X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=security%2Fruntime%2Forg.argeo.security.core%2Fsrc%2Fmain%2Fjava%2Forg%2Fargeo%2Fsecurity%2Fldap%2FArgeoSecurityDaoLdap.java;h=350050bbcb5e30786cdebc7f747b0067e00dbd8e;hb=490d9907457c43acfa965e7979ce5974bc1ba6ca;hp=83e090661533ea71e00f01d36606663ce488cf17;hpb=ff1367187d728854f39a55e360f8908d4ab04159;p=lgpl%2Fargeo-commons.git diff --git a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/ldap/ArgeoSecurityDaoLdap.java b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/ldap/ArgeoSecurityDaoLdap.java index 83e090661..350050bbc 100644 --- a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/ldap/ArgeoSecurityDaoLdap.java +++ b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/ldap/ArgeoSecurityDaoLdap.java @@ -1,6 +1,22 @@ +/* + * Copyright (C) 2010 Mathieu Baudier + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + package org.argeo.security.ldap; -import static org.argeo.security.core.ArgeoUserDetails.createBasicArgeoUser; +import static org.argeo.security.core.ArgeoUserDetails.createSimpleArgeoUser; import java.util.ArrayList; import java.util.List; @@ -11,22 +27,28 @@ import javax.naming.directory.DirContext; import org.argeo.security.ArgeoSecurityDao; import org.argeo.security.ArgeoUser; +import org.argeo.security.SimpleArgeoUser; import org.argeo.security.core.ArgeoUserDetails; import org.springframework.beans.factory.InitializingBean; import org.springframework.ldap.core.ContextExecutor; import org.springframework.ldap.core.ContextMapper; -import org.springframework.ldap.core.ContextSource; import org.springframework.ldap.core.DirContextAdapter; import org.springframework.ldap.core.DistinguishedName; import org.springframework.ldap.core.LdapTemplate; +import org.springframework.ldap.core.support.BaseLdapPathContextSource; +import org.springframework.security.Authentication; +import org.springframework.security.context.SecurityContextHolder; import org.springframework.security.ldap.DefaultLdapUsernameToDnMapper; import org.springframework.security.ldap.LdapAuthoritiesPopulator; import org.springframework.security.ldap.LdapUsernameToDnMapper; import org.springframework.security.ldap.LdapUtils; import org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator; +import org.springframework.security.ldap.search.FilterBasedLdapUserSearch; import org.springframework.security.userdetails.UserDetails; import org.springframework.security.userdetails.UserDetailsManager; +import org.springframework.security.userdetails.UserDetailsService; import org.springframework.security.userdetails.ldap.LdapUserDetailsManager; +import org.springframework.security.userdetails.ldap.LdapUserDetailsService; import org.springframework.security.userdetails.ldap.UserDetailsContextMapper; public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean { @@ -34,19 +56,22 @@ public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean private UserDetailsManager userDetailsManager; private LdapAuthoritiesPopulator authoritiesPopulator; - private String userBase = "ou=users"; + private String userBase = "ou=People"; private String usernameAttributeName = "uid"; - private String groupBase = "ou=groups"; + private String groupBase = "ou=Roles"; + private String[] groupClasses = { "top", "groupOfNames" }; private String groupRoleAttributeName = "cn"; - private String groupMemberAttributeName = "uniquemember"; + private String groupMemberAttributeName = "member"; private String defaultRole = "ROLE_USER"; private String rolePrefix = "ROLE_"; + private final BaseLdapPathContextSource contextSource; private final LdapTemplate ldapTemplate; private LdapUsernameToDnMapper usernameMapper = null; private UserDetailsContextMapper userDetailsMapper; + private LdapUserDetailsService ldapUserDetailsService; private List userNatureMappers; public void afterPropertiesSet() throws Exception { @@ -78,10 +103,19 @@ public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean userDetailsManager = ludm; } + if (ldapUserDetailsService == null) { + FilterBasedLdapUserSearch ldapUserSearch = new FilterBasedLdapUserSearch( + userBase, "(" + usernameAttributeName + "={0})", + contextSource); + ldapUserDetailsService = new LdapUserDetailsService(ldapUserSearch, + authoritiesPopulator); + ldapUserDetailsService.setUserDetailsMapper(userDetailsMapper); + } } - public ArgeoSecurityDaoLdap(ContextSource contextSource) { - ldapTemplate = new LdapTemplate(contextSource); + public ArgeoSecurityDaoLdap(BaseLdapPathContextSource contextSource) { + this.contextSource = contextSource; + ldapTemplate = new LdapTemplate(this.contextSource); } public void create(ArgeoUser user) { @@ -89,7 +123,24 @@ public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean } public ArgeoUser getUser(String uname) { - return createBasicArgeoUser(getDetails(uname)); + SimpleArgeoUser user = createSimpleArgeoUser(getDetails(uname)); + user.setPassword(null); + return user; + } + + public ArgeoUser getUserWithPassword(String uname) { + return createSimpleArgeoUser(getDetails(uname)); + } + + public ArgeoUser getCurrentUser() { + Authentication authentication = SecurityContextHolder.getContext() + .getAuthentication(); + ArgeoUser argeoUser = ArgeoUserDetails.asArgeoUser(authentication); + if (argeoUser == null) + return null; + if (argeoUser.getRoles().contains(defaultRole)) + argeoUser.getRoles().remove(defaultRole); + return argeoUser; } @SuppressWarnings("unchecked") @@ -104,7 +155,7 @@ public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean List lst = new ArrayList(); for (String username : usernames) { - lst.add(createBasicArgeoUser(getDetails(username))); + lst.add(createSimpleArgeoUser(getDetails(username))); } return lst; } @@ -130,10 +181,6 @@ public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean userDetailsManager.deleteUser(username); } - public void updatePassword(String oldPassword, String newPassword) { - userDetailsManager.changePassword(oldPassword, newPassword); - } - public Boolean userExists(String username) { return userDetailsManager.userExists(username); } @@ -151,12 +198,12 @@ public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean Name groupDn = buildGroupDn(group); DirContextAdapter context = new DirContextAdapter(); - context.setAttributeValues("objectClass", new String[] { "top", - "groupOfUniqueNames" }); + context.setAttributeValues("objectClass", groupClasses); context.setAttributeValue("cn", group); // Add superuser because cannot create empty group - context.setAttributeValue("uniqueMember", superuserDn.toString()); + context.setAttributeValue(groupMemberAttributeName, superuserDn + .toString()); ldapTemplate.bind(groupDn, context, null); } @@ -247,4 +294,17 @@ public class ArgeoSecurityDaoLdap implements ArgeoSecurityDao, InitializingBean public void setUserNatureMappers(List userNatureMappers) { this.userNatureMappers = userNatureMappers; } + + public String getDefaultRole() { + return defaultRole; + } + + public void setGroupClasses(String[] groupClasses) { + this.groupClasses = groupClasses; + } + + public UserDetailsService getUserDetailsService() { + return ldapUserDetailsService; + } + }