[java-identity-provider] branch master updated: IDP-1603 LDAP referral chasing
Daniel Fisher
dfisher at vt.edu
Thu May 14 02:33:15 UTC 2020
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=335679a4af703a7b5de3ebe37666add702d640f5
The following commit(s) were added to refs/heads/master by this push:
new 335679a4a IDP-1603 LDAP referral chasing
335679a4a is described below
commit 335679a4af703a7b5de3ebe37666add702d640f5
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Wed May 13 22:28:13 2020 -0400
IDP-1603 LDAP referral chasing
Update attribute resolver schema with boolean flag for referral chasing.
Add unit test.
---
.../dc/ldap/impl/LDAPDataConnectorParser.java | 23 ++++++++++++++++++
.../dc/ldap/LDAPDataConnectorParserTest.java | 28 ++++++++++++++++++++++
.../ldap-attribute-resolver-v2-referral.xml | 19 +++++++++++++++
.../ldap/resolver/ldap-attribute-resolver-v2.xml | 2 +-
.../schema/shibboleth-attribute-resolver.xsd | 8 +++++++
5 files changed, 79 insertions(+), 1 deletion(-)
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index bd4f680b9..f44f878b4 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -472,6 +472,8 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
final String baseDn = AttributeSupport.getAttributeValue(configElement, new QName("baseDN"));
final String searchScope = AttributeSupport.getAttributeValue(configElement, new QName("searchScope"));
final String derefAliases = AttributeSupport.getAttributeValue(configElement, new QName("derefAliases"));
+ final String followReferrals =
+ AttributeSupport.getAttributeValue(configElement, new QName("followReferrals"));
final String searchTimeLimit =
AttributeSupport.getAttributeValue(configElement, new QName("searchTimeLimit"));
final String maxResultSize = AttributeSupport.getAttributeValue(configElement, new QName("maxResultSize"));
@@ -489,6 +491,12 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
if (derefAliases != null) {
searchExecutor.addPropertyValue("derefAliases", derefAliases);
}
+ if (followReferrals != null) {
+ final BeanDefinitionBuilder handler =
+ BeanDefinitionBuilder.rootBeanDefinition(V2Parser.class, "buildReferralHandler");
+ handler.addConstructorArgValue(followReferrals);
+ searchExecutor.addPropertyValue("referralHandler", handler.getBeanDefinition());
+ }
if (searchTimeLimit != null) {
searchExecutor.addPropertyValue("timeLimit", searchTimeLimit);
} else {
@@ -880,5 +888,20 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
}
return handlers;
}
+
+ /**
+ * Returns a search referral handler or null if followReferrals is false.
+ *
+ * @param followReferrals whether to create a search referral handler
+ *
+ * @return search referral handler or null
+ */
+ @Nonnull public static SearchReferralHandler buildReferralHandler(
+ @Nullable final String followReferrals) {
+ if (followReferrals != null && Boolean.valueOf(followReferrals)) {
+ return new SearchReferralHandler();
+ }
+ return null;
+ }
}
}
\ No newline at end of file
diff --git a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
index 23f365d82..4dc943636 100644
--- a/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
+++ b/idp-attribute-resolver-spring/src/test/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/LDAPDataConnectorParserTest.java
@@ -47,6 +47,7 @@ import org.ldaptive.pool.IdlePruneStrategy;
import org.ldaptive.pool.PoolConfig;
import org.ldaptive.pool.PooledConnectionFactory;
import org.ldaptive.pool.SearchValidator;
+import org.ldaptive.referral.SearchReferralHandler;
import org.ldaptive.sasl.DigestMd5Config;
import org.ldaptive.sasl.Mechanism;
import org.ldaptive.sasl.QualityOfProtection;
@@ -233,6 +234,7 @@ public class LDAPDataConnectorParserTest {
assertEquals(searchExecutor.getBaseDn(), "");
assertNull(searchExecutor.getSearchFilter());
assertEquals(searchExecutor.getTimeLimit(), Duration.ofSeconds(3));
+ assertNull(searchExecutor.getReferralHandler());
final ConnectionFactoryValidator validator = (ConnectionFactoryValidator) dataConnector.getValidator();
assertNotNull(validator);
@@ -374,6 +376,31 @@ public class LDAPDataConnectorParserTest {
assertEquals(((DigestMd5Config) saslConfig).getRealm(), "shibboleth.net");
}
+ @Test public void v2ReferralConfig() throws Exception {
+ final LDAPDataConnector dataConnector =
+ getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-referral.xml"});
+ assertNotNull(dataConnector);
+ assertTrue(dataConnector.isFailFastInitialize());
+ assertEquals(dataConnector.getNoRetryDelay(), Duration.ZERO);
+
+ final DefaultConnectionFactory connFactory = (DefaultConnectionFactory) dataConnector.getConnectionFactory();
+ assertNotNull(connFactory);
+ final ConnectionConfig connConfig = connFactory.getConnectionConfig();
+ assertNotNull(connConfig);
+ final BindConnectionInitializer connInitializer = (BindConnectionInitializer) connConfig.getConnectionInitializer();
+ assertNotNull(connInitializer);
+ final SaslConfig saslConfig = connInitializer.getBindSaslConfig();
+ assertNull(saslConfig);
+
+ final SearchExecutor searchExecutor = dataConnector.getSearchExecutor();
+ assertNotNull(searchExecutor);
+ assertEquals(searchExecutor.getBaseDn(), "");
+ assertNull(searchExecutor.getSearchFilter());
+ assertEquals(searchExecutor.getTimeLimit(), Duration.ofSeconds(3));
+ final SearchReferralHandler referralHandler = (SearchReferralHandler) searchExecutor.getReferralHandler();
+ assertNotNull(referralHandler);
+ }
+
@Test public void springConfig() throws Exception {
final LDAPDataConnector dataConnector =
getLdapDataConnector(new String[] {"net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-spring.xml"});
@@ -540,6 +567,7 @@ public class LDAPDataConnectorParserTest {
assertEquals(searchExecutor.getBaseDn(), "ou=people,dc=shibboleth,dc=net");
assertNull(searchExecutor.getSearchFilter());
assertEquals(searchExecutor.getTimeLimit(), Duration.ofSeconds(7));
+ assertNull(searchExecutor.getReferralHandler());
final ConnectionFactoryValidator validator = (ConnectionFactoryValidator) dataConnector.getValidator();
assertNotNull(validator);
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-referral.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-referral.xml
new file mode 100644
index 000000000..c7afae04a
--- /dev/null
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-referral.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<AttributeResolver
+ xmlns="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">
+
+ <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
+ ldapURL="ldap://localhost:10389"
+ principal="cn=Directory Manager"
+ failFastInitialize="true"
+ principalCredential="password"
+ followReferrals="true">
+ <FilterTemplate>
+ <![CDATA[
+ (uid=${resolutionContext.principal})
+ ]]>
+ </FilterTemplate>
+ </DataConnector>
+
+</AttributeResolver>
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml
index ff1c6841e..58df71143 100644
--- a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2.xml
@@ -78,7 +78,7 @@
]]>
</FilterTemplate>
- <ConnectionPool
+ <ConnectionPool
minPoolSize="5"
maxPoolSize="10"
blockWaitTime="PT5S"
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index 233ac7c4a..61e180174 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -872,6 +872,14 @@
</documentation>
</annotation>
</attribute>
+ <attribute name="followReferrals" type="resolver:string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether search referrals and search references should be followed.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
<attribute name="useStartTLS" type="resolver:string">
<annotation>
<documentation>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list