[java-identity-provider] branch main updated: IDP-1950 Add disabled trust type for LDAP
Daniel Fisher
dfisher at vt.edu
Wed Jan 4 17:33:39 UTC 2023
This is an automated email from the git hooks/post-receive script.
dfisher pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=796f59287fcbfa9265e9f0749e367b49ed28a4cd
The following commit(s) were added to refs/heads/main by this push:
new 796f59287 IDP-1950 Add disabled trust type for LDAP
796f59287 is described below
commit 796f59287fcbfa9265e9f0749e367b49ed28a4cd
Author: Daniel Fisher <dfisher at vt.edu>
AuthorDate: Wed Jan 4 12:25:35 2023 -0500
IDP-1950 Add disabled trust type for LDAP
https://shibboleth.atlassian.net/browse/IDP-1950
Trust type is required, provide an option when not using SSL/startTLS.
Add a unit test for LDAPAuthenticationFactoryBean.
---
idp-authn-api/pom.xml | 5 +
.../config/LDAPAuthenticationFactoryBean.java | 16 ++-
.../config/LDAPAuthenticationFactoryBeanTest.java | 132 +++++++++++++++++++++
.../shibboleth/idp/authn/config/loginLDAPTest.ldif | 35 ++++++
4 files changed, 185 insertions(+), 3 deletions(-)
diff --git a/idp-authn-api/pom.xml b/idp-authn-api/pom.xml
index 35b9e677c..fd2524be6 100644
--- a/idp-authn-api/pom.xml
+++ b/idp-authn-api/pom.xml
@@ -110,6 +110,11 @@
<!-- Runtime Dependencies -->
<!-- Test Dependencies -->
+ <dependency>
+ <groupId>${shib-shared.groupId}</groupId>
+ <artifactId>shib-testing</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<scm>
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index 9868e67ef..6a38bbb5f 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -17,6 +17,7 @@
package net.shibboleth.idp.authn.config;
+import java.security.GeneralSecurityException;
import java.time.Duration;
import java.time.Period;
import javax.annotation.Nonnull;
@@ -25,8 +26,6 @@ import javax.annotation.Nullable;
import com.google.common.base.MoreObjects;
import net.shibboleth.idp.authn.TemplateSearchDnResolver;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.primitive.DeprecationSupport;
-import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
import org.apache.velocity.app.VelocityEngine;
import org.ldaptive.ActivePassiveConnectionStrategy;
@@ -102,7 +101,8 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
public enum TrustType {
JVM("jvmTrust"),
CERTIFICATE("certificateTrust"),
- KEYSTORE("keyStoreTrust");
+ KEYSTORE("keyStoreTrust"),
+ DISABLED("disabled");
/** Label for this type. */
private final String label;
@@ -478,6 +478,9 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
case KEYSTORE:
config.setCredentialConfig(truststoreCredentialConfig);
break;
+ case DISABLED:
+ config.setCredentialConfig(() -> { throw new GeneralSecurityException("SSL/startTLS is disabled"); });
+ break;
case JVM:
default:
break;
@@ -735,6 +738,13 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
}
// Checkstyle: CyclomaticComplexity|MethodLength ON
+ @Override
+ protected void destroyInstance(final Authenticator instance) {
+ if (instance != null) {
+ instance.close();
+ }
+ }
+
@Override
public String toString() {
return MoreObjects.toStringHelper(this)
diff --git a/idp-authn-api/src/test/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBeanTest.java b/idp-authn-api/src/test/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBeanTest.java
new file mode 100644
index 000000000..55daa7a8c
--- /dev/null
+++ b/idp-authn-api/src/test/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBeanTest.java
@@ -0,0 +1,132 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.idp.authn.config;
+
+import java.time.Duration;
+import java.util.Map;
+
+import org.apache.velocity.VelocityContext;
+import org.ldaptive.Credential;
+import org.ldaptive.auth.AuthenticationRequest;
+import org.ldaptive.auth.AuthenticationResponse;
+import org.ldaptive.auth.Authenticator;
+import org.ldaptive.auth.User;
+import org.springframework.core.io.ClassPathResource;
+import org.testng.Assert;
+import org.testng.annotations.AfterClass;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import net.shibboleth.idp.authn.context.UsernamePasswordContext;
+import net.shibboleth.shared.testing.InMemoryDirectory;
+import net.shibboleth.shared.testing.VelocityEngine;
+
+import static org.testng.Assert.assertEquals;
+
+/** Unit test for LDAP authentication factory bean. */
+public class LDAPAuthenticationFactoryBeanTest {
+
+ private static final String DATA_PATH = "/net/shibboleth/idp/authn/config/";
+
+ private InMemoryDirectory directoryServer;
+
+ private LDAPAuthenticationFactoryBean factoryBean;
+
+ private Authenticator authenticator;
+
+ /**
+ * Creates an UnboundID in-memory directory server. Leverages LDIF found in test resources.
+ */
+ @BeforeClass public void setupDirectoryServer() {
+ directoryServer =
+ new InMemoryDirectory(
+ new String[] {"dc=shibboleth,dc=net"},
+ new ClassPathResource(DATA_PATH + "loginLDAPTest.ldif"),
+ 10389);
+ directoryServer.start();
+ }
+
+ /**
+ * Shutdown the in-memory directory server.
+ */
+ @AfterClass public void teardownDirectoryServer() throws Exception {
+ if (directoryServer.openConnectionCount() > 0) {
+ Thread.sleep(100);
+ }
+ assertEquals(directoryServer.openConnectionCount(), 0);
+ directoryServer.stop(true);
+ }
+
+ @BeforeMethod
+ public void setupAuthenticator() throws Exception {
+ factoryBean = new LDAPAuthenticationFactoryBean();
+ factoryBean.setLdapUrl("ldap://localhost:10389");
+ factoryBean.setBaseDn("ou=people,dc=shibboleth,dc=net");
+ factoryBean.setUserFilter("(uid={user})");
+ factoryBean.setSubtreeSearch(false);
+ factoryBean.setVelocityEngine(VelocityEngine.newVelocityEngine());
+ factoryBean.setAuthenticatorType("anonSearchAuthenticator");
+ factoryBean.setTrustType("disabled");
+ factoryBean.setConnectionStrategyType("ACTIVE_PASSIVE");
+ factoryBean.setUseStartTLS(false);
+ factoryBean.setConnectTimeout(Duration.ofSeconds(3));
+ factoryBean.setResponseTimeout(Duration.ofSeconds(3));
+ factoryBean.setDisablePooling(false);
+ factoryBean.setBlockWaitTime(Duration.ofSeconds(3));
+ factoryBean.setPrunePeriod(Duration.ofMinutes(5));
+ factoryBean.setIdleTime(Duration.ofMinutes(10));
+ factoryBean.setMinPoolSize(3);
+ factoryBean.setMaxPoolSize(5);
+ factoryBean.setValidateOnCheckout(false);
+ factoryBean.setValidatePeriodically(true);
+ factoryBean.setValidatePeriod(Duration.ofMinutes(5));
+ factoryBean.setValidateDn("");
+ factoryBean.setValidateFilter("(objectClass=*)");
+ factoryBean.setBindPoolPassivatorType("anonymousBind");
+ authenticator = factoryBean.createInstance();
+ }
+
+ @AfterMethod public void teardownAuthenticator() throws Exception {
+ factoryBean.destroyInstance(authenticator);
+ }
+
+ @Test public void testAuthnSuccess() throws Exception {
+ final AuthenticationResponse response = authenticator.authenticate(
+ createAuthenticationRequest("PETER_THE_PRINCIPAL", "changeit"));
+ Assert.assertNotNull(response);
+ Assert.assertTrue(response.isSuccess());
+ }
+
+ @Test public void testAuthnFailure() throws Exception {
+ final AuthenticationResponse response = authenticator.authenticate(
+ createAuthenticationRequest("PETER_THE_PRINCIPAL", "wrong"));
+ Assert.assertNotNull(response);
+ Assert.assertFalse(response.isSuccess());
+ }
+
+ private AuthenticationRequest createAuthenticationRequest(final String username, final String password) {
+ final UsernamePasswordContext upc = new UsernamePasswordContext();
+ upc.setUsername(username);
+ upc.setPassword(password);
+ return new AuthenticationRequest(
+ new User(upc.getUsername(), new VelocityContext(Map.of("usernamePasswordContext", upc))),
+ new Credential(upc.getPassword()));
+ }
+}
\ No newline at end of file
diff --git a/idp-authn-api/src/test/resources/net/shibboleth/idp/authn/config/loginLDAPTest.ldif b/idp-authn-api/src/test/resources/net/shibboleth/idp/authn/config/loginLDAPTest.ldif
new file mode 100644
index 000000000..7c48f70cd
--- /dev/null
+++ b/idp-authn-api/src/test/resources/net/shibboleth/idp/authn/config/loginLDAPTest.ldif
@@ -0,0 +1,35 @@
+dn: dc=shibboleth,dc=net
+dc: shibboleth
+objectClass: dcObject
+objectClass: organization
+o: Shibboleth, Inc.
+
+dn: ou=people,dc=shibboleth,dc=net
+ou: people
+description: All people in organization
+objectclass: organizationalunit
+
+dn: cn=Peter Principal,ou=people,dc=shibboleth,dc=net
+objectclass: inetOrgPerson
+cn: Peter Principal
+cn: Peter J Principal
+cn: pete principal
+sn: Principal
+uid: PETER_THE_PRINCIPAL
+userpassword: changeit
+homephone: 555-111-2222
+mail: peter.principal at shibboleth.net
+mail: peterprincipal at shibboleth.net
+description: test principal
+
+dn: cn=Paul Principal,ou=people,dc=shibboleth,dc=net
+objectclass: inetOrgPerson
+cn: Paul Principal
+sn: Principal
+uid: PAUL_THE_PRINCIPAL
+userpassword: changeit
+homephone: 555-111-3333
+mail: paul.principal at shibboleth.net
+mail: paulprincipal at shibboleth.net
+description: test principal
+
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list