVIDER_URL, getUri().toString());
-                       connEnv.put("java.naming.ldap.attributes.binary",
-                                       LdifName.userPassword.name());
+                       connEnv.put("java.naming.ldap.attributes.binary", LdifName.userPassword.name());
 
                        initialLdapContext = new InitialLdapContext(connEnv, null);
                        // StartTlsResponse tls = (StartTlsResponse) ctx
                        // .extendedOperation(new StartTlsRequest());
                        // tls.negotiate();
-                       initialLdapContext.addToEnvironment(
-                                       Context.SECURITY_AUTHENTICATION, "simple");
+                       initialLdapContext.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");
                        Object principal = properties.get(Context.SECURITY_PRINCIPAL);
                        if (principal != null) {
-                               initialLdapContext.addToEnvironment(Context.SECURITY_PRINCIPAL,
-                                               principal.toString());
+                               initialLdapContext.addToEnvironment(Context.SECURITY_PRINCIPAL, principal.toString());
                                Object creds = properties.get(Context.SECURITY_CREDENTIALS);
                                if (creds != null) {
-                                       initialLdapContext.addToEnvironment(
-                                                       Context.SECURITY_CREDENTIALS, creds.toString());
+                                       initialLdapContext.addToEnvironment(Context.SECURITY_CREDENTIALS, creds.toString());
 
                                }
                        }
@@ -99,12 +94,10 @@ public class LdapUserAdmin extends AbstractUserDirectory {
                        LdifUser res;
                        if (attrs.get(objectClass.name()).contains(getGroupObjectClass()))
                                res = new LdifGroup(this, name, attrs);
-                       else if (attrs.get(objectClass.name()).contains(
-                                       getUserObjectClass()))
+                       else if (attrs.get(objectClass.name()).contains(getUserObjectClass()))
                                res = new LdifUser(this, name, attrs);
                        else
-                               throw new UserDirectoryException("Unsupported LDAP type for "
-                                               + name);
+                               throw new UserDirectoryException("Unsupported LDAP type for " + name);
                        return res;
                } catch (NamingException e) {
                        return null;
@@ -114,15 +107,14 @@ public class LdapUserAdmin extends AbstractUserDirectory {
        @Override
        protected List<DirectoryUser> doGetRoles(Filter f) {
                try {
-                       String searchFilter = f != null ? f.toString() : "(|("
-                                       + objectClass + "=" + getUserObjectClass() + ")("
-                                       + objectClass + "=" + getGroupObjectClass() + "))";
+                       String searchFilter = f != null ? f.toString()
+                                       : "(|(" + objectClass + "=" + getUserObjectClass() + ")(" + objectClass + "="
+                                                       + getGroupObjectClass() + "))";
                        SearchControls searchControls = new SearchControls();
                        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
 
                        String searchBase = getBaseDn();
-                       NamingEnumeration<SearchResult> results = getLdapContext().search(
-                                       searchBase, searchFilter, searchControls);
+                       NamingEnumeration<SearchResult> results = getLdapContext().search(searchBase, searchFilter, searchControls);
 
                        ArrayList<DirectoryUser> res = new ArrayList<DirectoryUser>();
                        results: while (results.hasMoreElements()) {
@@ -136,49 +128,41 @@ public class LdapUserAdmin extends AbstractUserDirectory {
                                else if (objectClassAttr.contains(getUserObjectClass()))
                                        role = new LdifUser(this, dn, attrs);
                                else {
-                                       log.warn("Unsupported LDAP type for "
-                                                       + searchResult.getName());
+                                       log.warn("Unsupported LDAP type for " + searchResult.getName());
                                        continue results;
                                }
                                res.add(role);
                        }
                        return res;
                } catch (Exception e) {
-                       throw new UserDirectoryException(
-                                       "Cannot get roles for filter " + f, e);
+                       throw new UserDirectoryException("Cannot get roles for filter " + f, e);
                }
        }
 
-       private LdapName toDn(String baseDn, Binding binding)
-                       throws InvalidNameException {
-               return new LdapName(binding.isRelative() ? binding.getName() + ","
-                               + baseDn : binding.getName());
+       private LdapName toDn(String baseDn, Binding binding) throws InvalidNameException {
+               return new LdapName(binding.isRelative() ? binding.getName() + "," + baseDn : binding.getName());
        }
 
        @Override
        protected List<LdapName> getDirectGroups(LdapName dn) {
                List<LdapName> directGroups = new ArrayList<LdapName>();
                try {
-                       String searchFilter = "(&(" + objectClass + "="
-                                       + getGroupObjectClass() + ")(" + getMemberAttributeId()
+                       String searchFilter = "(&(" + objectClass + "=" + getGroupObjectClass() + ")(" + getMemberAttributeId()
                                        + "=" + dn + "))";
 
                        SearchControls searchControls = new SearchControls();
                        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
 
                        String searchBase = getBaseDn();
-                       NamingEnumeration<SearchResult> results = getLdapContext().search(
-                                       searchBase, searchFilter, searchControls);
+                       NamingEnumeration<SearchResult> results = getLdapContext().search(searchBase, searchFilter, searchControls);
 
                        while (results.hasMoreElements()) {
-                               SearchResult searchResult = (SearchResult) results
-                                               .nextElement();
+                               SearchResult searchResult = (SearchResult) results.nextElement();
                                directGroups.add(toDn(searchBase, searchResult));
                        }
                        return directGroups;
                } catch (Exception e) {
-                       throw new ArgeoException("Cannot populate direct members of " + dn,
-                                       e);
+                       throw new ArgeoException("Cannot populate direct members of " + dn, e);
                }
        }
 
@@ -189,20 +173,17 @@ public class LdapUserAdmin extends AbstractUserDirectory {
                        // delete
                        for (LdapName dn : wc.getDeletedUsers().keySet()) {
                                if (!entryExists(dn))
-                                       throw new UserDirectoryException("User to delete no found "
-                                                       + dn);
+                                       throw new UserDirectoryException("User to delete no found " + dn);
                        }
                        // add
                        for (LdapName dn : wc.getNewUsers().keySet()) {
                                if (entryExists(dn))
-                                       throw new UserDirectoryException("User to create found "
-                                                       + dn);
+                                       throw new UserDirectoryException("User to create found " + dn);
                        }
                        // modify
                        for (LdapName dn : wc.getModifiedUsers().keySet()) {
-                               if (!entryExists(dn))
-                                       throw new UserDirectoryException("User to modify not found "
-                                                       + dn);
+                               if (!wc.getNewUsers().containsKey(dn) && !entryExists(dn))
+                                       throw new UserDirectoryException("User to modify not found " + dn);
                        }
                } catch (NamingException e) {
                        throw new UserDirectoryException("Cannot prepare LDAP", e);
@@ -232,8 +213,7 @@ public class LdapUserAdmin extends AbstractUserDirectory {
                        // modify
                        for (LdapName dn : wc.getModifiedUsers().keySet()) {
                                Attributes modifiedAttrs = wc.getModifiedUsers().get(dn);
-                               getLdapContext().modifyAttributes(dn,
-                                               DirContext.REPLACE_ATTRIBUTE, modifiedAttrs);
+                               getLdapContext().modifyAttributes(dn, DirContext.REPLACE_ATTRIBUTE, modifiedAttrs);
                        }
                } catch (NamingException e) {
                        throw new UserDirectoryException("Cannot commit LDAP", e);