Darwin Felix - 2017-04-01

The Connection reset remaining name bug only exists in spnego-r8.jar

The bug has been fixed and is included in spnego-r9.jar

spnego-r9.jar also includes the following changes:

  • fixed 'Connection reset remaining name' bug in the LdapAccessControl class
  • added friendly null check message if property mis-configured
  • short-circuit loop if user disables uniqueness property
  • added UserInfo interface
  • changed the UserAccessControl interface and the SpnegoAccessControl
    interface by adding a new method named getUserInfo
  • implemented the getUserInfo method in the LdapAccessControl class

Take a look at the javadoc of the getUserInfo method in the LdapAccessControl class.
http://spnego.sourceforge.net/api/index.html

Two new optional properties/parameters have been introduced.

web.xml example

...
<init-param>
    <param-name>spnego.authz.user.info</param-name>
    <param-value>department,memberOf,displayName</param-value>
</init-param>
<init-param>
    <param-name>spnego.authz.ldap.user.filter</param-name>
    <param-value><![CDATA[(&(sAMAccountType=805306368)(sAMAccountName=%1$s))]]></param-value>
</init-param>
...

policy.spnego file example

...
spnego.authz.user.info=department,memberOf,displayName
spnego.authz.ldap.user.filter=(&(sAMAccountType=805306368)(sAMAccountName=%1$s))
...

These are case-sensitive.