Thread: [Cobricks-cvscommit] drehscheibe-in/src/de/tum/cobricks/user LdapUserHandlerMyTUM.java

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Update of /cvsroot/cobricks/drehscheibe-in/src/de/tum/cobricks/user
In directory sc8-pr-cvs4.sourceforge.net:/tmp/cvs-serv32061

Added Files:
	LdapUserHandlerMyTUM.java 
Log Message:

--- NEW FILE: LdapUserHandlerMyTUM.java ---
/*
 * Copyright (c) 2004 Cobricks Group. All rights reserved.
 *
 * This file is part of a free software package; you can redistribute
 * it and/or modify it under the terms of the Cobricks Software Licence;
 * either version 1.0 of the License, or (at your option) any later
 * version (see www.cobricks.org).
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 */

package de.tum.cobricks.user;

import java.util.*;
import javax.naming.*;
import javax.naming.directory.*;

import org.apache.log4j.Logger;

import org.cobricks.core.CoreManager;
import org.cobricks.core.util.LogUtil;
import org.cobricks.user.*;

/**
 * Basic functionality for a user handler that uses the 
 * Integratum/MyTUM authentication server.
 *
 * init() instantiates a DirContext object (with global security 
 * credentials - properties "*.ldap.security.principal" and 
 * "*.ldap.security.credentials") for searches
 *
 * handleUnknownUser() create a new user object and sets the 
 * attribute "user.EMAIL" (e.g. wo...@my...)
 *
 * handleCheckCredentials() authenticates a user object with the
 * Integratum/MyTUM auth. server. Since we only have "compare"
 * rights, the user handler cannot retrieve user attributes other
 * than the CN.
 * This method also checks whether the user's authOrganisationseinheit
 * contains "Informatik" and her authRolle is "tumMitarbeiter".
 * Of this is the case, the role mitarbeiter is set.
 * This test is done at every (successful) login.
 *
 * Properties for configuring this user handler:
 * user.domain.mytum.de.ldap.providerurl=ldap://auth.tum.de
 * user.domain.mytum.de.ldap.security.principal=cn=Inf-Dreh-DN1,ou=bindDNs,ou=auth,ou=integratum,dc=tum,dc=de
 * user.domain.mytum.de.ldap.security.credentials=<password>
 * user.domain.mytum.de.ldap.rootdn=ou=users,ou=data,ou=prod,ou=auth,ou=integratum,dc=tum,dc=de 
 *
 * @author   mic...@ac..., wo...@in...
 * @version  $Date: 2006/10/04 10:56:27 $
 */

public class LdapUserHandlerMyTUM
    implements UserHandler
{

    static Logger logger = Logger.getLogger(LdapUserHandler.class);

    protected CoreManager coreManager;
    protected UserManager userManager;

    protected String domain;

    protected Hashtable env;
    protected DirContext dirContext;

    protected String myCN ="";

    /**
     *
     */
    public void init(String domain, CoreManager coreManager)
        throws Exception
    {
        logger.info("initializing LdapUserHandlerMyTUM");
        this.domain = domain;

        this.coreManager = coreManager;
        this.userManager = (UserManager)
            coreManager.getComponentDirectory().getManager("userManager");

        env = System.getProperties();
        env.put(Context.INITIAL_CONTEXT_FACTORY,
                "com.sun.jndi.ldap.LdapCtxFactory");
        String providerurl =
            coreManager.getProperty("user.domain."+domain+".ldap.providerurl");
        if (providerurl == null) {
            logger.error("no provider url for LdapUserHandler for domain "
                         +domain);
            return;
        }
        env.put(Context.PROVIDER_URL, providerurl);

        /* specify authentication information */
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        String securityprincipal =
            coreManager.getProperty("user.domain."+domain
                                    +".ldap.security.principal");
        String securitycredentials =
            coreManager.getProperty("user.domain."+domain
                                    +".ldap.security.credentials");
        env.put(Context.SECURITY_PRINCIPAL, securityprincipal);
        env.put(Context.SECURITY_CREDENTIALS, securitycredentials);
        env.put(Context.SECURITY_PROTOCOL, "ssl");

        try {
            // specify the timeout to be 5 seconds
            env.put("com.sun.jndi.ldap.connect.timeout", "5000");
            dirContext = new InitialDirContext(env);
        } catch (Exception e) {
            logger.error(LogUtil.
                         ex("Failed initializing directory context.", e));
            throw e;
        }

        logger.debug("finished initializing LdapUserHandlerMyTUM");
    }

    /**
     *
     */
    public User handleUnknownUser(String userlogin, Object credentials)
    {
        logger.debug("begin handleUnknownUser");
        logger.debug("userlogin = "+userlogin);

        // At this time, no user attributes can be loaded from MyTUM server
        // Therefore, set only MyTUM Email address and create new user instance
        try
        {
           // Do not create user object if credentials are wrong
           if (! checkCredentials (userlogin, credentials.toString()))
           {
              logger.debug("No user object created, wrong credentials");
              return null;
           }

           Map attr = new HashMap();
           attr.put(User.EMAIL, userlogin);
           logger.debug("New user with user.EMAIL = "+userlogin);
           User user = userManager.createUser(userlogin, attr);
           user.setCredentials(userManager, credentials);

           return user;
        }
        catch (Exception e)
        {
           logger.error(LogUtil.ex("Failed in getUserAttrs("+userlogin+")", e));
        }
        return null;
    }

    /**
     * Load attributes from LDAP directory
     */

    // Does not work with MyTUM server, no rights to load attributes
    protected Map getUserAttrs(String userlogin)
    {
       Map result = new HashMap();
       return result;
    }

    /**
     *
     */
    public void handleGetUser(User user)
    {
    }

    /**
     *
     */
    public boolean handleCheckCredentials(User user, Object credentials) 
    {
        logger.debug("begin handleCheckCredentials");
        String userlogin = user.getUserLogin();

        logger.debug("userlogin =" + userlogin);

        if (! checkCredentials (userlogin, credentials.toString()))
           return false;

        // User is authenticated, check status (Mitarbeiter Informatik or not)
        // by invoking search method once again
        int userid = user.getUserId();

        // Delete Mitarbeiter role first
        AccessControl ac = userManager.getAccessControl();
        AccessRole ar = ac.getAccessRoleByName("mitarbeiter");
        int roleid = ar.getId();
        ac.removeUser(roleid, userid);
        logger.debug("Mitarbeiter role deleted");

        // Now search user
        String userbase = coreManager.getProperty("user.domain."+domain
                                    +".ldap.rootdn");

    	String filter ="(&(&(authlogin=" + userlogin + ")";
    	filter += "(&(authOrganisationseinheit=*Informatik*)(authRolle=tumMitarbeiter*))))";
    	logger.debug("filter = "+filter);
    	String cn="";
    	String[] returnAttribut = {"cn"};

    	//  Set up the search controls
    	SearchControls ctls = new SearchControls();
    	ctls.setReturningAttributes(returnAttribut);       // Return attrs
    	ctls.setSearchScope(SearchControls.SUBTREE_SCOPE); // 

    	// Invoke search method to retrieve CN
    	try
    	{
    	    NamingEnumeration answer = dirContext.search(userbase, filter, ctls);    

    	    while ( answer.hasMore())
    	    {
    	       SearchResult sr = (SearchResult)answer.next();    	           
    	       cn = sr.getName();

    	       logger.debug("cn =" + cn);

    	       // CN found -> Mitarbeiter
    	       if (cn.equals(myCN))
    	       {
                  // Set Mitarbeiter role
                  ac.addUser(roleid, userid, false);
                  logger.debug("Mitarbeiter role (re-)set");
    	       }
            }

            // CN not found with search filter => no Mitarbeiter
        }
        catch (Exception e) { logger.debug("Exception while searching DirContext"); }

        return true;
    }

    private boolean checkCredentials (String userlogin, String credentials)
    {
        // check authentication
        try
        {
           String userbase = coreManager.getProperty("user.domain."+domain
                                    +".ldap.rootdn");

    	   String filter ="(authlogin="+userlogin+")";    	           	       
    	   String[] returnAttribut = {"cn"};

    	   //  Set up the search controls
    	   SearchControls ctls = new SearchControls();
    	   ctls.setReturningAttributes(returnAttribut);       // Return attrs
    	   ctls.setSearchScope(SearchControls.SUBTREE_SCOPE); // 

    	   // Invoke search method to retrieve CN (needed for authentication)
    	   try
    	   {
    	       NamingEnumeration answer = dirContext.search(userbase, filter, ctls);    

    	       while ( answer.hasMore())
    	       {
    	    	   SearchResult sr = (SearchResult)answer.next();    	           
    	           myCN = sr.getName();
    	           logger.debug("CN= " + myCN);
               }
           }
           catch (Exception e) {}

           // New context to authenticate user
    	   try
    	   {
    	      Hashtable env = new Hashtable();

              env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

              String providerurl = coreManager.getProperty("user.domain."+domain+".ldap.providerurl");
              env.put(Context.PROVIDER_URL, providerurl);

              String bindDnUser=myCN+","+userbase;
	      env.put(Context.SECURITY_PRINCIPAL,bindDnUser);

	      env.put(Context.SECURITY_CREDENTIALS, credentials);
	      env.put(Context.SECURITY_AUTHENTICATION, "simple");
	      env.put(Context.SECURITY_PROTOCOL, "ssl");              

              DirContext ctxUser = new InitialDirContext(env);
   	   }
    	   catch (AuthenticationException au)
    	   {
    	      logger.debug("Userauthentication failed "+au.getMessage());    	    	   
    	      return false;
    	   }
    	}
        catch (Exception u)
        {
          logger.debug("Userauthentication failed "+u.getMessage());    	    	   
          return false;
        }

        return true;
    }
}

Thread: [Cobricks-cvscommit] drehscheibe-in/src/de/tum/cobricks/user LdapUserHandlerMyTUM.java

cobricks-cvscommit