public class LDAPSecurityRealm
extends hudson.security.AbstractPasswordBasedSecurityRealm
SecurityRealm
implementation that uses LDAP for authentication.
Two object classes seem to be relevant. These are in RFC 2256 and core.schema. These use DN for membership, so it can create a group of anything. I don't know what the difference between these two are.
attributetype ( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a group' SUP distinguishedName ) attributetype ( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique member of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 ) objectclass ( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) ) objectclass ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( uniqueMember $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )
This one is from nis.schema, and appears to model POSIX group/user thing more closely.
objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) ) attributetype ( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) objectclass ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) attributetype ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'An integer uniquely identifying a user in an administrative domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributetype ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'An integer uniquely identifying a group in an administrative domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
Active Directory specific schemas (from here).
objectclass ( 1.2.840.113556.1.5.8 NAME 'group' SUP top STRUCTURAL MUST (groupType ) MAY (member $ nTGroupMembers $ operatorCount $ adminCount $ groupAttributes $ groupMembershipSAM $ controlAccessRights $ desktopProfile $ nonSecurityMember $ managedBy $ primaryGroupToken $ mail ) ) objectclass ( 1.2.840.113556.1.5.9 NAME 'user' SUP organizationalPerson STRUCTURAL MAY (userCertificate $ networkAddress $ userAccountControl $ badPwdCount $ codePage $ homeDirectory $ homeDrive $ badPasswordTime $ lastLogoff $ lastLogon $ dBCSPwd $ localeID $ scriptPath $ logonHours $ logonWorkstation $ maxStorage $ userWorkstations $ unicodePwd $ otherLoginWorkstations $ ntPwdHistory $ pwdLastSet $ preferredOU $ primaryGroupID $ userParameters $ profilePath $ operatorCount $ adminCount $ accountExpires $ lmPwdHistory $ groupMembershipSAM $ logonCount $ controlAccessRights $ defaultClassStore $ groupsToIgnore $ groupPriority $ desktopProfile $ dynamicLDAPServer $ userPrincipalName $ lockoutTime $ userSharedFolder $ userSharedFolderOther $ servicePrincipalName $ aCSPolicyName $ terminalServer $ mSMQSignCertificates $ mSMQDigests $ mSMQDigestsMig $ mSMQSignCertificatesMig $ msNPAllowDialin $ msNPCallingStationID $ msNPSavedCallingStationID $ msRADIUSCallbackNumber $ msRADIUSFramedIPAddress $ msRADIUSFramedRoute $ msRADIUSServiceType $ msRASSavedCallbackNumber $ msRASSavedFramedIPAddress $ msRASSavedFramedRoute $ mS-DS-CreatorSID ) )
Modifier and Type | Class and Description |
---|---|
static class |
LDAPSecurityRealm.AuthoritiesPopulatorImpl
LdapAuthoritiesPopulator that adds the automatic 'authenticated' role. |
static class |
LDAPSecurityRealm.CacheConfiguration |
static class |
LDAPSecurityRealm.DescriptorImpl |
static class |
LDAPSecurityRealm.EnvironmentProperty |
static class |
LDAPSecurityRealm.LDAPUserDetailsService |
static class |
LDAPSecurityRealm.MailAdressResolverImpl
If the security realm is LDAP, try to pick up e-mail address from LDAP.
|
Modifier and Type | Field and Description |
---|---|
boolean |
disableMailAddressResolver |
static String |
GROUP_SEARCH
LDAP filter to look for groups by their names.
|
String |
groupMembershipFilter
Deprecated.
|
LDAPGroupMembershipStrategy |
groupMembershipStrategy |
String |
groupSearchBase
This defines the organizational unit that contains groups.
|
String |
groupSearchFilter
Query to locate an entry that identifies the group, given the group name string.
|
boolean |
inhibitInferRootDN
Allow the rootDN to be inferred? Default is false.
|
String |
managerDN
If non-null, we use this and
managerPasswordSecret
when binding to LDAP. |
String |
rootDN
The root DN to connect to.
|
String |
server
LDAP server name(s) separated by spaces, optionally with TCP port number, like "ldap.acme.org"
or "ldap.acme.org:389" and/or with protcol, like "ldap://ldap.acme.org".
|
String |
userSearch
Query to locate an entry that identifies the user, given the user name string.
|
String |
userSearchBase
Specifies the relative DN from
the root DN . |
Constructor and Description |
---|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String groupSearchFilter,
LDAPGroupMembershipStrategy groupMembershipStrategy,
String managerDN,
hudson.util.Secret managerPasswordSecret,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache,
LDAPSecurityRealm.EnvironmentProperty[] environmentProperties,
String displayNameAttributeName,
String mailAddressAttributeName)
Deprecated.
retained for backwards binary compatibility.
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String groupSearchFilter,
LDAPGroupMembershipStrategy groupMembershipStrategy,
String managerDN,
hudson.util.Secret managerPasswordSecret,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache,
LDAPSecurityRealm.EnvironmentProperty[] environmentProperties,
String displayNameAttributeName,
String mailAddressAttributeName,
jenkins.model.IdStrategy userIdStrategy,
jenkins.model.IdStrategy groupIdStrategy) |
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String groupSearchFilter,
LDAPGroupMembershipStrategy groupMembershipStrategy,
String managerDN,
hudson.util.Secret managerPasswordSecret,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache,
LDAPSecurityRealm.EnvironmentProperty[] environmentProperties,
String displayNameAttributeName,
String mailAddressAttributeName,
String userIdStrategyClass,
String groupIdStrategyClass)
Deprecated.
will be removed once we depend on Jenkins 1.577+
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String managerDN,
String managerPassword,
boolean inhibitInferRootDN)
Deprecated.
retained for backwards binary compatibility.
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String managerDN,
String managerPassword,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver)
Deprecated.
retained for backwards binary compatibility.
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String managerDN,
String managerPassword,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache)
Deprecated.
retained for backwards binary compatibility.
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String groupSearchFilter,
String groupMembershipFilter,
String managerDN,
hudson.util.Secret managerPasswordSecret,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache,
LDAPSecurityRealm.EnvironmentProperty[] environmentProperties,
String displayNameAttributeName,
String mailAddressAttributeName)
Deprecated.
retained for backwards binary compatibility.
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String groupSearchFilter,
String groupMembershipFilter,
String managerDN,
String managerPassword,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache)
Deprecated.
retained for backwards binary compatibility.
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String groupSearchFilter,
String groupMembershipFilter,
String managerDN,
String managerPassword,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache,
LDAPSecurityRealm.EnvironmentProperty[] environmentProperties)
Deprecated.
retained for backwards binary compatibility.
|
LDAPSecurityRealm(String server,
String rootDN,
String userSearchBase,
String userSearch,
String groupSearchBase,
String groupSearchFilter,
String groupMembershipFilter,
String managerDN,
String managerPassword,
boolean inhibitInferRootDN,
boolean disableMailAddressResolver,
LDAPSecurityRealm.CacheConfiguration cache,
LDAPSecurityRealm.EnvironmentProperty[] environmentProperties,
String displayNameAttributeName,
String mailAddressAttributeName)
Deprecated.
retained for backwards binary compatibility.
|
Modifier and Type | Method and Description |
---|---|
protected org.acegisecurity.userdetails.UserDetails |
authenticate(String username,
String password) |
hudson.security.SecurityRealm.SecurityComponents |
createSecurityComponents() |
LDAPSecurityRealm.CacheConfiguration |
getCache() |
Integer |
getCacheSize() |
Integer |
getCacheTTL() |
String |
getDisplayNameAttributeName() |
LDAPSecurityRealm.EnvironmentProperty[] |
getEnvironmentProperties() |
Map<String,String> |
getExtraEnvVars() |
jenkins.model.IdStrategy |
getGroupIdStrategy() |
String |
getGroupIdStrategyClass()
Deprecated.
|
String |
getGroupMembershipFilter()
Deprecated.
|
LDAPGroupMembershipStrategy |
getGroupMembershipStrategy() |
String |
getGroupSearchFilter() |
String |
getLDAPURL() |
String |
getMailAddressAttributeName() |
String |
getManagerPassword() |
hudson.util.Secret |
getManagerPasswordSecret() |
String |
getServerUrl() |
jenkins.model.IdStrategy |
getUserIdStrategy() |
String |
getUserIdStrategyClass()
Deprecated.
|
hudson.security.GroupDetails |
loadGroupByGroupname(String groupname) |
org.acegisecurity.userdetails.UserDetails |
loadUserByUsername(String username) |
org.acegisecurity.Authentication |
updateUserDetails(org.acegisecurity.Authentication authentication) |
org.acegisecurity.userdetails.ldap.LdapUserDetails |
updateUserDetails(org.acegisecurity.userdetails.ldap.LdapUserDetails d) |
org.acegisecurity.userdetails.UserDetails |
updateUserDetails(org.acegisecurity.userdetails.UserDetails userDetails) |
createCliAuthenticator
all, allowsSignup, canLogOut, commenceSignup, createFilter, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getDescriptor, getLoginUrl, getPostLogOutUrl, getSecurityComponents, loadGroupByGroupname, setCaptchaSupport, validateCaptcha
public final String server
public final String rootDN
public final boolean inhibitInferRootDN
public final String userSearchBase
the root DN
.
This is used to narrow down the search space when doing user search.
Something like "ou=people" but can be empty.public final String userSearch
FilterBasedLdapUserSearch
public final String groupSearchBase
FilterBasedLdapUserSearch
public final String groupSearchFilter
GROUP_SEARCH
@Deprecated public transient String groupMembershipFilter
groupMembershipStrategy
{0}
is the user's full DN while {1} is the username. If non-null it will override the default specified in
LDAPBindSecurityRealm.groovy
public LDAPGroupMembershipStrategy groupMembershipStrategy
public final String managerDN
managerPasswordSecret
when binding to LDAP.
This is necessary when LDAP doesn't support anonymous access.public final boolean disableMailAddressResolver
public static String GROUP_SEARCH
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String managerDN, String managerPassword, boolean inhibitInferRootDN)
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String managerDN, String managerPassword, boolean inhibitInferRootDN, boolean disableMailAddressResolver)
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String managerDN, String managerPassword, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache)
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String managerDN, String managerPassword, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache)
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String managerDN, String managerPassword, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache, LDAPSecurityRealm.EnvironmentProperty[] environmentProperties)
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String managerDN, String managerPassword, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache, LDAPSecurityRealm.EnvironmentProperty[] environmentProperties, String displayNameAttributeName, String mailAddressAttributeName)
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String managerDN, hudson.util.Secret managerPasswordSecret, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache, LDAPSecurityRealm.EnvironmentProperty[] environmentProperties, String displayNameAttributeName, String mailAddressAttributeName)
@Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, LDAPGroupMembershipStrategy groupMembershipStrategy, String managerDN, hudson.util.Secret managerPasswordSecret, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache, LDAPSecurityRealm.EnvironmentProperty[] environmentProperties, String displayNameAttributeName, String mailAddressAttributeName)
@DataBoundConstructor @Deprecated public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, LDAPGroupMembershipStrategy groupMembershipStrategy, String managerDN, hudson.util.Secret managerPasswordSecret, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache, LDAPSecurityRealm.EnvironmentProperty[] environmentProperties, String displayNameAttributeName, String mailAddressAttributeName, String userIdStrategyClass, String groupIdStrategyClass)
public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, LDAPGroupMembershipStrategy groupMembershipStrategy, String managerDN, hudson.util.Secret managerPasswordSecret, boolean inhibitInferRootDN, boolean disableMailAddressResolver, LDAPSecurityRealm.CacheConfiguration cache, LDAPSecurityRealm.EnvironmentProperty[] environmentProperties, String displayNameAttributeName, String mailAddressAttributeName, jenkins.model.IdStrategy userIdStrategy, jenkins.model.IdStrategy groupIdStrategy)
@Deprecated public String getUserIdStrategyClass()
@Deprecated public String getGroupIdStrategyClass()
public String getServerUrl()
public jenkins.model.IdStrategy getUserIdStrategy()
getUserIdStrategy
in class hudson.security.SecurityRealm
public jenkins.model.IdStrategy getGroupIdStrategy()
getGroupIdStrategy
in class hudson.security.SecurityRealm
public LDAPSecurityRealm.CacheConfiguration getCache()
public Integer getCacheSize()
public Integer getCacheTTL()
@Deprecated public String getGroupMembershipFilter()
public LDAPGroupMembershipStrategy getGroupMembershipStrategy()
public String getGroupSearchFilter()
public LDAPSecurityRealm.EnvironmentProperty[] getEnvironmentProperties()
public String getManagerPassword()
public hudson.util.Secret getManagerPasswordSecret()
public String getLDAPURL()
public String getDisplayNameAttributeName()
public String getMailAddressAttributeName()
public hudson.security.SecurityRealm.SecurityComponents createSecurityComponents()
createSecurityComponents
in class hudson.security.AbstractPasswordBasedSecurityRealm
protected org.acegisecurity.userdetails.UserDetails authenticate(String username, String password) throws org.acegisecurity.AuthenticationException
authenticate
in class hudson.security.AbstractPasswordBasedSecurityRealm
org.acegisecurity.AuthenticationException
public org.acegisecurity.userdetails.UserDetails loadUserByUsername(String username) throws org.acegisecurity.userdetails.UsernameNotFoundException, org.springframework.dao.DataAccessException
loadUserByUsername
in interface org.acegisecurity.userdetails.UserDetailsService
loadUserByUsername
in class hudson.security.AbstractPasswordBasedSecurityRealm
org.acegisecurity.userdetails.UsernameNotFoundException
org.springframework.dao.DataAccessException
public org.acegisecurity.Authentication updateUserDetails(org.acegisecurity.Authentication authentication)
public org.acegisecurity.userdetails.UserDetails updateUserDetails(org.acegisecurity.userdetails.UserDetails userDetails)
public org.acegisecurity.userdetails.ldap.LdapUserDetails updateUserDetails(org.acegisecurity.userdetails.ldap.LdapUserDetails d)
public hudson.security.GroupDetails loadGroupByGroupname(String groupname) throws org.acegisecurity.userdetails.UsernameNotFoundException, org.springframework.dao.DataAccessException
loadGroupByGroupname
in class hudson.security.AbstractPasswordBasedSecurityRealm
org.acegisecurity.userdetails.UsernameNotFoundException
org.springframework.dao.DataAccessException
Copyright © 2016. All rights reserved.