[java-identity-provider] branch main updated: IDP-1710 add connectionStrategy to LDAP authn
Daniel Fisher
dfisher at vt.edu
Sun Nov 22 04:35:12 UTC 2020
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=fda9b4f1ff0b1bc4d6202e86f8b47ff85b703b69
The following commit(s) were added to refs/heads/main by this push:
new fda9b4f1f IDP-1710 add connectionStrategy to LDAP authn
fda9b4f1f is described below
commit fda9b4f1ff0b1bc4d6202e86f8b47ff85b703b69
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Sat Nov 21 23:25:48 2020 -0500
IDP-1710 add connectionStrategy to LDAP authn
Make ACTIVE_PASSIVE the default for authn configuration.
ACTIVE_PASSIVE should arguably be activePassive to match camel casing of other authn properties, but the resolver already defines this enum.
---
.../config/LDAPAuthenticationFactoryBean.java | 49 ++++++++++++++++++++++
.../idp/flows/authn/password-authn-beans.xml | 1 +
.../resources/conf/attribute-resolver-ldap.xml | 1 +
idp-conf/src/main/resources/conf/ldap.properties | 3 ++
4 files changed, 54 insertions(+)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index a300f1089..1a2c4e318 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -27,6 +27,7 @@ import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
import org.apache.velocity.app.VelocityEngine;
+import org.ldaptive.ActivePassiveConnectionStrategy;
import org.ldaptive.BindConnectionInitializer;
import org.ldaptive.BindRequest;
import org.ldaptive.ConnectionConfig;
@@ -34,6 +35,8 @@ import org.ldaptive.ConnectionInitializer;
import org.ldaptive.Credential;
import org.ldaptive.DefaultConnectionFactory;
import org.ldaptive.LdapURL;
+import org.ldaptive.RandomConnectionStrategy;
+import org.ldaptive.RoundRobinConnectionStrategy;
import org.ldaptive.SearchFilter;
import org.ldaptive.SearchRequest;
import org.ldaptive.SearchScope;
@@ -152,12 +155,42 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
}
}
+ /** Enum that defines LDAP connection strategy. Labels maps to values in ldap.properties. */
+ public enum ConnectionStrategyType {
+ ACTIVE_PASSIVE("ACTIVE_PASSIVE"),
+ ROUND_ROBIN("ROUND_ROBIN"),
+ RANDOM("RANDOM");
+
+ /** Label for this type. */
+ private final String label;
+
+ ConnectionStrategyType(final String s) {
+ label = s;
+ }
+
+ public String label() {
+ return label;
+ }
+
+ public static ConnectionStrategyType fromLabel(final String s) {
+ for (ConnectionStrategyType cst : ConnectionStrategyType.values()) {
+ if (cst.label().equals(s)) {
+ return cst;
+ }
+ }
+ return null;
+ }
+ }
+
/** Type of authenticator to configure. */
private AuthenticatorType authenticatorType;
/** Type of trust model to configure. */
private TrustType trustType;
+ /** Type of connection strategy to configure. */
+ private ConnectionStrategyType connectionStrategyType;
+
/** LDAP URL. */
private String ldapUrl;
@@ -268,6 +301,10 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
trustType = TrustType.fromLabel(type);
}
+ public void setConnectionStrategyType(@Nonnull @NotEmpty final String type) {
+ connectionStrategyType = ConnectionStrategyType.fromLabel(type);
+ }
+
public void setLdapUrl(@Nullable @NotEmpty final String url) {
ldapUrl = url;
}
@@ -452,6 +489,18 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
config.setUseStartTLS(useStartTLS);
config.setConnectTimeout(connectTimeout);
config.setResponseTimeout(responseTimeout);
+ switch (connectionStrategyType) {
+ case ROUND_ROBIN:
+ config.setConnectionStrategy(new RoundRobinConnectionStrategy());
+ break;
+ case RANDOM:
+ config.setConnectionStrategy(new RandomConnectionStrategy());
+ break;
+ case ACTIVE_PASSIVE:
+ default:
+ config.setConnectionStrategy(new ActivePassiveConnectionStrategy());
+ break;
+ }
config.setSslConfig(createSslConfig());
if (initializer != null) {
config.setConnectionInitializer(initializer);
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
index 8766e7d0d..f59f3e907 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/password-authn-beans.xml
@@ -144,6 +144,7 @@
class="net.shibboleth.idp.authn.config.LDAPAuthenticationFactoryBean"
p:authenticatorType="%{idp.authn.LDAP.authenticator:anonSearchAuthenticator}"
p:trustType="%{idp.authn.LDAP.sslConfig:certificateTrust}"
+ p:connectionStrategyType="%{idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}"
p:ldapUrl="%{idp.authn.LDAP.ldapURL:ldap://localhost:10389}"
p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"
p:connectTimeout="%{idp.authn.LDAP.connectTimeout:PT3S}"
diff --git a/idp-conf/src/main/resources/conf/attribute-resolver-ldap.xml b/idp-conf/src/main/resources/conf/attribute-resolver-ldap.xml
index 616778f02..ec375b43f 100644
--- a/idp-conf/src/main/resources/conf/attribute-resolver-ldap.xml
+++ b/idp-conf/src/main/resources/conf/attribute-resolver-ldap.xml
@@ -62,6 +62,7 @@
connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
+ connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"
noResultIsError="true"
multipleResultsIsError="true"
excludeResolutionPhases="c14n/attribute"
diff --git a/idp-conf/src/main/resources/conf/ldap.properties b/idp-conf/src/main/resources/conf/ldap.properties
index 1e0c51b5f..74f3efb7d 100644
--- a/idp-conf/src/main/resources/conf/ldap.properties
+++ b/idp-conf/src/main/resources/conf/ldap.properties
@@ -11,6 +11,8 @@ idp.authn.LDAP.ldapURL = ldap://localhost:10389
#idp.authn.LDAP.connectTimeout = PT3S
# Time in milliseconds to wait for responses
#idp.authn.LDAP.responseTimeout = PT3S
+# Connection strategy to use when multiple URLs are supplied, either ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
+#idp.authn.LDAP.connectionStrategy = ACTIVE_PASSIVE
## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
#idp.authn.LDAP.sslConfig = certificateTrust
@@ -45,6 +47,7 @@ idp.authn.LDAP.dnFormat = uid=%s,ou=people,dc=example,dc
idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL}
idp.attribute.resolver.LDAP.connectTimeout = %{idp.authn.LDAP.connectTimeout:PT3S}
idp.attribute.resolver.LDAP.responseTimeout = %{idp.authn.LDAP.responseTimeout:PT3S}
+idp.attribute.resolver.LDAP.connectionStrategy = %{idp.authn.LDAP.connectionStrategy:ACTIVE_PASSIVE}
idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN:undefined}
idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN:undefined}
idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list