[java-identity-provider] branch master updated: Add flag to disable pooling for LDAP authn.
Daniel Fisher
dfisher at vt.edu
Fri Jan 17 23:27:40 EST 2020
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=64fe08f70ef8daf364d9547c935811516db9be9b
The following commit(s) were added to refs/heads/master by this push:
new 64fe08f Add flag to disable pooling for LDAP authn.
64fe08f is described below
commit 64fe08f70ef8daf364d9547c935811516db9be9b
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Fri Jan 17 23:26:04 2020 -0500
Add flag to disable pooling for LDAP authn.
---
.../config/LDAPAuthenticationFactoryBean.java | 80 +++++++++++++++-------
.../system/flows/authn/password-authn-beans.xml | 1 +
2 files changed, 58 insertions(+), 23 deletions(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index e3c0ac9..c01eed5 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -24,6 +24,7 @@ import java.util.List;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import net.shibboleth.idp.authn.PooledTemplateSearchDnResolver;
+import net.shibboleth.idp.authn.TemplateSearchDnResolver;
import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
@@ -36,6 +37,7 @@ import org.ldaptive.Credential;
import org.ldaptive.DefaultConnectionFactory;
import org.ldaptive.LdapURL;
import org.ldaptive.auth.Authenticator;
+import org.ldaptive.auth.BindAuthenticationHandler;
import org.ldaptive.auth.FormatDnResolver;
import org.ldaptive.auth.PooledBindAuthenticationHandler;
import org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler;
@@ -144,6 +146,9 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
/** Trust configuration when using truststore based trust. */
private CredentialConfig truststoreCredentialConfig;
+ /** Whether to disable connection pooling for both binds and searches. */
+ private boolean disablePooling;
+
/** Wait time for getting a connection from the pool. */
private Duration blockWaitTime;
@@ -240,6 +245,10 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
truststoreCredentialConfig = config;
}
+ public void setDisablePooling(final boolean b) {
+ disablePooling = b;
+ }
+
public void setBlockWaitTime(@Nullable final Duration time) {
blockWaitTime = time;
}
@@ -412,21 +421,37 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
}
}
final Authenticator authenticator = new Authenticator();
- authenticator.setAuthenticationHandler(
- new PooledBindAuthenticationHandler(
- new PooledConnectionFactory(createConnectionPool("bind-pool", createConnectionConfig()))));
+ if (disablePooling) {
+ authenticator.setAuthenticationHandler(
+ new BindAuthenticationHandler(new DefaultConnectionFactory(createConnectionConfig())));
+ } else {
+ authenticator.setAuthenticationHandler(
+ new PooledBindAuthenticationHandler(
+ new PooledConnectionFactory(createConnectionPool("bind-pool", createConnectionConfig()))));
+ }
switch(authenticatorType) {
case BIND_SEARCH:
- final PooledTemplateSearchDnResolver bindSearchDnResolver =
- new PooledTemplateSearchDnResolver(velocityEngine, userFilter);
- bindSearchDnResolver.setBaseDn(baseDn);
- bindSearchDnResolver.setSubtreeSearch(subtreeSearch);
- bindSearchDnResolver.setConnectionFactory(
- new PooledConnectionFactory(
- createConnectionPool(
- "search-pool",
- createConnectionConfig(new BindConnectionInitializer(bindDn, new Credential(bindDnCredential))))));
- authenticator.setDnResolver(bindSearchDnResolver);
+ if (disablePooling) {
+ final TemplateSearchDnResolver bindSearchDnResolver =
+ new TemplateSearchDnResolver(velocityEngine, userFilter);
+ bindSearchDnResolver.setBaseDn(baseDn);
+ bindSearchDnResolver.setSubtreeSearch(subtreeSearch);
+ bindSearchDnResolver.setConnectionFactory(
+ new DefaultConnectionFactory(
+ createConnectionConfig(new BindConnectionInitializer(bindDn, new Credential(bindDnCredential)))));
+ authenticator.setDnResolver(bindSearchDnResolver);
+ } else {
+ final PooledTemplateSearchDnResolver bindSearchDnResolver =
+ new PooledTemplateSearchDnResolver(velocityEngine, userFilter);
+ bindSearchDnResolver.setBaseDn(baseDn);
+ bindSearchDnResolver.setSubtreeSearch(subtreeSearch);
+ bindSearchDnResolver.setConnectionFactory(
+ new PooledConnectionFactory(
+ createConnectionPool(
+ "search-pool",
+ createConnectionConfig(new BindConnectionInitializer(bindDn, new Credential(bindDnCredential))))));
+ authenticator.setDnResolver(bindSearchDnResolver);
+ }
authenticator.setResolveEntryOnFailure(resolveEntryOnFailure);
break;
case DIRECT:
@@ -439,16 +464,25 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
authenticator.setAuthenticationResponseHandlers(new ActiveDirectoryAuthenticationResponseHandler());
break;
case ANON_SEARCH:
- final PooledTemplateSearchDnResolver anonSearchDnResolver =
- new PooledTemplateSearchDnResolver(velocityEngine, userFilter);
- anonSearchDnResolver.setBaseDn(baseDn);
- anonSearchDnResolver.setSubtreeSearch(subtreeSearch);
- anonSearchDnResolver.setConnectionFactory(
- new PooledConnectionFactory(
- createConnectionPool(
- "search-pool",
- createConnectionConfig())));
- authenticator.setDnResolver(anonSearchDnResolver);
+ if (disablePooling) {
+ final TemplateSearchDnResolver anonSearchDnResolver =
+ new TemplateSearchDnResolver(velocityEngine, userFilter);
+ anonSearchDnResolver.setBaseDn(baseDn);
+ anonSearchDnResolver.setSubtreeSearch(subtreeSearch);
+ anonSearchDnResolver.setConnectionFactory(new DefaultConnectionFactory(createConnectionConfig()));
+ authenticator.setDnResolver(anonSearchDnResolver);
+ } else {
+ final PooledTemplateSearchDnResolver anonSearchDnResolver =
+ new PooledTemplateSearchDnResolver(velocityEngine, userFilter);
+ anonSearchDnResolver.setBaseDn(baseDn);
+ anonSearchDnResolver.setSubtreeSearch(subtreeSearch);
+ anonSearchDnResolver.setConnectionFactory(
+ new PooledConnectionFactory(
+ createConnectionPool(
+ "search-pool",
+ createConnectionConfig())));
+ authenticator.setDnResolver(anonSearchDnResolver);
+ }
authenticator.setResolveEntryOnFailure(resolveEntryOnFailure);
break;
default:
diff --git a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
index b11187f..3f0aa44 100644
--- a/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
+++ b/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml
@@ -119,6 +119,7 @@
p:responseTimeout="%{idp.authn.LDAP.responseTimeout:PT3S}"
p:trustCertificatesCredentialConfig-ref="shibboleth.authn.LDAP.trustCertificates"
p:truststoreCredentialConfig-ref="shibboleth.authn.LDAP.truststore"
+ p:disablePooling="%{idp.authn.LDAP.disablePooling:false}"
p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list