API tools faq
paste
Guest User

Untitled

a guest
Jun 28th, 2018
131
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.22 KB | None | 0 0
raw download clone embed print report
  1. Server jettyServer = new Server(8080);
  2.  
  3. ServletContextHandler context = new ServletContextHandler(jettyServer, "/", ServletContextHandler.SESSIONS | ServletContextHandler.SECURITY);
  4.  
  5. context.addServlet(new ServletHolder(new DefaultServlet() {
  6. @Override
  7. protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
  8. request.getSession().invalidate(); // do logout
  9. response.getWriter().append("<html><form method='POST' action='/j_security_check'>"
  10. + "<input type='text' name='j_username'/>"
  11. + "<input type='password' name='j_password'/>"
  12. + "<input type='submit' value='Login'/></form></html>");
  13. }
  14. }), "/login");
  15.  
  16. context.addServlet(new ServletHolder(new MyServlet()),"/*");
  17.  
  18. Constraint constraint = new Constraint();
  19. constraint.setName(Constraint.__FORM_AUTH);
  20. constraint.setRoles(new String[]{"user"});
  21. constraint.setAuthenticate(true);
  22.  
  23. ConstraintMapping constraintMapping = new ConstraintMapping();
  24. constraintMapping.setConstraint(constraint);
  25. constraintMapping.setPathSpec("/*");
  26.  
  27. ConstraintSecurityHandler securityHandler;
  28.  
  29. if (ldapEnabled) { // *** something is missing ****
  30. LdapLoginModule lm = new LdapLoginModule();
  31. Map options = new HashMap<>();
  32. options.put( "hostname", "127.0.0.1" );
  33. options.put( "port", "389" );
  34. options.put( "contextFactory", "com.sun.jndi.ldap.LdapCtxFactory" );
  35. options.put( "bindDn", "CN=admin,OU=example,OU=com" );
  36. options.put( "bindPassword", "password" );
  37. options.put( "userBaseDn", "dc=example,dc=com" );
  38. lm.initialize(null,null,null,options);
  39.  
  40. securityHandler = new ConstraintSecurityHandler ();
  41. securityHandler.addConstraintMapping(constraintMapping);
  42. JAASLoginService loginService = new JAASLoginService("ldaploginmodule");
  43. loginService.setIdentityService(new DefaultIdentityService());
  44. securityHandler.setLoginService(loginService);
  45. } else { // This works
  46. securityHandler = new ConstraintSecurityHandler();
  47. securityHandler.addConstraintMapping(constraintMapping);
  48. HashLoginService loginService = new HashLoginService();
  49. loginService.putUser("username", new Password("password"), new String[]{"user"});
  50. securityHandler.setLoginService(loginService);
  51. }
  52.  
  53. java.io.IOException: ldap-loginModule.conf (No such file or directory)
  54.  
  55. LoginService loginService = new AbstractLoginService() {
  56.  
  57. private final InitialLdapContext _ldap = _getLdap(
  58. "cn=" + CONFIG.getString("ldap.manager") + "," + CONFIG.getString("ldap.baseDn"),
  59. CONFIG.getString("ldap.managerPassword"));
  60.  
  61. @Override
  62. protected void finalize() throws Throwable {
  63. _ldap.close();
  64. }
  65.  
  66. private InitialLdapContext _getLdap(String userDn, String password) {
  67. Hashtable env = new Hashtable();
  68. env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
  69. env.put(Context.SECURITY_AUTHENTICATION, "simple");
  70. env.put(Context.PROVIDER_URL, CONFIG.getString("ldap.server"));
  71. env.put(Context.SECURITY_PRINCIPAL, userDn);
  72. env.put(Context.SECURITY_CREDENTIALS, password);//dn user password
  73. try {
  74. InitialLdapContext ldap = new InitialLdapContext(env, null);
  75. return ldap;
  76. } catch (AuthenticationException e) {
  77. return null;
  78. } catch (NamingException e) {
  79. return null;
  80. }
  81. }
  82.  
  83. // Based on https://www.owasp.org/index.php/Preventing_LDAP_Injection_in_Java
  84. private String _escapeLDAPSearchFilter(String filter) {
  85. StringBuilder sb = new StringBuilder();
  86. for (int i = 0; i < filter.length(); i++) {
  87. char curChar = filter.charAt(i);
  88. switch (curChar) {
  89. case '\':
  90. sb.append("\5c");
  91. break;
  92. case '*':
  93. sb.append("\2a");
  94. break;
  95. case '(':
  96. sb.append("\28");
  97. break;
  98. case ')':
  99. sb.append("\29");
  100. break;
  101. case 'u0000':
  102. sb.append("\00");
  103. break;
  104. default:
  105. sb.append(curChar);
  106. }
  107. }
  108. return sb.toString();
  109. }
  110.  
  111. @Override
  112. protected String[] loadRoleInfo(AbstractLoginService.UserPrincipal user) {
  113. String groupBaseDn = CONFIG.getString("ldap.groupBaseDn") + "," + CONFIG.getString("ldap.baseDn");
  114.  
  115. String search = CONFIG.getString("ldap.groupFilter");
  116.  
  117. String userDn;
  118. if (CONFIG.getBoolean("ldap.usePosixGroups", true)) {
  119. userDn = user.getName();
  120. } else {
  121. userDn = "uid=" + user.getName() + "," + CONFIG.getString("ldap.userBaseDn") + "," + CONFIG.getString("ldap.baseDn"); // TODO: not sure in this, never tested
  122. }
  123. search = search + "(" + CONFIG.getString("ldap.groupMemberAttribute") + "=" + _escapeLDAPSearchFilter(userDn) + ")";
  124.  
  125. search = "(&" + search + ")";
  126.  
  127. SearchControls searchControls = new SearchControls();
  128. searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
  129. searchControls.setTimeLimit(30000);
  130.  
  131. NamingEnumeration<SearchResult> enumeration = null;
  132.  
  133. ArrayList<String> roles = new ArrayList<>();
  134. try {
  135. enumeration = _ldap.search(groupBaseDn, search, searchControls);
  136. while(enumeration.hasMore()){
  137. SearchResult result = enumeration.nextElement();
  138. final Attributes attributes = result.getAttributes();
  139. Attribute attribute = attributes.get(CONFIG.getString("ldap.groupIdAttribute"));
  140. if (attribute != null) {
  141. roles.add((String) attribute.get());
  142. }
  143. }
  144. } catch (NamingException e) {
  145.  
  146. } finally {
  147. if (enumeration != null) {
  148. try {
  149. enumeration.close();
  150. } catch (NamingException ee) {
  151.  
  152. }
  153. }
  154. }
  155.  
  156. String[] ret = new String[roles.size()];
  157. return roles.toArray(ret);
  158.  
  159. }
  160.  
  161. @Override
  162. protected AbstractLoginService.UserPrincipal loadUserInfo(String username) {
  163.  
  164. final Credential credential = new Credential() {
  165. @Override
  166. public boolean check(Object credentials) {
  167. InitialLdapContext myLdap = _getLdap(
  168. "uid=" + username + "," + CONFIG.getString("ldap.userBaseDn") + "," + CONFIG.getString("ldap.baseDn"),
  169. (String) credentials);
  170. if (myLdap == null) {
  171. return false;
  172. } else {
  173. try {
  174. myLdap.close();
  175. } catch (NamingException e) {
  176. //okay...
  177. }
  178. return true;
  179. }
  180. }
  181. };
  182.  
  183. final AbstractLoginService.UserPrincipal webUser = new UserPrincipal(username, credential);
  184.  
  185. return webUser;
  186.  
  187. }
  188. };
  189.  
  190. ldap.server=ldap://192.168.100.200
  191. ldap.manager=admin
  192. ldap.managerPassword=ldapadmin
  193. ldap.baseDn=dc=example,dc=com
  194. ldap.userBaseDn=ou=People
  195. ldap.groupBaseDn=ou=Groups
  196. ldap.groupMemberAttribute=memberUid
  197. ldap.usePosixGroups=true
  198. ldap.userFilter=(objectClass=inetOrgPerson)
  199. ldap.groupFilter=(objectClass=posixGroup)
  200. ldap.groupIdAttribute=cn
  201.  
  202. dn: ou=People,dc=example,dc=com
  203. objectClass: organizationalUnit
  204. ou: People
  205.  
  206. dn: ou=Groups,dc=example,dc=com
  207. objectClass: organizationalUnit
  208. ou: Groups
  209.  
  210. dn: uid=testuser01,ou=People,dc=example,dc=com
  211. objectClass: inetOrgPerson
  212. objectClass: posixAccount
  213. objectClass: shadowAccount
  214. uid: testuser01
  215. sn: User01
  216. givenName: Test01
  217. cn: testuser01
  218. displayName: Test User 01
  219. uidNumber: 10001
  220. gidNumber: 10001
  221. userPassword: 12345qw
  222. homeDirectory: /home/testuser01
  223.  
  224. dn: uid=testuser02,ou=People,dc=example,dc=com
  225. objectClass: inetOrgPerson
  226. objectClass: posixAccount
  227. objectClass: shadowAccount
  228. uid: testuser02
  229. sn: User02
  230. givenName: Test02
  231. cn: testuser02
  232. displayName: Test User 02
  233. uidNumber: 10002
  234. gidNumber: 10002
  235. userPassword: 12345qw
  236. homeDirectory: /home/testuser02
  237.  
  238. dn: uid=testuser03,ou=People,dc=example,dc=com
  239. objectClass: inetOrgPerson
  240. objectClass: posixAccount
  241. objectClass: shadowAccount
  242. uid: testuser03
  243. sn: User03
  244. givenName: Test03
  245. cn: testuser03
  246. displayName: Test User 03
  247. uidNumber: 10003
  248. gidNumber: 10003
  249. userPassword: 12345qw
  250. homeDirectory: /home/testuser03
  251.  
  252. dn: cn=admins,ou=Groups,dc=example,dc=com
  253. objectClass: posixGroup
  254. cn: admins
  255. gidNumber: 5000
  256. memberUid: testuser01
  257.  
  258. dn: cn=staff,ou=Groups,dc=example,dc=com
  259. objectClass: posixGroup
  260. cn: staff
  261. gidNumber: 5001
  262. memberUid: testuser01
  263. memberUid: testuser02
  264. memberUid: testuser03
  265.  
  266. dn: cn=management,ou=Groups,dc=example,dc=com
  267. objectClass: posixGroup
  268. cn: management
  269. gidNumber: 5003
  270. memberUid: testuser02
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!