Back to index...

	/*
	* Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package com.sun.security.auth.module;

	import java.security.AccessController;
	import java.net.SocketPermission;
	import java.security.Principal;
	import java.security.PrivilegedAction;
	import java.util.Arrays;
	import java.util.Hashtable;
	import java.util.Map;
	import java.util.ResourceBundle;
	import java.util.regex.Matcher;
	import java.util.regex.Pattern;
	import java.util.Set;

	import javax.naming.*;
	import javax.naming.directory.*;
	import javax.naming.ldap.*;
	import javax.security.auth.*;
	import javax.security.auth.callback.*;
	import javax.security.auth.login.*;
	import javax.security.auth.spi.*;

	import com.sun.security.auth.LdapPrincipal;
	import com.sun.security.auth.UserPrincipal;


	/**
	* This {@link LoginModule} performs LDAP-based authentication.
	* A username and password is verified against the corresponding user
	* credentials stored in an LDAP directory.
	* This module requires the supplied {@link CallbackHandler} to support a
	* {@link NameCallback} and a {@link PasswordCallback}.
	* If authentication is successful then a new {@link LdapPrincipal} is created
	* using the user's distinguished name and a new {@link UserPrincipal} is
	* created using the user's username and both are associated
	* with the current {@link Subject}.
	*
	* <p> This module operates in one of three modes: <i>search-first</i>,
	* <i>authentication-first</i> or <i>authentication-only</i>.
	* A mode is selected by specifying a particular set of options.
	*
	* <p> In search-first mode, the LDAP directory is searched to determine the
	* user's distinguished name and then authentication is attempted.
	* An (anonymous) search is performed using the supplied username in
	* conjunction with a specified search filter.
	* If successful then authentication is attempted using the user's
	* distinguished name and the supplied password.
	* To enable this mode, set the <code>userFilter</code> option and omit the
	* <code>authIdentity</code> option.
	* Use search-first mode when the user's distinguished name is not
	* known in advance.
	*
	* <p> In authentication-first mode, authentication is attempted using the
	* supplied username and password and then the LDAP directory is searched.
	* If authentication is successful then a search is performed using the
	* supplied username in conjunction with a specified search filter.
	* To enable this mode, set the <code>authIdentity</code> and the
	* <code>userFilter</code> options.
	* Use authentication-first mode when accessing an LDAP directory
	* that has been configured to disallow anonymous searches.
	*
	* <p> In authentication-only mode, authentication is attempted using the
	* supplied username and password. The LDAP directory is not searched because
	* the user's distinguished name is already known.
	* To enable this mode, set the <code>authIdentity</code> option to a valid
	* distinguished name and omit the <code>userFilter</code> option.
	* Use authentication-only mode when the user's distinguished name is
	* known in advance.
	*
	* <p> The following option is mandatory and must be specified in this
	* module's login {@link Configuration}:
	* <dl><dt></dt><dd>
	* <dl>
	* <dt> <code>userProvider=<b>ldap_urls</b></code>
	* </dt>
	* <dd> This option identifies the LDAP directory that stores user entries.
	* <b>ldap_urls</b> is a list of space-separated LDAP URLs
	* (<a href="http://www.ietf.org/rfc/rfc2255.txt">RFC 2255</a>)
	* that identifies the LDAP server to use and the position in
	* its directory tree where user entries are located.
	* When several LDAP URLs are specified then each is attempted,
	* in turn, until the first successful connection is established.
	* Spaces in the distinguished name component of the URL must be escaped
	* using the standard mechanism of percent character ('<code>%</code>')
	* followed by two hexadecimal digits (see {@link java.net.URI}).
	* Query components must also be omitted from the URL.
	*
	* <p>
	* Automatic discovery of the LDAP server via DNS
	* (<a href="http://www.ietf.org/rfc/rfc2782.txt">RFC 2782</a>)
	* is supported (once DNS has been configured to support such a service).
	* It is enabled by omitting the hostname and port number components from
	* the LDAP URL. </dd>
	* </dl></dl>
	*
	* <p> This module also recognizes the following optional {@link Configuration}
	* options:
	* <dl><dt></dt><dd>
	* <dl>
	* <dt> <code>userFilter=<b>ldap_filter</b></code> </dt>
	* <dd> This option specifies the search filter to use to locate a user's
	* entry in the LDAP directory. It is used to determine a user's
	* distinguished name.
	* <code><b>ldap_filter</b></code> is an LDAP filter string
	* (<a href="http://www.ietf.org/rfc/rfc2254.txt">RFC 2254</a>).
	* If it contains the special token "<code><b>{USERNAME}</b></code>"
	* then that token will be replaced with the supplied username value
	* before the filter is used to search the directory. </dd>
	*
	* <dt> <code>authIdentity=<b>auth_id</b></code> </dt>
	* <dd> This option specifies the identity to use when authenticating a user
	* to the LDAP directory.
	* <code><b>auth_id</b></code> may be an LDAP distinguished name string
	* (<a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a>) or some
	* other string name.
	* It must contain the special token "<code><b>{USERNAME}</b></code>"
	* which will be replaced with the supplied username value before the
	* name is used for authentication.
	* Note that if this option does not contain a distinguished name then
	* the <code>userFilter</code> option must also be specified. </dd>
	*
	* <dt> <code>authzIdentity=<b>authz_id</b></code> </dt>
	* <dd> This option specifies an authorization identity for the user.
	* <code><b>authz_id</b></code> is any string name.
	* If it comprises a single special token with curly braces then
	* that token is treated as a attribute name and will be replaced with a
	* single value of that attribute from the user's LDAP entry.
	* If the attribute cannot be found then the option is ignored.
	* When this option is supplied and the user has been successfully
	* authenticated then an additional {@link UserPrincipal}
	* is created using the authorization identity and it is associated with
	* the current {@link Subject}. </dd>
	*
	* <dt> <code>useSSL</code> </dt>
	* <dd> if <code>false</code>, this module does not establish an SSL connection
	* to the LDAP server before attempting authentication. SSL is used to
	* protect the privacy of the user's password because it is transmitted
	* in the clear over LDAP.
	* By default, this module uses SSL. </dd>
	*
	* <dt> <code>useFirstPass</code> </dt>
	* <dd> if <code>true</code>, this module retrieves the username and password
	* from the module's shared state, using "javax.security.auth.login.name"
	* and "javax.security.auth.login.password" as the respective keys. The
	* retrieved values are used for authentication. If authentication fails,
	* no attempt for a retry is made, and the failure is reported back to
	* the calling application.</dd>
	*
	* <dt> <code>tryFirstPass</code> </dt>
	* <dd> if <code>true</code>, this module retrieves the username and password
	* from the module's shared state, using "javax.security.auth.login.name"
	* and "javax.security.auth.login.password" as the respective keys. The
	* retrieved values are used for authentication. If authentication fails,
	* the module uses the {@link CallbackHandler} to retrieve a new username
	* and password, and another attempt to authenticate is made. If the
	* authentication fails, the failure is reported back to the calling
	* application.</dd>
	*
	* <dt> <code>storePass</code> </dt>
	* <dd> if <code>true</code>, this module stores the username and password
	* obtained from the {@link CallbackHandler} in the module's shared state,
	* using
	* "javax.security.auth.login.name" and
	* "javax.security.auth.login.password" as the respective keys. This is
	* not performed if existing values already exist for the username and
	* password in the shared state, or if authentication fails.</dd>
	*
	* <dt> <code>clearPass</code> </dt>
	* <dd> if <code>true</code>, this module clears the username and password
	* stored in the module's shared state after both phases of authentication
	* (login and commit) have completed.</dd>
	*
	* <dt> <code>debug</code> </dt>
	* <dd> if <code>true</code>, debug messages are displayed on the standard
	* output stream.
	* </dl>
	* </dl>
	*
	* <p>
	* Arbitrary
	* <a href="{@docRoot}/../../../../../technotes/guides/jndi/jndi-ldap-gl.html#PROP">JNDI properties</a>
	* may also be specified in the {@link Configuration}.
	* They are added to the environment and passed to the LDAP provider.
	* Note that the following four JNDI properties are set by this module directly
	* and are ignored if also present in the configuration:
	* <ul>
	* <li> <code>java.naming.provider.url</code>
	* <li> <code>java.naming.security.principal</code>
	* <li> <code>java.naming.security.credentials</code>
	* <li> <code>java.naming.security.protocol</code>
	* </ul>
	*
	* <p>
	* Three sample {@link Configuration}s are shown below.
	* The first one activates search-first mode. It identifies the LDAP server
	* and specifies that users' entries be located by their <code>uid</code> and
	* <code>objectClass</code> attributes. It also specifies that an identity
	* based on the user's <code>employeeNumber</code> attribute should be created.
	* The second one activates authentication-first mode. It requests that the
	* LDAP server be located dynamically, that authentication be performed using
	* the supplied username directly but without the protection of SSL and that
	* users' entries be located by one of three naming attributes and their
	* <code>objectClass</code> attribute.
	* The third one activates authentication-only mode. It identifies alternative
	* LDAP servers, it specifies the distinguished name to use for
	* authentication and a fixed identity to use for authorization. No directory
	* search is performed.
	*
	* <pre>
	*
	* ExampleApplication {
	* com.sun.security.auth.module.LdapLoginModule REQUIRED
	* userProvider="ldap://ldap-svr/ou=people,dc=example,dc=com"
	* userFilter="(&(uid={USERNAME})(objectClass=inetOrgPerson))"
	* authzIdentity="{EMPLOYEENUMBER}"
	* debug=true;
	* };
	*
	* ExampleApplication {
	* com.sun.security.auth.module.LdapLoginModule REQUIRED
	* userProvider="ldap:///cn=users,dc=example,dc=com"
	* authIdentity="{USERNAME}"
	* userFilter="(&(\|(samAccountName={USERNAME})(userPrincipalName={USERNAME})(cn={USERNAME}))(objectClass=user))"
	* useSSL=false
	* debug=true;
	* };
	*
	* ExampleApplication {
	* com.sun.security.auth.module.LdapLoginModule REQUIRED
	* userProvider="ldap://ldap-svr1 ldap://ldap-svr2"
	* authIdentity="cn={USERNAME},ou=people,dc=example,dc=com"
	* authzIdentity="staff"
	* debug=true;
	* };
	*
	* </pre>
	*
	* <dl>
	* <dt><b>Note:</b> </dt>
	* <dd>When a {@link SecurityManager} is active then an application
	* that creates a {@link LoginContext} and uses a {@link LoginModule}
	* must be granted certain permissions.
	* <p>
	* If the application creates a login context using an <em>installed</em>
	* {@link Configuration} then the application must be granted the
	* {@link AuthPermission} to create login contexts.
	* For example, the following security policy allows an application in
	* the user's current directory to instantiate <em>any</em> login context:
	* <pre>
	*
	* grant codebase "file:${user.dir}/" {
	* permission javax.security.auth.AuthPermission "createLoginContext.*";
	* };
	* </pre>
	*
	* Alternatively, if the application creates a login context using a
	* <em>caller-specified</em> {@link Configuration} then the application
	* must be granted the permissions required by the {@link LoginModule}.
	* <em>This</em> module requires the following two permissions:
	* <p>
	* <ul>
	* <li> The {@link SocketPermission} to connect to an LDAP server.
	* <li> The {@link AuthPermission} to modify the set of {@link Principal}s
	* associated with a {@link Subject}.
	* </ul>
	* <p>
	* For example, the following security policy grants an application in the
	* user's current directory all the permissions required by this module:
	* <pre>
	*
	* grant codebase "file:${user.dir}/" {
	* permission java.net.SocketPermission "*:389", "connect";
	* permission java.net.SocketPermission "*:636", "connect";
	* permission javax.security.auth.AuthPermission "modifyPrincipals";
	* };
	* </pre>
	* </dd>
	* </dl>
	*
	* @since 1.6
	*/
	@jdk.Exported
	public class LdapLoginModule implements LoginModule {

	// Use the default classloader for this class to load the prompt strings.
	private static final ResourceBundle rb = AccessController.doPrivileged(
	new PrivilegedAction<ResourceBundle>() {
	public ResourceBundle run() {
	return ResourceBundle.getBundle(
	"sun.security.util.AuthResources");
	}
	}
	);

	// Keys to retrieve the stored username and password
	private static final String USERNAME_KEY = "javax.security.auth.login.name";
	private static final String PASSWORD_KEY =
	"javax.security.auth.login.password";

	// Option names
	private static final String USER_PROVIDER = "userProvider";
	private static final String USER_FILTER = "userFilter";
	private static final String AUTHC_IDENTITY = "authIdentity";
	private static final String AUTHZ_IDENTITY = "authzIdentity";

	// Used for the username token replacement
	private static final String USERNAME_TOKEN = "{USERNAME}";
	private static final Pattern USERNAME_PATTERN =
	Pattern.compile("\\{USERNAME\\}");

	// Configurable options
	private String userProvider;
	private String userFilter;
	private String authcIdentity;
	private String authzIdentity;
	private String authzIdentityAttr = null;
	private boolean useSSL = true;
	private boolean authFirst = false;
	private boolean authOnly = false;
	private boolean useFirstPass = false;
	private boolean tryFirstPass = false;
	private boolean storePass = false;
	private boolean clearPass = false;
	private boolean debug = false;

	// Authentication status
	private boolean succeeded = false;
	private boolean commitSucceeded = false;

	// Supplied username and password
	private String username;
	private char[] password;

	// User's identities
	private LdapPrincipal ldapPrincipal;
	private UserPrincipal userPrincipal;
	private UserPrincipal authzPrincipal;

	// Initial state
	private Subject subject;
	private CallbackHandler callbackHandler;
	private Map<String, Object> sharedState;
	private Map<String, ?> options;
	private LdapContext ctx;
	private Matcher identityMatcher = null;
	private Matcher filterMatcher = null;
	private Hashtable<String, Object> ldapEnvironment;
	private SearchControls constraints = null;

	/**
	* Initialize this <code>LoginModule</code>.
	*
	* @param subject the <code>Subject</code> to be authenticated.
	* @param callbackHandler a <code>CallbackHandler</code> to acquire the
	* username and password.
	* @param sharedState shared <code>LoginModule</code> state.
	* @param options options specified in the login
	* <code>Configuration</code> for this particular
	* <code>LoginModule</code>.
	*/
	// Unchecked warning from (Map<String, Object>)sharedState is safe
	// since javax.security.auth.login.LoginContext passes a raw HashMap.
	@SuppressWarnings("unchecked")
	public void initialize(Subject subject, CallbackHandler callbackHandler,
	Map<String, ?> sharedState, Map<String, ?> options) {

	this.subject = subject;
	this.callbackHandler = callbackHandler;
	this.sharedState = (Map<String, Object>)sharedState;
	this.options = options;

	ldapEnvironment = new Hashtable<String, Object>(9);
	ldapEnvironment.put(Context.INITIAL_CONTEXT_FACTORY,
	"com.sun.jndi.ldap.LdapCtxFactory");

	// Add any JNDI properties to the environment
	for (String key : options.keySet()) {
	if (key.indexOf(".") > -1) {
	ldapEnvironment.put(key, options.get(key));
	}
	}

	// initialize any configured options

	userProvider = (String)options.get(USER_PROVIDER);
	if (userProvider != null) {
	ldapEnvironment.put(Context.PROVIDER_URL, userProvider);
	}

	authcIdentity = (String)options.get(AUTHC_IDENTITY);
	if (authcIdentity != null &&
	(authcIdentity.indexOf(USERNAME_TOKEN) != -1)) {
	identityMatcher = USERNAME_PATTERN.matcher(authcIdentity);
	}

	userFilter = (String)options.get(USER_FILTER);
	if (userFilter != null) {
	if (userFilter.indexOf(USERNAME_TOKEN) != -1) {
	filterMatcher = USERNAME_PATTERN.matcher(userFilter);
	}
	constraints = new SearchControls();
	constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
	constraints.setReturningAttributes(new String[0]); //return no attrs
	}

	authzIdentity = (String)options.get(AUTHZ_IDENTITY);
	if (authzIdentity != null &&
	authzIdentity.startsWith("{") && authzIdentity.endsWith("}")) {
	if (constraints != null) {
	authzIdentityAttr =
	authzIdentity.substring(1, authzIdentity.length() - 1);
	constraints.setReturningAttributes(
	new String[]{authzIdentityAttr});
	}
	authzIdentity = null; // set later, from the specified attribute
	}

	// determine mode
	if (authcIdentity != null) {
	if (userFilter != null) {
	authFirst = true; // authentication-first mode
	} else {
	authOnly = true; // authentication-only mode
	}
	}

	if ("false".equalsIgnoreCase((String)options.get("useSSL"))) {
	useSSL = false;
	ldapEnvironment.remove(Context.SECURITY_PROTOCOL);
	} else {
	ldapEnvironment.put(Context.SECURITY_PROTOCOL, "ssl");
	}

	tryFirstPass =
	"true".equalsIgnoreCase((String)options.get("tryFirstPass"));

	useFirstPass =
	"true".equalsIgnoreCase((String)options.get("useFirstPass"));

	storePass = "true".equalsIgnoreCase((String)options.get("storePass"));

	clearPass = "true".equalsIgnoreCase((String)options.get("clearPass"));

	debug = "true".equalsIgnoreCase((String)options.get("debug"));

	if (debug) {
	if (authFirst) {
	System.out.println("\t\t[LdapLoginModule] " +
	"authentication-first mode; " +
	(useSSL ? "SSL enabled" : "SSL disabled"));
	} else if (authOnly) {
	System.out.println("\t\t[LdapLoginModule] " +
	"authentication-only mode; " +
	(useSSL ? "SSL enabled" : "SSL disabled"));
	} else {
	System.out.println("\t\t[LdapLoginModule] " +
	"search-first mode; " +
	(useSSL ? "SSL enabled" : "SSL disabled"));
	}
	}
	}

	/**
	* Begin user authentication.
	*
	* <p> Acquire the user's credentials and verify them against the
	* specified LDAP directory.
	*
	* @return true always, since this <code>LoginModule</code>
	* should not be ignored.
	* @exception FailedLoginException if the authentication fails.
	* @exception LoginException if this <code>LoginModule</code>
	* is unable to perform the authentication.
	*/
	public boolean login() throws LoginException {

	if (userProvider == null) {
	throw new LoginException
	("Unable to locate the LDAP directory service");
	}

	if (debug) {
	System.out.println("\t\t[LdapLoginModule] user provider: " +
	userProvider);
	}

	// attempt the authentication
	if (tryFirstPass) {

	try {
	// attempt the authentication by getting the
	// username and password from shared state
	attemptAuthentication(true);

	// authentication succeeded
	succeeded = true;
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"tryFirstPass succeeded");
	}
	return true;

	} catch (LoginException le) {
	// authentication failed -- try again below by prompting
	cleanState();
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"tryFirstPass failed: " + le.toString());
	}
	}

	} else if (useFirstPass) {

	try {
	// attempt the authentication by getting the
	// username and password from shared state
	attemptAuthentication(true);

	// authentication succeeded
	succeeded = true;
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"useFirstPass succeeded");
	}
	return true;

	} catch (LoginException le) {
	// authentication failed
	cleanState();
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"useFirstPass failed");
	}
	throw le;
	}
	}

	// attempt the authentication by prompting for the username and pwd
	try {
	attemptAuthentication(false);

	// authentication succeeded
	succeeded = true;
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"authentication succeeded");
	}
	return true;

	} catch (LoginException le) {
	cleanState();
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"authentication failed");
	}
	throw le;
	}
	}

	/**
	* Complete user authentication.
	*
	* <p> This method is called if the LoginContext's
	* overall authentication succeeded
	* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
	* succeeded).
	*
	* <p> If this LoginModule's own authentication attempt
	* succeeded (checked by retrieving the private state saved by the
	* <code>login</code> method), then this method associates an
	* <code>LdapPrincipal</code> and one or more <code>UserPrincipal</code>s
	* with the <code>Subject</code> located in the
	* <code>LoginModule</code>. If this LoginModule's own
	* authentication attempted failed, then this method removes
	* any state that was originally saved.
	*
	* @exception LoginException if the commit fails
	* @return true if this LoginModule's own login and commit
	* attempts succeeded, or false otherwise.
	*/
	public boolean commit() throws LoginException {

	if (succeeded == false) {
	return false;
	} else {
	if (subject.isReadOnly()) {
	cleanState();
	throw new LoginException ("Subject is read-only");
	}
	// add Principals to the Subject
	Set<Principal> principals = subject.getPrincipals();
	if (! principals.contains(ldapPrincipal)) {
	principals.add(ldapPrincipal);
	}
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"added LdapPrincipal \"" +
	ldapPrincipal +
	"\" to Subject");
	}

	if (! principals.contains(userPrincipal)) {
	principals.add(userPrincipal);
	}
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"added UserPrincipal \"" +
	userPrincipal +
	"\" to Subject");
	}

	if (authzPrincipal != null &&
	(! principals.contains(authzPrincipal))) {
	principals.add(authzPrincipal);

	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"added UserPrincipal \"" +
	authzPrincipal +
	"\" to Subject");
	}
	}
	}
	// in any case, clean out state
	cleanState();
	commitSucceeded = true;
	return true;
	}

	/**
	* Abort user authentication.
	*
	* <p> This method is called if the overall authentication failed.
	* (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules
	* did not succeed).
	*
	* <p> If this LoginModule's own authentication attempt
	* succeeded (checked by retrieving the private state saved by the
	* <code>login</code> and <code>commit</code> methods),
	* then this method cleans up any state that was originally saved.
	*
	* @exception LoginException if the abort fails.
	* @return false if this LoginModule's own login and/or commit attempts
	* failed, and true otherwise.
	*/
	public boolean abort() throws LoginException {
	if (debug)
	System.out.println("\t\t[LdapLoginModule] " +
	"aborted authentication");

	if (succeeded == false) {
	return false;
	} else if (succeeded == true && commitSucceeded == false) {

	// Clean out state
	succeeded = false;
	cleanState();

	ldapPrincipal = null;
	userPrincipal = null;
	authzPrincipal = null;
	} else {
	// overall authentication succeeded and commit succeeded,
	// but someone else's commit failed
	logout();
	}
	return true;
	}

	/**
	* Logout a user.
	*
	* <p> This method removes the Principals
	* that were added by the <code>commit</code> method.
	*
	* @exception LoginException if the logout fails.
	* @return true in all cases since this <code>LoginModule</code>
	* should not be ignored.
	*/
	public boolean logout() throws LoginException {
	if (subject.isReadOnly()) {
	cleanState();
	throw new LoginException ("Subject is read-only");
	}
	Set<Principal> principals = subject.getPrincipals();
	principals.remove(ldapPrincipal);
	principals.remove(userPrincipal);
	if (authzIdentity != null) {
	principals.remove(authzPrincipal);
	}

	// clean out state
	cleanState();
	succeeded = false;
	commitSucceeded = false;

	ldapPrincipal = null;
	userPrincipal = null;
	authzPrincipal = null;

	if (debug) {
	System.out.println("\t\t[LdapLoginModule] logged out Subject");
	}
	return true;
	}

	/**
	* Attempt authentication
	*
	* @param getPasswdFromSharedState boolean that tells this method whether
	* to retrieve the password from the sharedState.
	* @exception LoginException if the authentication attempt fails.
	*/
	private void attemptAuthentication(boolean getPasswdFromSharedState)
	throws LoginException {

	// first get the username and password
	getUsernamePassword(getPasswdFromSharedState);

	if (password == null \|\| password.length == 0) {
	throw (LoginException)
	new FailedLoginException("No password was supplied");
	}

	String dn = "";

	if (authFirst \|\| authOnly) {

	String id =
	replaceUsernameToken(identityMatcher, authcIdentity, username);

	// Prepare to bind using user's username and password
	ldapEnvironment.put(Context.SECURITY_CREDENTIALS, password);
	ldapEnvironment.put(Context.SECURITY_PRINCIPAL, id);

	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"attempting to authenticate user: " + username);
	}

	try {
	// Connect to the LDAP server (using simple bind)
	ctx = new InitialLdapContext(ldapEnvironment, null);

	} catch (NamingException e) {
	throw (LoginException)
	new FailedLoginException("Cannot bind to LDAP server")
	.initCause(e);
	}

	// Authentication has succeeded

	// Locate the user's distinguished name
	if (userFilter != null) {
	dn = findUserDN(ctx);
	} else {
	dn = id;
	}

	} else {

	try {
	// Connect to the LDAP server (using anonymous bind)
	ctx = new InitialLdapContext(ldapEnvironment, null);

	} catch (NamingException e) {
	throw (LoginException)
	new FailedLoginException("Cannot connect to LDAP server")
	.initCause(e);
	}

	// Locate the user's distinguished name
	dn = findUserDN(ctx);

	try {

	// Prepare to bind using user's distinguished name and password
	ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");
	ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, dn);
	ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);

	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"attempting to authenticate user: " + username);
	}
	// Connect to the LDAP server (using simple bind)
	ctx.reconnect(null);

	// Authentication has succeeded

	} catch (NamingException e) {
	throw (LoginException)
	new FailedLoginException("Cannot bind to LDAP server")
	.initCause(e);
	}
	}

	// Save input as shared state only if authentication succeeded
	if (storePass &&
	!sharedState.containsKey(USERNAME_KEY) &&
	!sharedState.containsKey(PASSWORD_KEY)) {
	sharedState.put(USERNAME_KEY, username);
	sharedState.put(PASSWORD_KEY, password);
	}

	// Create the user principals
	userPrincipal = new UserPrincipal(username);
	if (authzIdentity != null) {
	authzPrincipal = new UserPrincipal(authzIdentity);
	}

	try {

	ldapPrincipal = new LdapPrincipal(dn);

	} catch (InvalidNameException e) {
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"cannot create LdapPrincipal: bad DN");
	}
	throw (LoginException)
	new FailedLoginException("Cannot create LdapPrincipal")
	.initCause(e);
	}
	}

	/**
	* Search for the user's entry.
	* Determine the distinguished name of the user's entry and optionally
	* an authorization identity for the user.
	*
	* @param ctx an LDAP context to use for the search
	* @return the user's distinguished name or an empty string if none
	* was found.
	* @exception LoginException if the user's entry cannot be found.
	*/
	private String findUserDN(LdapContext ctx) throws LoginException {

	String userDN = "";

	// Locate the user's LDAP entry
	if (userFilter != null) {
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"searching for entry belonging to user: " + username);
	}
	} else {
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] " +
	"cannot search for entry belonging to user: " + username);
	}
	throw (LoginException)
	new FailedLoginException("Cannot find user's LDAP entry");
	}

	try {
	// Sanitize username and substitute into LDAP filter
	String canonicalUserFilter =
	replaceUsernameToken(filterMatcher, userFilter,
	escapeUsernameChars());

	NamingEnumeration<SearchResult> results =
	ctx.search("", canonicalUserFilter, constraints);

	// Extract the distinguished name of the user's entry
	// (Use the first entry if more than one is returned)
	if (results.hasMore()) {
	SearchResult entry = results.next();
	userDN = entry.getNameInNamespace();

	if (debug) {
	System.out.println("\t\t[LdapLoginModule] found entry: " +
	userDN);
	}

	// Extract a value from user's authorization identity attribute
	if (authzIdentityAttr != null) {
	Attribute attr =
	entry.getAttributes().get(authzIdentityAttr);
	if (attr != null) {
	Object val = attr.get();
	if (val instanceof String) {
	authzIdentity = (String) val;
	}
	}
	}

	results.close();

	} else {
	// Bad username
	if (debug) {
	System.out.println("\t\t[LdapLoginModule] user's entry " +
	"not found");
	}
	}

	} catch (NamingException e) {
	// ignore
	}

	if (userDN.equals("")) {
	throw (LoginException)
	new FailedLoginException("Cannot find user's LDAP entry");
	} else {
	return userDN;
	}
	}

	/**
	* Modify the supplied username to encode characters that must be escaped
	* according to RFC 4515: LDAP: String Representation of Search Filters.
	*
	* The following characters are encoded as a backslash "\" (ASCII 0x5c)
	* followed by the two hexadecimal digits representing the value of the
	* escaped character:
	* '*' (ASCII 0x2a)
	* '(' (ASCII 0x28)
	* ')' (ASCII 0x29)
	* '\' (ASCII 0x5c)
	* '\0'(ASCII 0x00)
	*
	* @return the modified username with its characters escaped as needed
	*/
	private String escapeUsernameChars() {
	int len = username.length();
	StringBuilder escapedUsername = new StringBuilder(len + 16);

	for (int i = 0; i < len; i++) {
	char c = username.charAt(i);
	switch (c) {
	case '*':
	escapedUsername.append("\\\\2A");
	break;
	case '(':
	escapedUsername.append("\\\\28");
	break;
	case ')':
	escapedUsername.append("\\\\29");
	break;
	case '\\':
	escapedUsername.append("\\\\5C");
	break;
	case '\0':
	escapedUsername.append("\\\\00");
	break;
	default:
	escapedUsername.append(c);
	}
	}

	return escapedUsername.toString();
	}


	/**
	* Replace the username token
	*
	* @param matcher the replacement pattern
	* @param string the target string
	* @param username the supplied username
	* @return the modified string
	*/
	private String replaceUsernameToken(Matcher matcher, String string,
	String username) {
	return matcher != null ? matcher.replaceAll(username) : string;
	}

	/**
	* Get the username and password.
	* This method does not return any value.
	* Instead, it sets global name and password variables.
	*
	* <p> Also note that this method will set the username and password
	* values in the shared state in case subsequent LoginModules
	* want to use them via use/tryFirstPass.
	*
	* @param getPasswdFromSharedState boolean that tells this method whether
	* to retrieve the password from the sharedState.
	* @exception LoginException if the username/password cannot be acquired.
	*/
	private void getUsernamePassword(boolean getPasswdFromSharedState)
	throws LoginException {

	if (getPasswdFromSharedState) {
	// use the password saved by the first module in the stack
	username = (String)sharedState.get(USERNAME_KEY);
	password = (char[])sharedState.get(PASSWORD_KEY);
	return;
	}

	// prompt for a username and password
	if (callbackHandler == null)
	throw new LoginException("No CallbackHandler available " +
	"to acquire authentication information from the user");

	Callback[] callbacks = new Callback[2];
	callbacks[0] = new NameCallback(rb.getString("username."));
	callbacks[1] = new PasswordCallback(rb.getString("password."), false);

	try {
	callbackHandler.handle(callbacks);
	username = ((NameCallback)callbacks[0]).getName();
	char[] tmpPassword = ((PasswordCallback)callbacks[1]).getPassword();
	password = new char[tmpPassword.length];
	System.arraycopy(tmpPassword, 0,
	password, 0, tmpPassword.length);
	((PasswordCallback)callbacks[1]).clearPassword();

	} catch (java.io.IOException ioe) {
	throw new LoginException(ioe.toString());

	} catch (UnsupportedCallbackException uce) {
	throw new LoginException("Error: " + uce.getCallback().toString() +
	" not available to acquire authentication information" +
	" from the user");
	}
	}

	/**
	* Clean out state because of a failed authentication attempt
	*/
	private void cleanState() {
	username = null;
	if (password != null) {
	Arrays.fill(password, ' ');
	password = null;
	}
	try {
	if (ctx != null) {
	ctx.close();
	}
	} catch (NamingException e) {
	// ignore
	}
	ctx = null;

	if (clearPass) {
	sharedState.remove(USERNAME_KEY);
	sharedState.remove(PASSWORD_KEY);
	}
	}
	}

Back to index...