[java-identity-provider] branch master updated: Allow entry resolution with bindDN.
Daniel Fisher
dfisher at vt.edu
Fri Feb 28 16:35:00 EST 2020
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=8418a1b46d79f22813ac790d64434f23cc9546c7
The following commit(s) were added to refs/heads/master by this push:
new 8418a1b Allow entry resolution with bindDN.
8418a1b is described below
commit 8418a1b46d79f22813ac790d64434f23cc9546c7
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Fri Feb 28 16:32:12 2020 -0500
Allow entry resolution with bindDN.
Add resolveEntryWithBindDn property which configures a entry resolver that uses the bind credentials.
Add isActiveDirectory property which adds the ActiveDirectory response handler.
This allows any authenticator type to leverage AD account states.
Remove setting of specific authenticator return attributes, that can be configured via the returnAttributes property.
---
.../config/LDAPAuthenticationFactoryBean.java | 50 +++++++++++++++++-----
.../system/flows/authn/password-authn-beans.xml | 2 +
2 files changed, 41 insertions(+), 11 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index 81fc016..8eb9a80 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -18,9 +18,6 @@
package net.shibboleth.idp.authn.config;
import java.time.Duration;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.authn.PooledTemplateSearchDnResolver;
@@ -40,6 +37,8 @@ import org.ldaptive.auth.Authenticator;
import org.ldaptive.auth.BindAuthenticationHandler;
import org.ldaptive.auth.FormatDnResolver;
import org.ldaptive.auth.PooledBindAuthenticationHandler;
+import org.ldaptive.auth.PooledSearchEntryResolver;
+import org.ldaptive.auth.SearchEntryResolver;
import org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler;
import org.ldaptive.auth.ext.EDirectoryAuthenticationResponseHandler;
import org.ldaptive.auth.ext.FreeIPAAuthenticationResponseHandler;
@@ -192,6 +191,9 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
/** Whether to return the LDAP entry even if the user BIND fails. */
private boolean resolveEntryOnFailure;
+ /** Whether to resolve the user entry with the bind credentials. */
+ private boolean resolveEntryWithBindDn;
+
/** Velocity engine used to materialize the LDAP filter. */
private VelocityEngine velocityEngine;
@@ -207,6 +209,9 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
/** Whether to use the password expiration control with the BIND operation. See draft-vchu-ldap-pwd-policy. */
private boolean usePasswordExpiration;
+ /** Whether to use account state data as defined by active directory diagnostic messages. */
+ private boolean isActiveDirectory;
+
/** Whether to use account state data as defined by the FreeIPA directory schema. */
private boolean isFreeIPA;
@@ -309,6 +314,10 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
resolveEntryOnFailure = b;
}
+ public void setResolveEntryWithBindDn(final boolean b) {
+ resolveEntryWithBindDn = b;
+ }
+
public void setVelocityEngine(final VelocityEngine engine) {
velocityEngine = engine;
}
@@ -329,6 +338,10 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
usePasswordExpiration = b;
}
+ public void setActiveDirectory(final boolean b) {
+ isActiveDirectory = b;
+ }
+
public void setFreeIPA(final boolean b) {
isFreeIPA = b;
}
@@ -461,7 +474,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
bindSearchDnResolver.setConnectionFactory(
new PooledConnectionFactory(
createConnectionPool(
- "search-pool",
+ "dn-search-pool",
createConnectionConfig(new BindConnectionInitializer(bindDn, new Credential(bindDnCredential))))));
authenticator.setDnResolver(bindSearchDnResolver);
}
@@ -492,7 +505,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
anonSearchDnResolver.setConnectionFactory(
new PooledConnectionFactory(
createConnectionPool(
- "search-pool",
+ "dn-search-pool",
createConnectionConfig())));
authenticator.setDnResolver(anonSearchDnResolver);
}
@@ -501,22 +514,37 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
default:
break;
}
- final List<String> retAttrs = new ArrayList<>();
+
+ if (resolveEntryWithBindDn) {
+ if (disablePooling) {
+ final SearchEntryResolver searchEntryResolver = new SearchEntryResolver();
+ searchEntryResolver.setConnectionFactory(
+ new DefaultConnectionFactory(
+ createConnectionConfig(new BindConnectionInitializer(bindDn, new Credential(bindDnCredential)))));
+ authenticator.setEntryResolver(searchEntryResolver);
+ } else {
+ final PooledSearchEntryResolver searchEntryResolver = new PooledSearchEntryResolver();
+ searchEntryResolver.setConnectionFactory(
+ new PooledConnectionFactory(
+ createConnectionPool(
+ "entry-search-pool",
+ createConnectionConfig(new BindConnectionInitializer(bindDn, new Credential(bindDnCredential))))));
+ authenticator.setEntryResolver(searchEntryResolver);
+ }
+ }
+
if (usePasswordPolicy) {
authenticator.setAuthenticationRequestHandlers(new PasswordPolicyAuthenticationRequestHandler());
authenticator.setAuthenticationResponseHandlers(new PasswordPolicyAuthenticationResponseHandler());
} else if (usePasswordExpiration) {
authenticator.setAuthenticationResponseHandlers(new PasswordExpirationAuthenticationResponseHandler());
+ } else if (isActiveDirectory) {
+ authenticator.setAuthenticationResponseHandlers(new ActiveDirectoryAuthenticationResponseHandler());
} else if (isEDirectory) {
- retAttrs.addAll(Arrays.asList(EDirectoryAuthenticationResponseHandler.ATTRIBUTES));
authenticator.setAuthenticationResponseHandlers(new EDirectoryAuthenticationResponseHandler());
} else if (isFreeIPA) {
- retAttrs.addAll(Arrays.asList(FreeIPAAuthenticationResponseHandler.ATTRIBUTES));
authenticator.setAuthenticationResponseHandlers(new FreeIPAAuthenticationResponseHandler());
}
- if (!retAttrs.isEmpty()) {
- authenticator.setReturnAttributes(retAttrs.toArray(new String[0]));
- }
return authenticator;
}
// Checkstyle: CyclomaticComplexity|MethodLength ON
diff --git a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
index 2e55715..166cede 100644
--- a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
@@ -136,11 +136,13 @@
p:userFilter="#{'%{idp.authn.LDAP.userFilter:undefined}'.trim()}"
p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"
p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"
+ p:resolveEntryWithBindDn="%{idp.authn.LDAP.resolveEntryWithBindDn:false}"
p:velocityEngine-ref="shibboleth.VelocityEngine"
p:bindDn="#{'%{idp.authn.LDAP.bindDN:undefined}'.trim()}"
p:bindDnCredential="%{idp.authn.LDAP.bindDNCredential:undefined}"
p:usePasswordPolicy="%{idp.authn.LDAP.usePasswordPolicy:false}"
p:usePasswordExpiration="%{idp.authn.LDAP.usePasswordExpiration:false}"
+ p:activeDirectory="%{idp.authn.LDAP.activeDirectory:false}"
p:freeIPA="%{idp.authn.LDAP.freeIPADirectory:false}"
p:EDirectory="%{idp.authn.LDAP.eDirectory:false}" />
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list