View difference between Paste ID: sEknVQnF and yUV828Qb
SHOW: | | - or go back to the newest paste.
1
package ldap
2
3
import javax.naming.AuthenticationException
4
import javax.naming.Context
5
import javax.naming.InvalidNameException
6
import javax.naming.NamingException
7
import javax.naming.directory.InitialDirContext
8
import javax.persistence.NoResultException
9
10
import net.datenwerke.rs.authenticator.client.login.dto.UserPasswordAuthToken
11
import net.datenwerke.rs.authenticator.client.login.pam.UserPasswordClientPAM
12
import net.datenwerke.rs.utils.crypto.PasswordHasher;
13
import net.datenwerke.security.client.login.AuthToken
14
import net.datenwerke.security.service.authenticator.AuthenticationResult
15
import net.datenwerke.security.service.authenticator.ReportServerPAM
16
import net.datenwerke.security.service.authenticator.hooks.PAMHook
17
import net.datenwerke.security.service.usermanager.UserManagerService
18
import net.datenwerke.security.service.usermanager.entities.User
19
20
import com.google.inject.Inject
21-
import java.util.logging.Logger;
21+
22
final LdapPAM ldapPam = GLOBALS.injector.getInstance(LdapPAM.class);
23-
Logger logger = Logger.getLogger("LDAP");
23+
24-
logger.severe("@@@@ LDAP INIT @@@@");
24+
25
	public void beforeStaticPamConfig(LinkedHashSet<ReportServerPAM> pams){
26
		pams.add(ldapPam);
27
	}
28
	public void afterStaticPamConfig(LinkedHashSet<ReportServerPAM> pams){
29
		
30
	}
31
	
32
});
33
34
35
public class LdapPAM implements ReportServerPAM {
36
	
37
	private static final String CLIENT_MODULE_NAME = UserPasswordClientPAM.class.getName();
38
	private UserManagerService userManagerService;
39
	private PasswordHasher passwordHasher;
40
41
	@Inject
42
	public LdapPAM(UserManagerService userManagerService, PasswordHasher passwordHasher) {
43
		this.userManagerService = userManagerService;
44-
                 Logger logger = Logger.getLogger("LDAP");
44+
45
	}
46
	
47
	
48
	public AuthenticationResult authenticate(AuthToken[] tokens) {
49
		for(Object token : tokens){
50
			if(token instanceof UserPasswordAuthToken){
51
				UserPasswordAuthToken credentials = (UserPasswordAuthToken) token;
52
				User u = authenticate(credentials.getUsername(), credentials.getPassword());
53
				if(null != u){
54
					return new AuthenticationResult(true, u, true);
55
				}else{
56
					User usr = getUserOrNull(credentials.getUsername());
57
					boolean authoritive = (null == usr || (null != usr.getOrigin() && usr.getOrigin().toLowerCase().startsWith("ldap://")) || (null != usr.getPassword() && !usr.getPassword().isEmpty()));
58
					return new AuthenticationResult(false, usr, authoritive);
59-
					logger.severe("####### LdapPAM: authenticate success (usr=" + u.getUsername() + ")")
59+
60
			}
61
		}
62
63
		return new AuthenticationResult(false, null, false);
64-
					logger.severe("####### LdapPAM: authenticate failed (result=AuthenticationResult(false, " + u.getUsername() + ", "+authoritive+")")
64+
65
	
66
	
67
	protected User getUserOrNull(String username){
68
		try{
69-
		logger.severe("####### LdapPAM: authenticate notoken (result=AuthenticationResult(false, null, false)")
69+
70
		}catch(NoResultException ex){
71
			return null;
72
		}
73
	}
74
	
75
	
76
	public User authenticate(String username, String cleartextPassword){
77
		User user = getUserOrNull(username);
78
		if(null == user)
79
			return null;
80
		
81
		if(null != user.getPassword() && !user.getPassword().isEmpty() && passwordHasher.validatePassword(user.getPassword(), cleartextPassword)){
82
83
			return user;
84
		}else{
85
86
		}		
87
			
88
		LdapAuthenticator authenticator = new LdapAuthenticator();	
89-
			logger.severe("####### LdapPAM: authenticate with local password: success")
89+
90
91
			return user;
92-
			logger.severe("####### LdapPAM: authenticate with local password: fail")
92+
93
94
			return null;
95
		}
96
	}
97-
			logger.severe("####### LdapPAM: authenticate against directory server: success")
97+
98
	public String getClientModuleName() {
99
		return CLIENT_MODULE_NAME;
100-
			logger.severe("####### LdapPAM: authenticate against directory server: failed")
100+
101
102
}
103
104
105
public class LdapAuthenticator {
106
	
107
	public boolean authenticate(User user, String password){
108
		if(null == user.getOrigin() || null == user.getGuid())
109
			return false;
110
		
111
		Properties props = new Properties();
112
113
		props.setProperty(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
114-
                 Logger logger = Logger.getLogger("LDAP");
114+
115
		props.setProperty(Context.URL_PKG_PREFIXES, "com.sun.jndi.url");
116
		props.setProperty(Context.SECURITY_AUTHENTICATION, "simple");
117
118
		props.setProperty(Context.SECURITY_PRINCIPAL, getPrincipal(user));
119
		props.setProperty(Context.SECURITY_CREDENTIALS, password);
120
		
121
		try {
122
			InitialDirContext ctx = new InitialDirContext(props);
123
			ctx.getAttributes(getPrincipal(user));
124
			return true;
125
		} catch (AuthenticationException e) {
126
			return false;
127
		} catch (InvalidNameException e) {
128
			throw new RuntimeException(e);
129
		} catch (NamingException e) {
130
			if(e.getMessage().contains("LdapErr: DSID-0C0906E8")){
131
				return false;
132
			}
133
			
134-
                                                   logger.severe(e);
134+
135
136
	}
137
138
	private String getProvider(User user) {
139
		String origin = user.getOrigin();
140
		int i = origin.lastIndexOf("/");
141
		
142
		return origin.substring(0, i);
143
	}
144
145
	private String getPrincipal(User user) {
146
		String origin = user.getOrigin();
147
			
148
		int i = user.getOrigin().lastIndexOf("/");
149
		return origin.substring(i + 1);
150
	}
151
	
152
}