org.apache.isis.extensions.shirorealmldap.realm.impl

Class IsisLdapRealm

java.lang.Object

org.apache.shiro.realm.CachingRealm

org.apache.shiro.realm.AuthenticatingRealm

org.apache.shiro.realm.AuthorizingRealm

org.apache.shiro.realm.ldap.DefaultLdapRealm

org.apache.isis.extensions.shirorealmldap.realm.impl.IsisLdapRealm

All Implemented Interfaces:

org.apache.shiro.authc.LogoutAware, org.apache.shiro.authz.Authorizer, org.apache.shiro.authz.permission.PermissionResolverAware, org.apache.shiro.authz.permission.RolePermissionResolverAware, org.apache.shiro.cache.CacheManagerAware, org.apache.shiro.realm.Realm, org.apache.shiro.util.Initializable, org.apache.shiro.util.Nameable

public class IsisLdapRealm
extends org.apache.shiro.realm.ldap.DefaultLdapRealm

Implementation of JndiLdapRealm that also returns each user's groups.

Sample config for shiro.ini:

 contextFactory = org.apache.isis.extensions.shirorealmldap.realm.impl.IsisLdapContextFactory
 contextFactory.url = ldap://localhost:10389
 contextFactory.authenticationMechanism = CRAM-MD5
 contextFactory.systemAuthenticationMechanism = simple
 contextFactory.systemUsername = uid=admin,ou=system
 contextFactory.systemPassword = secret

 ldapRealm = org.apache.isis.extensions.shirorealmldap.realm.impl.IsisLdapRealm
 ldapRealm.contextFactory = $contextFactory

 ldapRealm.searchBase = ou=groups,o=mojo
 ldapRealm.groupObjectClass = groupOfUniqueNames
 ldapRealm.uniqueMemberAttribute = uniqueMember
 ldapRealm.uniqueMemberAttributeValueTemplate = uid={0}

 ldapRealm.searchUserBase = ou=users,o=mojo
 ldapRealm.userObjectClass=inetOrgPerson
 ldapRealm.groupExtractedAttribute=street,country
 ldapRealm.userExtractedAttribute=street,country
 ldapRealm.permissionByGroupAttribute=attribute:Folder.{street}:Read,attribute:Portfolio.{country}
 ldapRealm.permissionByUserAttribute=attribute:Folder.{street}:Read,attribute:Portfolio.{country}

 # optional mapping from physical groups to logical application roles
 ldapRealm.rolesByGroup = \
    LDN_USERS: user_role,\
    NYK_USERS: user_role,\
    HKG_USERS: user_role,\
    GLOBAL_ADMIN: admin_role,\
    DEMOS: self-install_role

 securityManager.realms = $ldapRealm
 

The permissions for each role can be specified using the setResourcePath(String) to an 'ini' file with a [roles] section, eg:

 ldapRealm.resourcePath=classpath:webapp/myroles.ini
 

where myroles.ini is in src/main/resources/webapp, and takes the form:

 [roles]
 user_role = *:ToDoItemsJdo:*:*,\
             *:ToDoItem:*:*
 self-install_role = *:ToDoItemsFixturesService:install:*
 admin_role = *
 

This 'ini' file can then be referenced by other realms (if multiple realm are configured with the Shiro security manager).

Alternatively, permissions can be set directly using setPermissionsByRole(String), where the string is the same information, formatted thus:

 ldapRealm.permissionsByRole=\
    user_role = *:ToDoItemsJdo:*:*,\
                *:ToDoItem:*:*; \
    self-install_role = *:ToDoItemsFixturesService:install:* ; \
    admin_role = *
 

Alternatively, permissions can be extracted from the base itself with the parameter searchUserBase, the attribute list as userExtractedAttribute and the permission url as permissionByUserAttribute. The idea is to extract attribute from the user or the group of the user and map directly to permission rule in replacing the string {attribute} by the extracted attribute (can me multiple). See the sample for group and user attribute and mapping.

Field Summary

Fields

Modifier and Type	Field and Description
protected Set<String>	groupExtractedAttribute For Group Extracted attribute name with mapping name in parenthesis.
protected Set<String>	permissionByGroupAttribute For Group Mapping of attributes.
protected Set<String>	permissionByUserAttribute For User Mapping of attributes.
protected Set<String>	userExtractedAttribute For User Extracted attribute name with mapping name in parenthesis.

Constructor Summary

Constructors

Constructor and Description
IsisLdapRealm()

Method Summary

Modifier and Type	Method and Description
protected Set<String>	groupFor(String userName, LdapContext ldapCtx)
protected boolean	memberOf(SearchResult group, Set<String> groups)
protected org.apache.shiro.authz.AuthorizationInfo	queryForAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals, org.apache.shiro.realm.ldap.LdapContextFactory ldapContextFactory) Get groups from LDAP.
void	setCnAttribute(String cnAttribute)
void	setGroupExtractedAttribute(String groupExtractedAttribute)
void	setGroupObjectClass(String groupObjectClassAttribute)
void	setPermissionByGroupAttribute(String permissionByGroupAttribute)
void	setPermissionByUserAttribute(String permissionByUserAttr)
void	setPermissionsByRole(String permissionsByRoleStr) Deprecated.
void	setResourcePath(String resourcePath) ldapRealm.resourcePath=classpath:webapp/myroles.ini
void	setRolesByGroup(Map<String,String> rolesByGroup)
void	setSearchBase(String searchBase)
void	setSearchUserBase(String searchUserBase)
void	setUniqueMemberAttribute(String uniqueMemberAttribute)
void	setUniqueMemberAttributeValueTemplate(String template)
void	setUserExtractedAttribute(String userExtractedAttribute)
void	setUserObjectClass(String userObjectClass)

Methods inherited from class org.apache.shiro.realm.ldap.DefaultLdapRealm

createAuthenticationInfo, doGetAuthenticationInfo, doGetAuthorizationInfo, getContextFactory, getLdapPrincipal, getUserDn, getUserDnPrefix, getUserDnSuffix, getUserDnTemplate, queryForAuthenticationInfo, setContextFactory, setUserDnTemplate

Methods inherited from class org.apache.shiro.realm.AuthorizingRealm

afterCacheManagerSet, checkPermission, checkPermission, checkPermission, checkPermissions, checkPermissions, checkPermissions, checkRole, checkRole, checkRoles, checkRoles, checkRoles, clearCachedAuthorizationInfo, doClearCache, getAuthorizationCache, getAuthorizationCacheKey, getAuthorizationCacheName, getAuthorizationInfo, getPermissionResolver, getPermissions, getRolePermissionResolver, hasAllRoles, hasRole, hasRole, hasRoles, hasRoles, isAuthorizationCachingEnabled, isPermitted, isPermitted, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, isPermittedAll, onInit, setAuthorizationCache, setAuthorizationCacheName, setAuthorizationCachingEnabled, setName, setPermissionResolver, setRolePermissionResolver

Methods inherited from class org.apache.shiro.realm.AuthenticatingRealm

assertCredentialsMatch, clearCachedAuthenticationInfo, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, supports

Methods inherited from class org.apache.shiro.realm.CachingRealm

clearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabled

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.shiro.util.Initializable

init

Field Detail

groupExtractedAttribute

protected Set<String> groupExtractedAttribute

For Group Extracted attribute name with mapping name in parenthesis. Ex: street,country

userExtractedAttribute

protected Set<String> userExtractedAttribute

For User Extracted attribute name with mapping name in parenthesis. Ex: street,country

permissionByGroupAttribute

protected Set<String> permissionByGroupAttribute

For Group Mapping of attributes. Ex: attribute:Folder.{street}:Read,attribute:Portfolio.{country}:*

permissionByUserAttribute

protected Set<String> permissionByUserAttribute

For User Mapping of attributes. Ex: attribute:Folder.{street}:Read,attribute:Portfolio.{country}:*

Constructor Detail

IsisLdapRealm

public IsisLdapRealm()

Method Detail

queryForAuthorizationInfo

protected org.apache.shiro.authz.AuthorizationInfo queryForAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals,
                                                                             org.apache.shiro.realm.ldap.LdapContextFactory ldapContextFactory)
                                                                      throws NamingException

Get groups from LDAP.

Overrides:

queryForAuthorizationInfo in class org.apache.shiro.realm.ldap.DefaultLdapRealm

Parameters:

principals - the principals of the Subject whose AuthenticationInfo should be queried from the LDAP server.

ldapContextFactory - factory used to retrieve LDAP connections.

Returns:

an AuthorizationInfo instance containing information retrieved from the LDAP server.

Throws:

NamingException - if any LDAP errors occur during the search.

groupFor

protected Set<String> groupFor(String userName,
                               LdapContext ldapCtx)
                        throws NamingException

Throws:

NamingException

memberOf

protected boolean memberOf(SearchResult group,
                           Set<String> groups)
                    throws NamingException

Throws:

NamingException

setSearchBase

public void setSearchBase(String searchBase)

setGroupObjectClass

public void setGroupObjectClass(String groupObjectClassAttribute)

setUniqueMemberAttribute

public void setUniqueMemberAttribute(String uniqueMemberAttribute)

setUniqueMemberAttributeValueTemplate

public void setUniqueMemberAttributeValueTemplate(String template)

setRolesByGroup

public void setRolesByGroup(Map<String,String> rolesByGroup)

setResourcePath

public void setResourcePath(String resourcePath)

 ldapRealm.resourcePath=classpath:webapp/myroles.ini
 

where myroles.ini is in src/main/resources/webapp, and takes the form:

 [roles]
 user_role = *:ToDoItemsJdo:*:*,\
             *:ToDoItem:*:*
 self-install_role = *:ToDoItemsFixturesService:install:*
 admin_role = *
 

This 'ini' file can then be referenced by other realms (if multiple realm are configured with the Shiro security manager).

See Also:

setResourcePath(String)

setPermissionsByRole

@Deprecated
public void setPermissionsByRole(String permissionsByRoleStr)

Deprecated.

Specify permissions for each role using a formatted string.

 ldapRealm.permissionsByRole=\
    user_role = *:ToDoItemsJdo:*:*,\
                *:ToDoItem:*:*; \
    self-install_role = *:ToDoItemsFixturesService:install:* ; \
    admin_role = *
 

See Also:

setResourcePath(String)

setPermissionByUserAttribute

public void setPermissionByUserAttribute(String permissionByUserAttr)

setPermissionByGroupAttribute

public void setPermissionByGroupAttribute(String permissionByGroupAttribute)

setUserExtractedAttribute

public void setUserExtractedAttribute(String userExtractedAttribute)

setGroupExtractedAttribute

public void setGroupExtractedAttribute(String groupExtractedAttribute)

setSearchUserBase

public void setSearchUserBase(String searchUserBase)

setUserObjectClass

public void setUserObjectClass(String userObjectClass)

setCnAttribute

public void setCnAttribute(String cnAttribute)