To remove unnecesary clutter, I deleted a few of my last posts in this thread if you're wondering where they went. I want to use Acegi with my Ldap server, but the LdapDao in the CVS sandbox and the JNDIRealm DAO above won't work with my application. It's for my school and I have zero access to the ldap server to be able to add roles to it and the users that belong to those roles. It's handled by an outside service, updated weekly, and I wouldn't even know where to begin on how to convince them to add it when I'm just a student worker.
So instead I added a property to the applicationContext xml where I specify the cn's I want to have administration access to my app and everyone else is just supposed to have a regular user status. Given my limited java and acegi experience this may be a total hack, but I've posted the class with the hope I can get some feedback and suggestions on it. It's not done yet, but I am able to login and the authorization seems to be working properly on the website. I'm not actually doing anything useful with it yet, but I'm happy to have made some progress.
There are two things I'd like to figure out right away. One is being able to grab the entry data from the user that logged in and store it in the session so I can access things like their email, first/last name, etc without hitting ldap constantly. The second thing is to be able to put the filter string in the applicationContext.xml file instead of hard-coding it in the class. Any suggestions would be great. For the rest of the weekend I'm gonna see if I can figure out how to do a ldap version of the user cache.
LdapDaoImpl.java
/*
* email me if you have a better way of doing this
* pjhyett@gmail.com
*/
package org.appfuse.dao;
import java.util.ArrayList;
import java.util.Hashtable;
import java.util.List;
import javax.naming.AuthenticationException;
import javax.naming.CommunicationException;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import net.sf.acegisecurity.BadCredentialsException;
import net.sf.acegisecurity.GrantedAuthority;
import net.sf.acegisecurity.GrantedAuthorityImpl;
import net.sf.acegisecurity.UserDetails;
import net.sf.acegisecurity.providers.dao.PasswordAuthent icationDao;
import net.sf.acegisecurity.providers.dao.User;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.dao.DataAccessException;
import org.springframework.dao.DataAccessResourceFailureE xception;
public class LdapDaoImpl implements PasswordAuthenticationDao {
private final Log logger = LogFactory.getLog(LdapDaoImpl.class);
public static final String BAD_CREDENTIALS_EXCEPTION_MESSAGE = "Invalid username, password or context";
//~ Instance fields ================================================== ======
private String filter;
private String host;
private String rootContext;
private String[] supervisors;
private String[] attributes;
private int port = 389;
//~ Methods ================================================== ==============
/**
* Set cn's of users meant to be supervisors
*
* @param supervisors The supervisors to set.
*/
public void setSupervisors(String[] supervisors) {
this.supervisors = supervisors;
}
/**
* Set attributes for ldap search
*
* @param attributes The attributes to set.
*/
public void setAttributes(String[] attributes) {
this.attributes = attributes;
}
/**
* Set filter for ldap search
*
* @param filter The filter to set.
*/
public void setFilter(String filter) {
this.filter = filter;
}
/**
* Set hostname or IP address of the host running LDAP server.
*
* @param hostname DOCUMENT ME!
*/
public void setHost(String hostname) {
this.host = hostname;
}
/**
* Set the port on which is running the LDAP server.
*
* @param port DOCUMENT ME!
*/
public void setPort(int port) {
this.port = port;
}
/**
* Set the root context to which you attempt to log in.
*
* @param rootContext DOCUMENT ME!
*/
public void setRootContext(String rootContext) {
this.rootContext = rootContext;
}
public UserDetails loadUserByUsernameAndPassword(String username, String password)
throws DataAccessException, BadCredentialsException {
if ((username == null) || (username.length() == 0)) {
throw new BadCredentialsException("Empty username");
}
if ((password == null) || (password.length() == 0)) {
throw new BadCredentialsException("Empty password");
}
Hashtable env = new Hashtable(11);
env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
StringBuffer providerUrl = new StringBuffer();
providerUrl.append("ldap://");
providerUrl.append(this.host);
providerUrl.append(":");
providerUrl.append(this.port);
providerUrl.append("/");
providerUrl.append(this.rootContext);
String myDN = "cn=" + username + ", " + this.rootContext;
env.put(Context.PROVIDER_URL, providerUrl.toString());
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, myDN);
env.put(Context.SECURITY_CREDENTIALS, password);
try {
DirContext ctx = new InitialDirContext(env);
this.filter = "(&(objectclass=person)(cn="+username+"))";
SearchControls ctls = new SearchControls();
ctls.setReturningAttributes(this.attributes);
ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
NamingEnumeration answer = ctx.search("", this.filter, ctls);
ctx.close();
if(!answer.hasMore()){
//username not found
throw new BadCredentialsException(BAD_CREDENTIALS_EXCEPTION_ MESSAGE);
}else{
//username found
List roles = new ArrayList();
roles.add(new GrantedAuthorityImpl("USER"));
for(int i=0;i<this.supervisors.length;i++){
if(username.equals(this.supervisors[i])){
roles.add(new GrantedAuthorityImpl("SUPERVISOR"));
break;
}
}
/*
* in here would be where I grab the entry details
* and store them in a subclass of User
*/
return new User(username, password, true, getGrantedAuthorities(roles));
}
} catch (AuthenticationException ex) {
throw new BadCredentialsException(BAD_CREDENTIALS_EXCEPTION_ MESSAGE, ex);
} catch (CommunicationException ex) {
throw new DataAccessResourceFailureException(ex.getRootCause ().getMessage(), ex);
} catch (NamingException ex) {
throw new DataAccessResourceFailureException(ex.getMessage() , ex);
}
}
protected GrantedAuthority[] getGrantedAuthorities(List roles) {
GrantedAuthority[] grantedAuthorities = new GrantedAuthority[roles.size()];
for (int i = 0; i < roles.size(); i++) {
grantedAuthorities[i] = getGrantedAuthority(roles.get(i));
}
return grantedAuthorities;
}
protected GrantedAuthority getGrantedAuthority(Object role) {
GrantedAuthority ga = new GrantedAuthorityImpl("ROLE_" + String.valueOf(role).toUpperCase());
return ga;
}
}
applicationContext.xml
<bean id="authenticationDao" class="org.appfuse.dao.LdapDaoImpl">
<property name="port"><value>389</value></property>
<property name="host"><value>ldap.noctrl.edu</value></property>
<property name="rootContext"><value>ou=Napvil,o=NCC</value></property>
<property name="supervisors"><value>pjhyett,mpohl</value></property>
<property name="attributes"><value>mail,sn,GivenName,employeeID</value></property>
</bean>