Make multi-referentials support more robust.

diff --git a/org.argeo.util/src/org/argeo/osgi/useradmin/DirectoryUserAdmin.java b/org.argeo.util/src/org/argeo/osgi/useradmin/DirectoryUserAdmin.java
index e6e3f983b1a8a9a16e4db38d9a618efb2789737e..003aad11d8e1e6ea6e3ab9212b3c38db061755e9 100644 (file)
--- a/org.argeo.util/src/org/argeo/osgi/useradmin/DirectoryUserAdmin.java
+++ b/org.argeo.util/src/org/argeo/osgi/useradmin/DirectoryUserAdmin.java
@@ -291,8 +291,10 @@ public class DirectoryUserAdmin extends AbstractLdapDirectory implements UserAdm
 
                        Subject currentSubject = CurrentSubject.current();
                        if (currentSubject != null //
+                                       && getRealm().isPresent() //
                                        && !currentSubject.getPrivateCredentials(Authorization.class).isEmpty() //
-                                       && !currentSubject.getPrivateCredentials(KerberosTicket.class).isEmpty()) {
+                                       && !currentSubject.getPrivateCredentials(KerberosTicket.class).isEmpty()) //
+                       {
                                // TODO not only Kerberos but also bind scope with kept password ?
                                Authorization auth = currentSubject.getPrivateCredentials(Authorization.class).iterator().next();
                                // bind with authenticating user

diff --git a/org.argeo.util/src/org/argeo/util/directory/ldap/LdapDao.java b/org.argeo.util/src/org/argeo/util/directory/ldap/LdapDao.java
index e15c005bef38771bedd3a84d7692d8c4e336113c..fac7dd1acf582bb47d7b080bdf70fb8f9cf09b8c 100644 (file)
--- a/org.argeo.util/src/org/argeo/util/directory/ldap/LdapDao.java
+++ b/org.argeo.util/src/org/argeo/util/directory/ldap/LdapDao.java
@@ -13,12 +13,14 @@ import javax.naming.NamingEnumeration;
 import javax.naming.NamingException;
 import javax.naming.directory.Attribute;
 import javax.naming.directory.Attributes;
+import javax.naming.directory.BasicAttributes;
 import javax.naming.directory.SearchControls;
 import javax.naming.directory.SearchResult;
 import javax.naming.ldap.LdapName;
 import javax.naming.ldap.Rdn;
 
 import org.argeo.util.directory.HierarchyUnit;
+import org.argeo.util.naming.LdapAttrs;
 import org.argeo.util.naming.LdapObjs;
 
 /** A user admin based on a LDAP server. */
@@ -78,34 +80,43 @@ public class LdapDao extends AbstractLdapDirectoryDao {
 
        @Override
        public LdapEntry doGetEntry(LdapName name) throws NameNotFoundException {
-               if (!entryExists(name))
-                       throw new NameNotFoundException(name + " was not found in " + getDirectory().getBaseDn());
-//             try {
-//                     Attributes attrs = ldapConnection.getAttributes(name);
-//                     if (attrs.size() == 0)
-//                             return null;
-
-//                     int roleType = roleType(name);
+//             if (!entryExists(name))
+//                     throw new NameNotFoundException(name + " was not found in " + getDirectory().getBaseDn());
+               try {
+                       Attributes attrs = ldapConnection.getAttributes(name);
+
                        LdapEntry res;
                        Rdn technicalRdn = LdapNameUtils.getParentRdn(name);
-                       if (getDirectory().getGroupBaseRdn().equals(technicalRdn))
-                               res = newGroup(name, null);
-                       else if (getDirectory().getSystemRoleBaseRdn().equals(technicalRdn))
-                               res = newGroup(name, null);
-                       else if (getDirectory().getUserBaseRdn().equals(technicalRdn))
-                               res = newUser(name, null);
-                       else
-                               res = new DefaultLdapEntry(getDirectory(), name, null);
-//                     if (isGroup(name))
-//                             res = newGroup(name, attrs);
-//                     else
-//                             res = newUser(name, attrs);
-//                     else
-//                             throw new IllegalArgumentException("Unsupported LDAP type for " + name);
+                       if (getDirectory().getGroupBaseRdn().equals(technicalRdn)) {
+                               if (attrs.size() == 0) {// exists but not accessible
+                                       attrs = new BasicAttributes();
+                                       attrs.put(LdapAttrs.objectClass.name(), LdapObjs.top.name());
+                                       attrs.put(LdapAttrs.objectClass.name(), getDirectory().getGroupObjectClass());
+                               }
+                               res = newGroup(name, attrs);
+                       } else if (getDirectory().getSystemRoleBaseRdn().equals(technicalRdn)) {
+                               if (attrs.size() == 0) {// exists but not accessible
+                                       attrs = new BasicAttributes();
+                                       attrs.put(LdapAttrs.objectClass.name(), LdapObjs.top.name());
+                                       attrs.put(LdapAttrs.objectClass.name(), getDirectory().getGroupObjectClass());
+                               }
+                               res = newGroup(name, attrs);
+                       } else if (getDirectory().getUserBaseRdn().equals(technicalRdn)) {
+                               if (attrs.size() == 0) {// exists but not accessible
+                                       attrs = new BasicAttributes();
+                                       attrs.put(LdapAttrs.objectClass.name(), LdapObjs.top.name());
+                                       attrs.put(LdapAttrs.objectClass.name(), getDirectory().getUserObjectClass());
+                               }
+                               res = newUser(name, attrs);
+                       } else {
+                               res = new DefaultLdapEntry(getDirectory(), name, attrs);
+                       }
                        return res;
-//             } catch (NameNotFoundException e) {
-//                     throw e;
-//             }
+               } catch (NameNotFoundException e) {
+                       throw e;
+               } catch (NamingException e) {
+                       throw new IllegalStateException("Cannot retrieve entry " + name, e);
+               }
        }
 
 //     protected boolean isGroup(LdapName dn) {