public class LdapAuthBean extends java.lang.Object implements AuthFunctionBean
This class with authenticate login attempts against LDAP entries with RDN of the HyperSQL account name (the precise attribute name defaults to 'uid', but you may change that).
This class purposefully does not support LDAPS, because LDAPS is deprecated in favor of StartTLS, which we do support. If you need to support LDAPS and are using SE 1.6, use our JaasAuthBean with Sun's LdapLoginModule.
This class does not support SASL/External authentication, because the work involved with securely obtaining user-specific certs would be more complex than everything else here combined. Another AuthFunctionBean would have to be written if SASL/External is needed.
To use instances of this class, you must use at least the methods setLdapHost, setParentDn, initialize, plus rolesSchemaAttribute and/or accessAttribute.
For a user to be given HyperSQL catalog access, that user must either have a value for accessAttribute if that property is set (optionally requiring a match with accessValuePattern); or, if the accessAttribute is not set then must have some (any) value for rolesSchemaAttribute (optionally requiring a match with roleSchemaValuePattern). Consequently, if you have set both accessAttribute and rolesSchemaAttribute, the latter attribute will only be consulted if the check of the former attribute succeeds.
If you want roles assigned according to the local HyperSQL database instead of according to LDAP, then set accessAttribute but not rolesSchemaAttribute.
If what is wanted is to grant access but with no roles (overriding local roles if there are any), then set both accessAttribute and rolesSchemaAttribute, but do not set any rolesSchemaAttribute attribute values for these no-role users. (I hesitate to mention it, but you could accomplish the same thing with only a rolesSchemaAttribute attribute, by setting only a dummy role/schema value for non-role users, because HyperSQL will ignore unknown roles or schemas but still give access since a list was still supplied).
AuthFunctionBean
,
setLdapHost(String)
,
setParentDn(String)
,
init()
Constructor and Description |
---|
LdapAuthBean() |
Modifier and Type | Method and Description |
---|---|
java.lang.String[] |
authenticate(java.lang.String userName,
java.lang.String password)
Return a list of authorized roles or null to indicate that the
implementation does not intend to produce a specific role list but only
to indicate whether to allow access or not.
|
void |
init() |
void |
setAccessAttribute(java.lang.String attribute)
Set the attribute name of the RDN + parentDn entries which will be
consulted to decide whether the user can access the HyperSQL database.
|
void |
setAccessValuePattern(java.util.regex.Pattern accessValuePattern)
Assign a pattern to detect honored accessAttribute values.
|
void |
setAccessValuePatternString(java.lang.String patternString)
String wrapper for method setAccessValuePattern(Pattern)
Use the (x?) Pattern constructs to set options.
|
void |
setInitialContextFactory(java.lang.String initialContextFactory)
Most users should not call this, and will get the default of
"com.sun.jndi.ldap.LdapCtxFactory".
|
void |
setLdapHost(java.lang.String ldapHost)
Do not specify URL scheme ("ldap:") because that is implied.
|
void |
setLdapPort(int ldapPort) |
void |
setParentDn(java.lang.String parentDn)
Set DN which is parent of the user DNs.
|
void |
setPrincipalTemplate(java.lang.String principalTemplate)
A template String containing place-holder token '${username}'.
|
void |
setRdnAttribute(java.lang.String rdnAttribute)
rdnAttribute must hold the user name exactly as the HyperSQL login will
be made with.
|
void |
setRoleSchemaValuePattern(java.util.regex.Pattern roleSchemaValuePattern)
Assign a pattern to both detect honored values, and to map from a single
value of "rolesSchemaAttribute"s to a HyperSQL role or schema string.
|
void |
setRoleSchemaValuePatternString(java.lang.String patternString)
String wrapper for method setRoleSchemaValuePattern(Pattern)
Use the (x?) Pattern constructs to set options.
|
void |
setRolesSchemaAttribute(java.lang.String attribute)
Set the attribute name of the RDN + parentDn entries in which is stored
the list of roles and optional schema for the authenticating user.
|
void |
setSaslRealm(java.lang.String saslRealm)
Some LDAP servers using a SASL mechanism require a realm to be specified,
and some mechanisms allow a realm to be specified if you wish to use that
feature.
|
void |
setSecurityMechanism(java.lang.String mechanism)
Defaults to "SIMPLE".
|
void |
setStartTls(boolean isTls)
If this is set, then the entire (brief) transaction with the LDAP server
will be encrypted.
|
public void setStartTls(boolean isTls)
public void setLdapPort(int ldapPort)
public void init()
java.lang.IllegalStateException
- if any required setting has not been set.public void setAccessValuePattern(java.util.regex.Pattern accessValuePattern)
You may only use this property if you have set property accessAttribute. If you have set accessAttribute but not this property, then access will be decided based solely upon existence of this attribute.
Capture groups in the pattern will be ignored and serve no purpose.
N.b. this Pattern will be used for the matches() operation, therefore it must match the entire candidate value strings (this is different than the find operation which does not need to satisfy the entire candidate value).
Example1 :
This will match true values per OpenLDAP's boolean OID.
TRUE
Matcher.matches()
public void setAccessValuePatternString(java.lang.String patternString)
java.util.regex.PatternSyntaxException
setAccessValuePattern(Pattern)
public void setRoleSchemaValuePattern(java.util.regex.Pattern roleSchemaValuePattern)
You may only use this property if you have set property rolesSchemaAttribute. If rolesSchemaAttribute is set but this property is not set, then the value will directly determine the user's roles and schema.
Unlike the rolesSchemaAttribute, the property at-hand uses the singular for "role", because whereas rolesSchemaAttribute is the attribute for listing multiple roles, roleSchemaValuePattern is used to evaluate single role values.
These are two distinct and important purposes for the specified Pattern.
Together, these two features work great to extract just the needed role and schema names from 'memberof' DNs, and will have no problem if you also use 'memberof' for unrelated purposes.
N.b. this Pattern will be used for the matches() operation, therefore it must match the entire candidate value strings (this is different than the find operation which does not need to satisfy the entire candidate value).
Example1 :
will extract the CN value from matching attribute values.
cn=([^,]+),ou=dbRole,dc=admc,dc=com
Example1 :
will return the entire
cn=[^,]+,ou=dbRole,dc=admc,dc=com
cn...com
string for matching
attribute values.
Matcher.matches()
public void setRoleSchemaValuePatternString(java.lang.String patternString)
java.util.regex.PatternSyntaxException
setRoleSchemaValuePattern(Pattern)
public void setSecurityMechanism(java.lang.String mechanism)
mechanism
- Either 'SIMPLE' (the default) for LDAP Simple, or
one of the LDAP SASL mechanisms, such as 'DIGEST-MD5'.public void setLdapHost(java.lang.String ldapHost)
If using StartTLS, then this host name must match the cn of the LDAP server's certificate.
If you need to support LDAPS and are using SE 1.6, use our JaasAuthBean with Sun's LdapLoginModule instead of this class.
JaasAuthBean
public void setPrincipalTemplate(java.lang.String principalTemplate)
If you supply a principalTemplate that does not contain '${username}', then authentication will be user-independent.
It is common to authenticate to LDAP servers with the DN of the user's
LDAP entry. In this situation, set principalTemplate to
<RDN_ATTR=>${username},<PARENT_DN>
.
For example if you use parentDn of
"ou=people,dc=admc,dc=com"
and rdnAttribute of
uid
, then you would set
"uid=${username},ou=people,dc=admc,dc=com"
By default the user name will be passed exactly as it is, so don't use this setter if that is what you want. (This works great for OpenLDAP with DIGEST-MD5 SASL, for example).
public void setInitialContextFactory(java.lang.String initialContextFactory)
public void setSaslRealm(java.lang.String saslRealm)
Don't use this setter if you are not setting a SASL mechanism.
public void setParentDn(java.lang.String parentDn)
public void setRdnAttribute(java.lang.String rdnAttribute)
This is the RDN relative to the Parent DN specified with setParentDN. Defaults to 'uid'.
setParentDn(String)
public void setRolesSchemaAttribute(java.lang.String attribute)
There is no default. You must set this attribute if you want LDAP instead of the local HyperSQL database to determine the user's roles! You must set the rolesSchemaAttribute property and/or the accessAttribute property. Consequently, if you do no tset this property, then you must set the accessAttribute property, and this LdapAuthBean will only determine access not roles.
To use the nice reverse group membership feature of LDAP, set this value to "memberof".
If you have set both rolesSchemaAttribute and this value, then the attribute set here will only be consulted if the accessAttribute check succeeds.
public void setAccessAttribute(java.lang.String attribute)
There is no default. If you set this attribute, then the attribute will determine whether the user can access the HyperSQL database, regardless of whether the rolesSchemaAttribute attribute is set.
If you set just this property, then the local HyperSQL database will decide all roles for the user. If you set this property and property rolesSchemaAttribute then this attribute will determine access, and if this attribute grants access then the rolesSchemaAttribute value will determine the user's roles.
public java.lang.String[] authenticate(java.lang.String userName, java.lang.String password) throws org.hsqldb.auth.DenyException
AuthFunctionBean
authenticate
in interface AuthFunctionBean
org.hsqldb.auth.DenyException
AuthFunctionBean.authenticate(String, String)
Copyright �� 2001 - 2013 HSQL Development Group.