[java-identity-provider] branch master updated: IDP-1491 Detect and use JNDI LDAP properties.
Daniel Fisher
dfisher at vt.edu
Mon Sep 9 20:04:39 EDT 2019
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=6004c05cf6d873de12a6cbe9f3dc08c7938ddc99
The following commit(s) were added to refs/heads/master by this push:
new 6004c05 IDP-1491 Detect and use JNDI LDAP properties.
6004c05 is described below
commit 6004c05cf6d873de12a6cbe9f3dc08c7938ddc99
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Mon Sep 9 20:01:36 2019 -0400
IDP-1491 Detect and use JNDI LDAP properties.
If JNDI properties for binary attributes or derefAliases are detected, set those values on the search request.
Update the resolver schema to include BinaryAttributes element and derefAlises attribute.
Merge and cleanup from the maint-3.4 branch.
---
.../dc/ldap/impl/LDAPDataConnectorParser.java | 37 ++++++++++-
.../dc/ldap/LDAPDataConnectorParserTest.java | 72 ++++++++++++++++++++++
.../spring/dc/ldap/ldapDataConnectorTest.ldif | 24 ++++++++
.../resolver/ldap-attribute-resolver-v2-jndi.xml | 34 ++++++++++
.../ldap/resolver/ldap-attribute-resolver-v2.xml | 8 ++-
.../schema/shibboleth-attribute-resolver.xsd | 27 ++++++++
6 files changed, 196 insertions(+), 6 deletions(-)
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index 92225aa..5aba401 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -29,6 +29,7 @@ import org.ldaptive.BindConnectionInitializer;
import org.ldaptive.ConnectionConfig;
import org.ldaptive.Credential;
import org.ldaptive.DefaultConnectionFactory;
+import org.ldaptive.DerefAliases;
import org.ldaptive.SearchExecutor;
import org.ldaptive.SearchFilter;
import org.ldaptive.SearchRequest;
@@ -181,7 +182,7 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
builder.addPropertyValue("connectionFactory", connectionFactory.getBeanDefinition());
}
- final BeanDefinition searchExecutor = v2Parser.createSearchExecutor();
+ final BeanDefinition searchExecutor = v2Parser.createSearchExecutor(props);
builder.addPropertyValue("searchExecutor", searchExecutor);
final String mappingStrategyID = AttributeSupport.getAttributeValue(config, new QName("mappingStrategyRef"));
@@ -450,13 +451,16 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
/**
* Creates a new search executor bean definition from a v2 XML configuration.
- *
+ *
+ * @param props ldap properties
+ *
* @return search executor bean definition
*/
// CheckStyle: CyclomaticComplexity OFF
- @Nonnull public BeanDefinition createSearchExecutor() {
+ @Nonnull public BeanDefinition createSearchExecutor(final ManagedMap<String, String> props) {
final String baseDn = AttributeSupport.getAttributeValue(configElement, new QName("baseDN"));
final String searchScope = AttributeSupport.getAttributeValue(configElement, new QName("searchScope"));
+ final String derefAliases = AttributeSupport.getAttributeValue(configElement, new QName("derefAliases"));
final String searchTimeLimit =
AttributeSupport.getAttributeValue(configElement, new QName("searchTimeLimit"));
final String maxResultSize = AttributeSupport.getAttributeValue(configElement, new QName("maxResultSize"));
@@ -471,6 +475,12 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
if (searchScope != null) {
searchExecutor.addPropertyValue("searchScope", searchScope);
}
+ if (derefAliases != null) {
+ searchExecutor.addPropertyValue("derefAliases", derefAliases);
+ } else if (props.containsKey("java.naming.ldap.derefAliases")) {
+ searchExecutor.addPropertyValue(
+ "derefAliases", props.get("java.naming.ldap.derefAliases").toUpperCase());
+ }
if (searchTimeLimit != null) {
final BeanDefinitionBuilder duration =
BeanDefinitionBuilder.rootBeanDefinition(V2Parser.class, "buildDuration");
@@ -507,6 +517,27 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
searchExecutor.addPropertyValue("returnAttributes", returnAttrs.getBeanDefinition());
}
+ final List<Element> binaryAttrsElements = ElementSupport.getChildElementsByTagNameNS(configElement,
+ AttributeResolverNamespaceHandler.NAMESPACE, "BinaryAttributes");
+
+ if (!binaryAttrsElements.isEmpty()) {
+ if (binaryAttrsElements.size() > 1) {
+ log.warn("{} Only one <BinaryAttributes> element can be specified; "+
+ "only the first has been consulted.", getLogPrefix());
+ }
+ final Element binaryAttrsElement = binaryAttrsElements.get(0);
+
+ final BeanDefinitionBuilder binaryAttrs =
+ BeanDefinitionBuilder.rootBeanDefinition(V2Parser.class, "buildStringList");
+ binaryAttrs.addConstructorArgValue(ElementSupport.getElementContentAsString(binaryAttrsElement));
+ searchExecutor.addPropertyValue("binaryAttributes", binaryAttrs.getBeanDefinition());
+ } else if (props.containsKey("java.naming.ldap.attributes.binary")) {
+ final BeanDefinitionBuilder binaryAttrs =
+ BeanDefinitionBuilder.rootBeanDefinition(V2Parser.class, "buildStringList");
+ binaryAttrs.addConstructorArgValue(props.get("java.naming.ldap.attributes.binary"));
+ searchExecutor.addPropertyValue("binaryAttributes", binaryAttrs.getBeanDefinition());
+ }
+
return searchExecutor.getBeanDefinition();
}
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
index 95ea7e6..7a4389f 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
@@ -36,7 +36,9 @@ import java.util.Map;
import org.ldaptive.BindConnectionInitializer;
import org.ldaptive.ConnectionConfig;
import org.ldaptive.DefaultConnectionFactory;
+import org.ldaptive.DerefAliases;
import org.ldaptive.SearchExecutor;
+import org.ldaptive.SearchScope;
import org.ldaptive.pool.BlockingConnectionPool;
import org.ldaptive.pool.IdlePruneStrategy;
import org.ldaptive.pool.PoolConfig;
@@ -148,6 +150,8 @@ public class LDAPDataConnectorParserTest {
TestSources.SP_ENTITY_ID);
final Map<String, IdPAttribute> attrs = dataConnector.resolve(context);
assertNotNull(attrs);
+ assertEquals(2, attrs.size());
+ assertEquals(attrs.get("employeeNumber").getValues().get(0).getNativeValue(), "C2J20hMNp7NlUwQ+");
assertNotNull(attrs.get("entryDN"));
}
@@ -311,6 +315,74 @@ public class LDAPDataConnectorParserTest {
assertNotNull(attrs.get("entryDN"));
}
+ @Test public void v2JndiConfig() throws Exception {
+ final LDAPDataConnector dataConnector =
+ getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-jndi.xml"});
+ assertNotNull(dataConnector);
+ assertEquals(Duration.ofMinutes(5), dataConnector.getNoRetryDelay());
+ final DefaultConnectionFactory connFactory = (DefaultConnectionFactory) dataConnector.getConnectionFactory();
+ assertNotNull(connFactory);
+
+ final ConnectionConfig connConfig = connFactory.getConnectionConfig();
+ assertNotNull(connConfig);
+ assertEquals("ldap://localhost:10389", connConfig.getLdapUrl());
+ assertEquals(false, connConfig.getUseSSL());
+ assertEquals(true, connConfig.getUseStartTLS());
+ final BindConnectionInitializer connInitializer = (BindConnectionInitializer) connConfig.getConnectionInitializer();
+ assertEquals("cn=Directory Manager", connInitializer.getBindDn());
+ assertEquals("password", connInitializer.getBindCredential().getString());
+ assertEquals(2000, connConfig.getConnectTimeout());
+ assertEquals(4000, connConfig.getResponseTimeout());
+
+ final SslConfig sslConfig = connFactory.getConnectionConfig().getSslConfig();
+ assertNotNull(sslConfig);
+ final CredentialConfig credentialConfig = sslConfig.getCredentialConfig();
+ assertNotNull(credentialConfig);
+
+ final ProviderConfig providerConfig = connFactory.getProvider().getProviderConfig();
+ assertNotNull(providerConfig);
+ assertEquals("value1", providerConfig.getProperties().get("name1"));
+ assertEquals("finding", providerConfig.getProperties().get("java.naming.ldap.derefAliases"));
+ assertEquals("jpegPhoto employeeNumber", providerConfig.getProperties().get("java.naming.ldap.attributes.binary"));
+
+ final SearchExecutor searchExecutor = dataConnector.getSearchExecutor();
+ assertNotNull(searchExecutor);
+ assertEquals("ou=people,dc=shibboleth,dc=net", searchExecutor.getBaseDn());
+ assertNull(searchExecutor.getSearchFilter());
+ assertEquals(7000, searchExecutor.getTimeLimit());
+ assertEquals(SearchScope.SUBTREE, searchExecutor.getSearchScope());
+ assertEquals(DerefAliases.FINDING, searchExecutor.getDerefAliases());
+ assertEquals(new String[] {"jpegPhoto", "employeeNumber"}, searchExecutor.getBinaryAttributes());
+
+ final ConnectionFactoryValidator validator = (ConnectionFactoryValidator) dataConnector.getValidator();
+ assertNotNull(validator);
+ assertTrue(validator.isThrowValidateError());
+ assertNotNull(validator.getConnectionFactory());
+
+ final ExecutableSearchBuilder searchBuilder = dataConnector.getExecutableSearchBuilder();
+ assertNotNull(searchBuilder);
+
+ final StringAttributeValueMappingStrategy mappingStrategy =(StringAttributeValueMappingStrategy) dataConnector.getMappingStrategy();
+ assertNotNull(mappingStrategy);
+ assertTrue(mappingStrategy.isNoResultAnError());
+ assertTrue(mappingStrategy.isMultipleResultsAnError());
+
+ assertNull(dataConnector.getResultsCache());
+
+ dataConnector.initialize();
+ final AttributeResolutionContext context =
+ TestSources.createResolutionContext(TestSources.PRINCIPAL_ID, TestSources.IDP_ENTITY_ID,
+ TestSources.SP_ENTITY_ID);
+ final Map<String, IdPAttribute> attrs = dataConnector.resolve(context);
+ assertNotNull(attrs);
+ assertEquals(5, attrs.size());
+ assertNotNull(attrs.get("cn"));
+ assertNotNull(attrs.get("sn"));
+ assertNotNull(attrs.get("jpegPhoto"));
+ assertEquals(attrs.get("employeeNumber").getValues().get(0).getNativeValue(), "C2J20hMNp7NlUwQ+");
+ assertNotNull(attrs.get("entryDN"));
+ }
+
@Test public void v2PropsConfig() throws Exception {
final Resource props = new ClassPathResource("net/shibboleth/idp/attribute/resolver/spring/dc/ldap/ldap-v2.properties");
final LDAPDataConnector dataConnector =
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/ldapDataConnectorTest.ldif b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/ldapDataConnectorTest.ldif
index 7c48f70..ccb33d3 100644
--- a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/ldapDataConnectorTest.ldif
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/ldapDataConnectorTest.ldif
@@ -21,6 +21,30 @@ homephone: 555-111-2222
mail: peter.principal at shibboleth.net
mail: peterprincipal at shibboleth.net
description: test principal
+employeeNumber:: C2J20hMNp7NlUwQ+
+jpegPhoto:: /9j/4AAQSkZJRgABAQAASABIAAD/4QCMRXhpZgAATU0AKgAAAAgABQESAAMAAAAB
+ AAEAAAEaAAUAAAABAAAASgEbAAUAAAABAAAAUgEoAAMAAAABAAIAAIdpAAQAAAAB
+ AAAAWgAAAAAAAABIAAAAAQAAAEgAAAABAAOgAQADAAAAAQABAACgAgAEAAAAAQAA
+ AAGgAwAEAAAAAQAAAAEAAAAA/+0AOFBob3Rvc2hvcCAzLjAAOEJJTQQEAAAAAAAA
+ OEJJTQQlAAAAAAAQ1B2M2Y8AsgTpgAmY7PhCfv/CABEIAAEAAQMBIgACEQEDEQH/
+ xAAfAAABBQEBAQEBAQAAAAAAAAADAgQBBQAGBwgJCgv/xADDEAABAwMCBAMEBgQH
+ BgQIBnMBAgADEQQSIQUxEyIQBkFRMhRhcSMHgSCRQhWhUjOxJGIwFsFy0UOSNIII
+ 4VNAJWMXNfCTc6JQRLKD8SZUNmSUdMJg0oSjGHDiJ0U3ZbNVdaSVw4Xy00Z2gONH
+ Vma0CQoZGigpKjg5OkhJSldYWVpnaGlqd3h5eoaHiImKkJaXmJmaoKWmp6ipqrC1
+ tre4ubrAxMXGx8jJytDU1dbX2Nna4OTl5ufo6erz9PX29/j5+v/EAB8BAAMBAQEB
+ AQEBAQEAAAAAAAECAAMEBQYHCAkKC//EAMMRAAICAQMDAwIDBQIFAgQEhwEAAhED
+ EBIhBCAxQRMFMCIyURRABjMjYUIVcVI0gVAkkaFDsRYHYjVT8NElYMFE4XLxF4Jj
+ NnAmRVSSJ6LSCAkKGBkaKCkqNzg5OkZHSElKVVZXWFlaZGVmZ2hpanN0dXZ3eHl6
+ gIOEhYaHiImKkJOUlZaXmJmaoKOkpaanqKmqsLKztLW2t7i5usDCw8TFxsfIycrQ
+ 09TV1tfY2drg4uPk5ebn6Onq8vP09fb3+Pn6/9sAQwAEAgMDAwIEAwMDBAQEBAUJ
+ BgUFBQULCAgGCQ0LDQ0NCwwMDhAUEQ4PEw8MDBIYEhMVFhcXFw4RGRsZFhoUFhcW
+ /9sAQwEEBAQFBQUKBgYKFg8MDxYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYW
+ FhYWFhYWFhYWFhYWFhYWFhYWFhYW/9oADAMBAAIRAxEAAAH2XbY7/wD/2gAIAQEA
+ AQUCf//aAAgBAxEBPwF//9oACAECEQE/AX//2gAIAQEABj8Cf//EADMQAQADAAIC
+ AgICAwEBAAACCwERACExQVFhcYGRobHB8NEQ4fEgMEBQYHCAkKCwwNDg/9oACAEB
+ AAE/Ib//2gAMAwEAAhEDEQAAEAP/xAAzEQEBAQADAAECBQUBAQABAQkBABEhMRBB
+ UWEgcfCRgaGx0cHh8TBAUGBwgJCgsMDQ4P/aAAgBAxEBPxC//9oACAECEQE/EL//
+ 2gAIAQEAAT8Qv//Z
dn: cn=Paul Principal,ou=people,dc=shibboleth,dc=net
objectclass: inetOrgPerson
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-jndi.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-jndi.xml
new file mode 100644
index 0000000..0d0942c
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-jndi.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AttributeResolver xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="urn:mace:shibboleth:2.0:security"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
+ urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd">
+
+ <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
+ ldapURL="ldap://localhost:10389"
+ baseDN="ou=people,dc=shibboleth,dc=net"
+ principal="cn=Directory Manager"
+ principalCredential="password"
+ useStartTLS="true"
+ searchTimeLimit="PT7S"
+ noResultIsError="true"
+ multipleResultsIsError="true"
+ noRetryDelay="PT5M"
+ trustFile="net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap.crt"
+ connectTimeout="PT2S"
+ responseTimeout="PT4S">
+
+ <LDAPProperty name="name1" value="value1"/>
+ <LDAPProperty name="java.naming.ldap.attributes.binary" value="jpegPhoto employeeNumber"/>
+ <LDAPProperty name="java.naming.ldap.derefAliases" value="finding"/>
+
+ <ReturnAttributes>cn sn jpegPhoto employeeNumber</ReturnAttributes>
+
+ <FilterTemplate>
+ <![CDATA[
+ (uid=${resolutionContext.principal})
+ ]]>
+ </FilterTemplate>
+
+ </DataConnector>
+
+</AttributeResolver>
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml
index 153bf7f..e8af468 100644
--- a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml
@@ -59,12 +59,14 @@
<LDAPProperty name="name2" value="value2"/>
- <ReturnAttributes>a b g t</ReturnAttributes>
+ <ReturnAttributes>a b g t employeeNumber</ReturnAttributes>
<LDAPProperty name="name1" value="value1"/>
- <ReturnAttributes>a b g t</ReturnAttributes>
-
+ <ReturnAttributes>a b g t employeeNumber</ReturnAttributes>
+
+ <BinaryAttributes>g employeeNumber</BinaryAttributes>
+
<FilterTemplate>
<![CDATA[
(uid=${resolutionContext.principal})
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index 2508c06..177361c 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -751,6 +751,13 @@
</documentation>
</annotation>
</element>
+ <element name="BinaryAttributes" type="resolver:string" minOccurs="0">
+ <annotation>
+ <documentation>
+ A space separated list of attributes whose values should be encoded.
+ </documentation>
+ </annotation>
+ </element>
<element name="LDAPProperty" type="resolver:PropertyType">
<annotation>
<documentation>
@@ -832,6 +839,14 @@
</documentation>
</annotation>
</attribute>
+ <attribute name="derefAliases" type="resolver:DerefAliasesType">
+ <annotation>
+ <documentation>
+ The LDAP alias dereference behavior. Acceptable values are NEVER, SEARCHING, FINDING, ALWAYS.
+ Default value is NEVER.
+ </documentation>
+ </annotation>
+ </attribute>
<attribute name="useStartTLS" type="resolver:string">
<annotation>
<documentation>
@@ -1546,6 +1561,18 @@
</restriction>
</simpleType>
+ <simpleType name="DerefAliasesType">
+ <annotation>
+ <documentation>How to dereference aliases.</documentation>
+ </annotation>
+ <restriction base="string">
+ <enumeration value="NEVER"/>
+ <enumeration value="SEARCHING"/>
+ <enumeration value="FINDING"/>
+ <enumeration value="ALWAYS"/>
+ </restriction>
+ </simpleType>
+
<complexType name="LdapPoolConfigType">
<attribute name="minPoolSize" type="resolver:string">
<annotation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list