summaryrefslogtreecommitdiffstats
path: root/pki/base/common/src/com/netscape/cms/authentication/PortalEnroll.java
diff options
context:
space:
mode:
Diffstat (limited to 'pki/base/common/src/com/netscape/cms/authentication/PortalEnroll.java')
-rw-r--r--pki/base/common/src/com/netscape/cms/authentication/PortalEnroll.java307
1 files changed, 143 insertions, 164 deletions
diff --git a/pki/base/common/src/com/netscape/cms/authentication/PortalEnroll.java b/pki/base/common/src/com/netscape/cms/authentication/PortalEnroll.java
index 74a5392a1..56c8739a8 100644
--- a/pki/base/common/src/com/netscape/cms/authentication/PortalEnroll.java
+++ b/pki/base/common/src/com/netscape/cms/authentication/PortalEnroll.java
@@ -17,6 +17,7 @@
// --- END COPYRIGHT BLOCK ---
package com.netscape.cms.authentication;
+
// ldap java sdk
import java.util.Enumeration;
import java.util.Locale;
@@ -48,25 +49,26 @@ import com.netscape.certsrv.ldap.ELdapException;
import com.netscape.certsrv.ldap.ILdapConnFactory;
import com.netscape.certsrv.logging.ILogger;
+
/**
* uid/pwd directory based authentication manager
* <P>
- *
+ *
* @version $Revision$, $Date$
*/
public class PortalEnroll extends DirBasedAuthentication {
/* configuration parameter keys */
- protected static final String PROP_LDAPAUTH = "ldapauth";
- protected static final String PROP_AUTHTYPE = "authtype";
- protected static final String PROP_BINDDN = "bindDN";
- protected static final String PROP_BINDPW = "bindPW";
- protected static final String PROP_LDAPCONN = "ldapconn";
- protected static final String PROP_HOST = "host";
- protected static final String PROP_PORT = "port";
- protected static final String PROP_SECURECONN = "secureConn";
- protected static final String PROP_VERSION = "version";
- protected static final String PROP_OBJECTCLASS = "objectclass";
+ protected static final String PROP_LDAPAUTH = "ldapauth";
+ protected static final String PROP_AUTHTYPE = "authtype";
+ protected static final String PROP_BINDDN = "bindDN";
+ protected static final String PROP_BINDPW = "bindPW";
+ protected static final String PROP_LDAPCONN = "ldapconn";
+ protected static final String PROP_HOST = "host";
+ protected static final String PROP_PORT = "port";
+ protected static final String PROP_SECURECONN = "secureConn";
+ protected static final String PROP_VERSION = "version";
+ protected static final String PROP_OBJECTCLASS = "objectclass";
/* required credentials to authenticate. uid and pwd are strings. */
public static final String CRED_UID = "uid";
@@ -78,77 +80,83 @@ public class PortalEnroll extends DirBasedAuthentication {
private String mObjectClass = null;
private String mBindDN = null;
private String mBaseDN = null;
- private ILdapConnFactory mLdapFactory = null;
- private LDAPConnection mLdapConn = null;
+ private ILdapConnFactory mLdapFactory = null;
+ private LDAPConnection mLdapConn = null;
// contains all nested superiors' required attrs in the form of a
- // vector of "required" attributes in Enumeration
+ // vector of "required" attributes in Enumeration
Vector mRequiredAttrs = null;
-
+
// contains all nested superiors' optional attrs in the form of a
- // vector of "optional" attributes in Enumeration
+ // vector of "optional" attributes in Enumeration
Vector mOptionalAttrs = null;
// contains all the objclasses, including superiors and itself
Vector mObjClasses = null;
-
- /*
- * Holds configuration parameters accepted by this implementation. This list
- * is passed to the configuration console so configuration for instances of
- * this implementation can be configured through the console.
+
+ /* Holds configuration parameters accepted by this implementation.
+ * This list is passed to the configuration console so configuration
+ * for instances of this implementation can be configured through the
+ * console.
*/
- protected static String[] mConfigParams = new String[] { PROP_DNPATTERN,
- "ldap.ldapconn.host", "ldap.ldapconn.port",
- "ldap.ldapconn.secureConn", "ldap.ldapconn.version",
- "ldap.ldapauth.bindDN", "ldap.ldapauth.bindPWPrompt",
- "ldap.ldapauth.clientCertNickname", "ldap.ldapauth.authtype",
- "ldap.basedn", "ldap.objectclass", "ldap.minConns",
- "ldap.maxConns", };
-
+ protected static String[] mConfigParams =
+ new String[] {
+ PROP_DNPATTERN,
+ "ldap.ldapconn.host",
+ "ldap.ldapconn.port",
+ "ldap.ldapconn.secureConn",
+ "ldap.ldapconn.version",
+ "ldap.ldapauth.bindDN",
+ "ldap.ldapauth.bindPWPrompt",
+ "ldap.ldapauth.clientCertNickname",
+ "ldap.ldapauth.authtype",
+ "ldap.basedn",
+ "ldap.objectclass",
+ "ldap.minConns",
+ "ldap.maxConns",
+ };
+
/**
* Default constructor, initialization must follow.
*/
- public PortalEnroll() throws EBaseException {
+ public PortalEnroll()
+ throws EBaseException {
super();
}
/**
* Initializes the PortalEnrollment auth manager.
* <p>
- *
* @param name - The name for this authentication manager instance.
* @param implName - The name of the authentication manager plugin.
* @param config - The configuration store for this instance.
* @exception EBaseException If an error occurs during initialization.
*/
public void init(String name, String implName, IConfigStore config)
- throws EBaseException {
+ throws EBaseException {
super.init(name, implName, config);
-
+
/* Get Bind DN for directory server */
mConfig = mLdapConfig.getSubStore(PROP_LDAPAUTH);
mBindDN = mConfig.getString(PROP_BINDDN);
- if ((mBindDN == null) || (mBindDN.length() == 0) || (mBindDN == ""))
- throw new EPropertyNotFound(CMS.getUserMessage(
- "CMS_BASE_GET_PROPERTY_FAILED", "binddn"));
-
- /* Get Bind DN for directory server */
+ if ( (mBindDN == null) || (mBindDN.length() == 0) || (mBindDN == ""))
+ throw new EPropertyNotFound(CMS.getUserMessage("CMS_BASE_GET_PROPERTY_FAILED", "binddn"));
+
+ /* Get Bind DN for directory server */
mBaseDN = mLdapConfig.getString(PROP_BASEDN);
if ((mBaseDN == null) || (mBaseDN.length() == 0) || (mBaseDN == ""))
- throw new EPropertyNotFound(CMS.getUserMessage(
- "CMS_BASE_GET_PROPERTY_FAILED", "basedn"));
-
- /* Get Object clase name for enrollment */
+ throw new EPropertyNotFound(CMS.getUserMessage("CMS_BASE_GET_PROPERTY_FAILED", "basedn"));
+
+ /* Get Object clase name for enrollment */
mObjectClass = mLdapConfig.getString(PROP_OBJECTCLASS);
- if (mObjectClass == null || mObjectClass.length() == 0)
- throw new EPropertyNotFound(CMS.getUserMessage(
- "CMS_BASE_GET_PROPERTY_FAILED", "objectclass"));
+ if (mObjectClass == null || mObjectClass.length() == 0)
+ throw new EPropertyNotFound(CMS.getUserMessage("CMS_BASE_GET_PROPERTY_FAILED", "objectclass"));
- /* Get connect parameter */
+ /* Get connect parameter */
mLdapFactory = CMS.getLdapBoundConnFactory();
mLdapFactory.init(mLdapConfig);
mLdapConn = mLdapFactory.getConn();
-
+
log(ILogger.LL_INFO, CMS.getLogMessage("CMS_AUTH_PORTAL_INIT"));
}
@@ -158,53 +166,48 @@ public class PortalEnroll extends DirBasedAuthentication {
* @param authCreds The authentication credentials.
* @return The user's ldap entry dn.
* @exception EInvalidCredentials If the uid and password are not valid
- * @exception EBaseException If an internal error occurs.
+ * @exception EBaseException If an internal error occurs.
*/
- protected String authenticate(LDAPConnection conn,
- IAuthCredentials authCreds, AuthToken token) throws EBaseException {
+ protected String authenticate(LDAPConnection conn,
+ IAuthCredentials authCreds,
+ AuthToken token)
+ throws EBaseException {
String uid = null;
String pwd = null;
String dn = null;
argblk = authCreds.getArgBlock();
-
+
// authenticate by binding to ldap server with password.
try {
// get the uid.
uid = (String) authCreds.get(CRED_UID);
if (uid == null) {
- throw new EMissingCredential(CMS.getUserMessage(
- "CMS_AUTHENTICATION_NULL_CREDENTIAL", CRED_UID));
+ throw new EMissingCredential(CMS.getUserMessage("CMS_AUTHENTICATION_NULL_CREDENTIAL", CRED_UID));
}
-
+
// get the password.
pwd = (String) authCreds.get(CRED_PWD);
if (pwd == null) {
- throw new EMissingCredential(CMS.getUserMessage(
- "CMS_AUTHENTICATION_NULL_CREDENTIAL", CRED_PWD));
+ throw new EMissingCredential(CMS.getUserMessage("CMS_AUTHENTICATION_NULL_CREDENTIAL", CRED_PWD));
}
if (pwd.equals("")) {
// anonymous binding not allowed
- throw new EInvalidCredentials(
- CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
+ throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
}
// get user dn.
- LDAPSearchResults res = conn.search(mBaseDN, LDAPv2.SCOPE_SUB,
- "(uid=" + uid + ")", null, false);
+ LDAPSearchResults res = conn.search(mBaseDN,
+ LDAPv2.SCOPE_SUB, "(uid=" + uid + ")", null, false);
if (res.hasMoreElements()) {
LDAPEntry entry = (LDAPEntry) res.nextElement();
- throw new EAuthUserError(CMS.getUserMessage(
- "CMS_AUTHENTICATION_INVALID_ATTRIBUTE_VALUE",
- "UID already exists."));
+ throw new EAuthUserError(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_ATTRIBUTE_VALUE", "UID already exists."));
} else {
dn = regist(token, uid);
- if (dn == null)
- throw new EAuthUserError(CMS.getUserMessage(
- "CMS_AUTHENTICATION_INVALID_ATTRIBUTE_VALUE",
- "Could not add user " + uid + "."));
+ if (dn == null)
+ throw new EAuthUserError(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_ATTRIBUTE_VALUE","Could not add user " + uid + "."));
}
// bind as user dn and pwd - authenticates user with pwd.
@@ -214,57 +217,47 @@ public class PortalEnroll extends DirBasedAuthentication {
token.set(CRED_UID, uid);
log(ILogger.LL_INFO, "portal authentication is done");
-
+
return dn;
} catch (ELdapException e) {
- log(ILogger.LL_FAILURE,
- CMS.getLogMessage("LDAP_ERROR", e.toString()));
+ log(ILogger.LL_FAILURE, CMS.getLogMessage("LDAP_ERROR", e.toString()));
throw e;
} catch (LDAPException e) {
switch (e.getLDAPResultCode()) {
- case LDAPException.NO_SUCH_OBJECT:
- case LDAPException.LDAP_PARTIAL_RESULTS:
- log(ILogger.LL_SECURITY,
- CMS.getLogMessage("CMS_AUTH_ADD_USER_ERROR",
- conn.getHost(),
- Integer.toString(conn.getPort())));
- throw new EAuthInternalError(CMS.getUserMessage(
- "CMS_AUTHENTICATION_INTERNAL_ERROR",
- "Check Configuration detail."));
+ case LDAPException.NO_SUCH_OBJECT:
+ case LDAPException.LDAP_PARTIAL_RESULTS:
+ log(ILogger.LL_SECURITY, CMS.getLogMessage("CMS_AUTH_ADD_USER_ERROR", conn.getHost(), Integer.toString(conn.getPort())));
+ throw new
+ EAuthInternalError(CMS.getUserMessage("CMS_AUTHENTICATION_INTERNAL_ERROR", "Check Configuration detail."));
case LDAPException.INVALID_CREDENTIALS:
- log(ILogger.LL_SECURITY,
- CMS.getLogMessage("CMS_AUTH_BAD_PASSWORD", uid));
- throw new EInvalidCredentials(
- CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
+ log(ILogger.LL_SECURITY,
+ CMS.getLogMessage("CMS_AUTH_BAD_PASSWORD", uid));
+ throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
case LDAPException.SERVER_DOWN:
log(ILogger.LL_FAILURE, CMS.getLogMessage("LDAP_SERVER_DOWN"));
- throw new ELdapException(CMS.getUserMessage(
- "CMS_LDAP_SERVER_UNAVAILABLE", conn.getHost(), ""
- + conn.getPort()));
-
- default:
- log(ILogger.LL_FAILURE,
- CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
- throw new ELdapException(CMS.getUserMessage(
- "CMS_LDAP_OTHER_LDAP_EXCEPTION", e.errorCodeToString()));
+ throw new ELdapException(
+ CMS.getUserMessage("CMS_LDAP_SERVER_UNAVAILABLE", conn.getHost(), "" + conn.getPort()));
+
+ default:
+ log(ILogger.LL_FAILURE, CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
+ throw new ELdapException(
+ CMS.getUserMessage("CMS_LDAP_OTHER_LDAP_EXCEPTION",
+ e.errorCodeToString()));
}
} catch (EBaseException e) {
- if (e.getMessage().equalsIgnoreCase(
- CMS.getUserMessage("CMS_BASE_ATTRIBUTE_NOT_FOUND")) == true)
- log(ILogger.LL_FAILURE,
- CMS.getLogMessage("CMS_AUTH_MAKE_DN_ERROR",
- e.toString()));
+ if (e.getMessage().equalsIgnoreCase(CMS.getUserMessage("CMS_BASE_ATTRIBUTE_NOT_FOUND")) == true)
+ log(ILogger.LL_FAILURE, CMS.getLogMessage("CMS_AUTH_MAKE_DN_ERROR", e.toString()));
throw e;
- }
+ }
}
/**
- * Returns a list of configuration parameter names. The list is passed to
- * the configuration console so instances of this implementation can be
- * configured through the console.
- *
+ * Returns a list of configuration parameter names.
+ * The list is passed to the configuration console so instances of
+ * this implementation can be configured through the console.
+ *
* @return String array of configuration parameter names.
*/
public String[] getConfigParams() {
@@ -273,49 +266,44 @@ public class PortalEnroll extends DirBasedAuthentication {
public String[] getExtendedPluginInfo(Locale locale) {
String[] s = {
- PROP_DNPATTERN
- + ";string;Template for cert"
- + " Subject Name. ($dn.xxx - get value from user's LDAP "
- + "DN. $attr.yyy - get value from LDAP attributes in "
- + "user's entry.) Default: " + DEFAULT_DNPATTERN,
- "ldap.ldapconn.host;string,required;"
- + "LDAP host to connect to",
- "ldap.ldapconn.port;number,required;"
- + "LDAP port number (default 389, or 636 if SSL)",
+ PROP_DNPATTERN + ";string;Template for cert" +
+ " Subject Name. ($dn.xxx - get value from user's LDAP " +
+ "DN. $attr.yyy - get value from LDAP attributes in " +
+ "user's entry.) Default: " + DEFAULT_DNPATTERN,
+ "ldap.ldapconn.host;string,required;" + "LDAP host to connect to",
+ "ldap.ldapconn.port;number,required;" + "LDAP port number (default 389, or 636 if SSL)",
"ldap.objectclass;string,required;SEE DOCUMENTATION for Object Class. "
- + "Default is inetOrgPerson.",
- "ldap.ldapconn.secureConn;boolean;"
- + "Use SSL to connect to directory?",
+ + "Default is inetOrgPerson.",
+ "ldap.ldapconn.secureConn;boolean;" + "Use SSL to connect to directory?",
"ldap.ldapconn.version;choice(3,2);" + "LDAP protocol version",
"ldap.ldapauth.bindDN;string,required;DN to bind as for Directory Manager. "
- + "For example 'CN=Directory Manager'",
- "ldap.ldapauth.bindPWPrompt;password;Enter password used to bind as "
- + "the above user",
+ + "For example 'CN=Directory Manager'",
+ "ldap.ldapauth.bindPWPrompt;password;Enter password used to bind as " +
+ "the above user",
"ldap.ldapauth.authtype;choice(BasicAuth,SslClientAuth);"
- + "How to bind to the directory (for pin removal only)",
+ + "How to bind to the directory (for pin removal only)",
"ldap.ldapauth.clientCertNickname;string;If you want to use "
- + "SSL client auth to the directory, set the client "
- + "cert nickname here",
- "ldap.basedn;string,required;Base DN to start searching "
- + "under. If your user's DN is 'uid=jsmith, o=company', you "
- + "might want to use 'o=company' here",
- "ldap.minConns;number;number of connections "
- + "to keep open to directory server",
- "ldap.maxConns;number;when needed, connection "
- + "pool can grow to this many connections",
- IExtendedPluginInfo.HELP_TEXT
- + ";This authentication plugin checks to see if a user "
- + "exists in the directory. If not, then the user is created "
- + "with the requested password.",
- IExtendedPluginInfo.HELP_TOKEN
- + ";configuration-authrules-portalauth" };
-
+ + "SSL client auth to the directory, set the client "
+ + "cert nickname here",
+ "ldap.basedn;string,required;Base DN to start searching " +
+ "under. If your user's DN is 'uid=jsmith, o=company', you " +
+ "might want to use 'o=company' here",
+ "ldap.minConns;number;number of connections " +
+ "to keep open to directory server",
+ "ldap.maxConns;number;when needed, connection " +
+ "pool can grow to this many connections",
+ IExtendedPluginInfo.HELP_TEXT +
+ ";This authentication plugin checks to see if a user " +
+ "exists in the directory. If not, then the user is created " +
+ "with the requested password.",
+ IExtendedPluginInfo.HELP_TOKEN + ";configuration-authrules-portalauth"
+ };
+
return s;
}
/**
* Returns array of required credentials for this authentication manager.
- *
* @return Array of required credentials.
*/
public String[] getRequiredCreds() {
@@ -324,7 +312,6 @@ public class PortalEnroll extends DirBasedAuthentication {
/**
* adds a user to the directory.
- *
* @return dn upon success and null upon failure.
* @param token authentication token
* @param uid the user's id.
@@ -334,7 +321,7 @@ public class PortalEnroll extends DirBasedAuthentication {
/* Specify the attributes of the entry */
Vector objectclass_values = null;
-
+
LDAPAttributeSet attrs = new LDAPAttributeSet();
LDAPAttribute attr = new LDAPAttribute("objectclass");
@@ -347,17 +334,14 @@ public class PortalEnroll extends DirBasedAuthentication {
try {
- /*
- * Construct a new LDAPSchema object to hold the schema that you
- * want to retrieve.
- */
+ /* Construct a new LDAPSchema object to hold
+ the schema that you want to retrieve. */
dirSchema = new LDAPSchema();
/* Get the schema from the Directory. Anonymous access okay. */
dirSchema.fetchSchema(mLdapConn);
} catch (LDAPException e) {
- log(ILogger.LL_FAILURE,
- CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
+ log(ILogger.LL_FAILURE, CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
}
// complete mRequiredAttrs, mOptionalAttrs, and mObjClasses
initLdapAttrs(dirSchema, mObjectClass);
@@ -383,10 +367,9 @@ public class PortalEnroll extends DirBasedAuthentication {
try {
attrval = (String) argblk.getValueAsString(attrname);
} catch (EBaseException e) {
- if (e.getMessage().equalsIgnoreCase(
- CMS.getUserMessage("CMS_BASE_ATTRIBUTE_NOT_FOUND")) == true)
+ if (e.getMessage().equalsIgnoreCase(CMS.getUserMessage("CMS_BASE_ATTRIBUTE_NOT_FOUND")) == true)
continue;
- }
+ }
CMS.debug("PortalEnroll: " + attrname + " = " + attrval);
attrs.add(new LDAPAttribute(attrname, attrval));
@@ -403,18 +386,17 @@ public class PortalEnroll extends DirBasedAuthentication {
while (attrnames.hasMoreElements()) {
String attrname = (String) attrnames.nextElement();
String attrval = null;
-
+
CMS.debug("PortalEnroll: attrname is: " + attrname);
try {
attrval = (String) argblk.getValueAsString(attrname);
} catch (EBaseException e) {
- if (e.getMessage().equalsIgnoreCase(
- CMS.getUserMessage("CMS_BASE_ATTRIBUTE_NOT_FOUND")) == true)
+ if (e.getMessage().equalsIgnoreCase(CMS.getUserMessage("CMS_BASE_ATTRIBUTE_NOT_FOUND")) == true)
continue;
- }
+ }
CMS.debug("PortalEnroll: " + attrname + " = " + attrval);
if (attrval != null) {
- attrs.add(new LDAPAttribute(attrname, attrval));
+ attrs.add(new LDAPAttribute(attrname, attrval));
}
}
}
@@ -428,24 +410,22 @@ public class PortalEnroll extends DirBasedAuthentication {
mLdapConn.add(entry);
} catch (LDAPException e) {
if (e.getLDAPResultCode() == LDAPException.ENTRY_ALREADY_EXISTS) {
- log(ILogger.LL_FAILURE,
- CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
+ log(ILogger.LL_FAILURE, CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
} else
- log(ILogger.LL_FAILURE,
- CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
+ log(ILogger.LL_FAILURE, CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
return null;
}
log(ILogger.LL_INFO, CMS.getLogMessage("CMS_AUTH_REGISTRATION_DONE"));
-
+
return dn;
}
/*
- * get the superiors of "inetOrgPerson" so the "required
- * attributes", "optional qttributes", and "object classes" are complete;
- * should build up mRequiredAttrs, mOptionalAttrs, and mObjClasses when
- * returned
+ * get the superiors of "inetOrgPerson" so the "required
+ * attributes", "optional qttributes", and "object classes" are complete;
+ * should build up
+ * mRequiredAttrs, mOptionalAttrs, and mObjClasses when returned
*/
public void initLdapAttrs(LDAPSchema dirSchema, String oclass) {
CMS.debug("PortalEnroll: in initLdapAttrsAttrs");
@@ -468,8 +448,7 @@ public class PortalEnroll extends DirBasedAuthentication {
CMS.debug("PortalEnroll: getting superiors for: " + oclass);
String superiors[] = objClass.getSuperiors();
- CMS.debug("PortalEnroll: got superiors, superiors.length="
- + superiors.length);
+ CMS.debug("PortalEnroll: got superiors, superiors.length=" + superiors.length);
if (superiors.length == 0)
return;
for (int i = 0; i < superiors.length; i++) {
@@ -478,8 +457,8 @@ public class PortalEnroll extends DirBasedAuthentication {
initLdapAttrs(dirSchema, superiors[i]);
}
} catch (Exception e) {
- log(ILogger.LL_FAILURE,
- CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
+ log(ILogger.LL_FAILURE, CMS.getLogMessage("LDAP_ERROR", e.getMessage()));
}
}
}
+
generated by cgit (git 2.34.1) at 2024-07-07 11:04:18 +0000