[java-identity-provider] branch maint-4 updated: IDP-1950 Add disabled trust type for LDAP
Daniel Fisher
dfisher at vt.edu
Wed Jan 4 17:09:54 UTC 2023
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch maint-4
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7ed842ddc515bc94f4649569e256c2aa658f98c8
The following commit(s) were added to refs/heads/maint-4 by this push:
new 7ed842ddc IDP-1950 Add disabled trust type for LDAP
7ed842ddc is described below
commit 7ed842ddc515bc94f4649569e256c2aa658f98c8
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Wed Jan 4 11:22:15 2023 -0500
IDP-1950 Add disabled trust type for LDAP
https://shibboleth.atlassian.net/browse/IDP-1950
Trust type is required, provide an option when not using SSL/startTLS.
Add a unit test for LDAPAuthenticationFactoryBean.
---
.../config/LDAPAuthenticationFactoryBean.java | 7 +-
.../config/LDAPAuthenticationFactoryBeanTest.java | 128 +++++++++++++++++++++
.../shibboleth/idp/authn/config/loginLDAPTest.ldif | 35 ++++++
3 files changed, 169 insertions(+), 1 deletion(-)
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index 39b88de9f..31b171797 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -17,6 +17,7 @@
package net.shibboleth.idp.authn.config;
+import java.security.GeneralSecurityException;
import java.time.Duration;
import java.time.Period;
import javax.annotation.Nonnull;
@@ -108,7 +109,8 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
public enum TrustType {
JVM("jvmTrust"),
CERTIFICATE("certificateTrust"),
- KEYSTORE("keyStoreTrust");
+ KEYSTORE("keyStoreTrust"),
+ DISABLED("disabled");
/** Label for this type. */
private final String label;
@@ -491,6 +493,9 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
case KEYSTORE:
config.setCredentialConfig(truststoreCredentialConfig);
break;
+ case DISABLED:
+ config.setCredentialConfig(() -> { throw new GeneralSecurityException("SSL/startTLS is disabled"); });
+ break;
case JVM:
default:
break;
diff --git a/idp-authn-api/src/test/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBeanTest.java b/idp-authn-api/src/test/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBeanTest.java
new file mode 100644
index 000000000..060c4beb6
--- /dev/null
+++ b/idp-authn-api/src/test/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBeanTest.java
@@ -0,0 +1,128 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.config;
+
+import java.time.Duration;
+import java.util.Map;
+
+import org.apache.velocity.VelocityContext;
+import org.ldaptive.Credential;
+import org.ldaptive.auth.AuthenticationRequest;
+import org.ldaptive.auth.AuthenticationResponse;
+import org.ldaptive.auth.Authenticator;
+import org.ldaptive.auth.User;
+import org.testng.Assert;
+import org.testng.annotations.AfterClass;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.unboundid.ldap.listener.InMemoryDirectoryServer;
+import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
+import com.unboundid.ldap.listener.InMemoryListenerConfig;
+import com.unboundid.ldap.sdk.LDAPException;
+
+import net.shibboleth.idp.authn.context.UsernamePasswordContext;
+import net.shibboleth.utilities.java.support.velocity.VelocityEngine;
+
+/** Unit test for LDAP authentication factory bean. */
+public class LDAPAuthenticationFactoryBeanTest {
+
+ private static final String DATA_PATH = "src/test/resources/net/shibboleth/idp/authn/config/";
+
+ private InMemoryDirectoryServer directoryServer;
+
+ private LDAPAuthenticationFactoryBean factoryBean;
+
+ private Authenticator authenticator;
+
+ /**
+ * Creates an UnboundID in-memory directory server. Leverages LDIF found in test resources.
+ *
+ * @throws LDAPException if the in-memory directory server cannot be created
+ */
+ @BeforeClass public void setupDirectoryServer() throws LDAPException {
+
+ InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=shibboleth,dc=net");
+ config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("default", 10389));
+ config.addAdditionalBindCredentials("cn=Directory Manager", "password");
+ directoryServer = new InMemoryDirectoryServer(config);
+ directoryServer.importFromLDIF(true, DATA_PATH + "loginLDAPTest.ldif");
+ directoryServer.startListening();
+ }
+
+ /**
+ * Shutdown the in-memory directory server.
+ */
+ @AfterClass public void teardownDirectoryServer() {
+ directoryServer.shutDown(true);
+ }
+
+ @BeforeMethod
+ public void setupAuthenticator() throws Exception {
+ factoryBean = new LDAPAuthenticationFactoryBean();
+ factoryBean.setLdapUrl("ldap://localhost:10389");
+ factoryBean.setBaseDn("ou=people,dc=shibboleth,dc=net");
+ factoryBean.setUserFilter("(uid={user})");
+ factoryBean.setSubtreeSearch(false);
+ factoryBean.setVelocityEngine(VelocityEngine.newVelocityEngine());
+ factoryBean.setAuthenticatorType("anonSearchAuthenticator");
+ factoryBean.setTrustType("disabled");
+ factoryBean.setConnectionStrategyType("ACTIVE_PASSIVE");
+ factoryBean.setUseStartTLS(false);
+ factoryBean.setConnectTimeout(Duration.ofSeconds(3));
+ factoryBean.setResponseTimeout(Duration.ofSeconds(3));
+ factoryBean.setDisablePooling(true);
+ factoryBean.setBlockWaitTime(Duration.ofSeconds(3));
+ factoryBean.setPrunePeriod(Duration.ofMinutes(5));
+ factoryBean.setIdleTime(Duration.ofMinutes(10));
+ factoryBean.setMinPoolSize(3);
+ factoryBean.setMaxPoolSize(5);
+ factoryBean.setValidateOnCheckout(false);
+ factoryBean.setValidatePeriodically(true);
+ factoryBean.setValidatePeriod(Duration.ofMinutes(5));
+ factoryBean.setValidateDn("");
+ factoryBean.setValidateFilter("(objectClass=*)");
+ factoryBean.setBindPoolPassivatorType("anonymousBind");
+ authenticator = factoryBean.createInstance();
+ }
+
+ @Test public void testAuthnSuccess() throws Exception {
+ final AuthenticationResponse response = authenticator.authenticate(
+ createAuthenticationRequest("PETER_THE_PRINCIPAL", "changeit"));
+ Assert.assertNotNull(response);
+ Assert.assertTrue(response.getResult());
+ }
+
+ @Test public void testAuthnFailure() throws Exception {
+ final AuthenticationResponse response = authenticator.authenticate(
+ createAuthenticationRequest("PETER_THE_PRINCIPAL", "wrong"));
+ Assert.assertNotNull(response);
+ Assert.assertFalse(response.getResult());
+ }
+
+ private AuthenticationRequest createAuthenticationRequest(final String username, final String password) {
+ final UsernamePasswordContext upc = new UsernamePasswordContext();
+ upc.setUsername(username);
+ upc.setPassword(password);
+ return new AuthenticationRequest(
+ new User(upc.getUsername(), new VelocityContext(Map.of("usernamePasswordContext", upc))),
+ new Credential(upc.getPassword()));
+ }
+}
\ No newline at end of file
diff --git a/idp-authn-api/src/test/resources/net/shibboleth/idp/authn/config/loginLDAPTest.ldif b/idp-authn-api/src/test/resources/net/shibboleth/idp/authn/config/loginLDAPTest.ldif
new file mode 100644
index 000000000..7c48f70cd
--- /dev/null
+++ b/idp-authn-api/src/test/resources/net/shibboleth/idp/authn/config/loginLDAPTest.ldif
@@ -0,0 +1,35 @@
+dn: dc=shibboleth,dc=net
+dc: shibboleth
+objectClass: dcObject
+objectClass: organization
+o: Shibboleth, Inc.
+
+dn: ou=people,dc=shibboleth,dc=net
+ou: people
+description: All people in organization
+objectclass: organizationalunit
+
+dn: cn=Peter Principal,ou=people,dc=shibboleth,dc=net
+objectclass: inetOrgPerson
+cn: Peter Principal
+cn: Peter J Principal
+cn: pete principal
+sn: Principal
+uid: PETER_THE_PRINCIPAL
+userpassword: changeit
+homephone: 555-111-2222
+mail: peter.principal at shibboleth.net
+mail: peterprincipal at shibboleth.net
+description: test principal
+
+dn: cn=Paul Principal,ou=people,dc=shibboleth,dc=net
+objectclass: inetOrgPerson
+cn: Paul Principal
+sn: Principal
+uid: PAUL_THE_PRINCIPAL
+userpassword: changeit
+homephone: 555-111-3333
+mail: paul.principal at shibboleth.net
+mail: paulprincipal at shibboleth.net
+description: test principal
+
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list