public class KnoxLdapRealm
extends org.apache.shiro.realm.ldap.DefaultLdapRealm
DefaultLdapRealm that also
returns each user's groups.
This implementation is heavily based on org.apache.isis.security.shiro.IsisLdapRealm.
This implementation saves looked up ldap groups in Shiro Session to make them
easy to be looked up outside of this object
Sample config for shiro.ini:
[main]
ldapRealm=KnoxLdapRealm
ldapGroupContextFactory=KnoxLdapContextFactory
ldapRealm.contextFactory=$ldapGroupContextFactory
ldapRealm.contextFactory.authenticationMechanism=simple
ldapRealm.contextFactory.url=ldap://localhost:33389
ldapRealm.userDnTemplate=uid={0},ou=people,dc=hadoop,dc=apache,dc=org
ldapRealm.authorizationEnabled=true
ldapRealm.contextFactory.systemAuthenticationMechanism=simple
ldapRealm.searchBase=ou=groups,dc=hadoop,dc=apache,dc=org
ldapRealm.groupObjectClass=groupofnames
ldapRealm.memberAttribute=member
ldapRealm.memberAttributeValueTemplate=cn={0},ou=people,dc=hadoop,dc=apache,dc=org
ldapRealm.contextFactory.systemUsername=uid=guest,ou=people,dc=hadoop,dc=apache,dc=org
ldapRealm.contextFactory.clusterName=sandbox
ldapRealm.contextFactory.systemPassword=S{ALIAS=ldcSystemPassword}
[urls]
**=authcBasic
# optional mapping from physical groups to logical application roles
ldapRealm.rolesByGroup = \
LDN_USERS: user_role,\
NYK_USERS: user_role,\
HKG_USERS: user_role,\
GLOBAL_ADMIN: admin_role,\
DEMOS: self-install_role
ldapRealm.permissionsByRole=\
user_role = *:ToDoItemsJdo:*:*,\
*:ToDoItem:*:*; \
self-install_role = *:ToDoItemsFixturesService:install:* ; \
admin_role = *
securityManager.realms = $ldapRealm
| Constructor and Description |
|---|
KnoxLdapRealm() |
| Modifier and Type | Method and Description |
|---|---|
protected org.apache.shiro.authc.AuthenticationInfo |
createAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token,
Object ldapPrincipal,
Object ldapCredentials,
LdapContext ldapContext) |
protected org.apache.shiro.authc.AuthenticationInfo |
doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token) |
String |
getGroupIdAttribute() |
String |
getGroupObjectClass() |
String |
getGroupSearchBase() |
String |
getMemberAttribute() |
String |
getPrincipalRegex() |
String |
getSearchBase() |
protected String |
getUserDn(String principal)
Returns the LDAP User Distinguished Name (DN) to use when acquiring an
LdapContext from the LdapContextFactory. |
String |
getUserObjectClass() |
String |
getUserSearchAttributeName() |
String |
getUserSearchAttributeTemplate() |
String |
getUserSearchBase() |
String |
getUserSearchFilter() |
String |
getUserSearchScope() |
boolean |
isAuthorizationEnabled() |
protected org.apache.shiro.authz.AuthorizationInfo |
queryForAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals,
org.apache.shiro.realm.ldap.LdapContextFactory ldapContextFactory)
Get groups from LDAP.
|
void |
setAuthorizationEnabled(boolean authorizationEnabled) |
void |
setGroupIdAttribute(String groupIdAttribute) |
void |
setGroupObjectClass(String groupObjectClassAttribute) |
void |
setGroupSearchBase(String groupSearchBase) |
void |
setMemberAttribute(String memberAttribute) |
void |
setMemberAttributeValueTemplate(String template) |
void |
setPermissionsByRole(String permissionsByRoleStr) |
void |
setPrincipalRegex(String regex) |
void |
setRolesByGroup(Map<String,String> rolesByGroup) |
void |
setSearchBase(String searchBase) |
void |
setUserDnTemplate(String template) |
void |
setUserObjectClass(String userObjectClass) |
void |
setUserSearchAttributeName(String userSearchAttributeName) |
void |
setUserSearchAttributeTemplate(String template) |
void |
setUserSearchBase(String userSearchBase) |
void |
setUserSearchFilter(String filter) |
void |
setUserSearchScope(String scope) |
doGetAuthorizationInfo, getContextFactory, getLdapPrincipal, getUserDnPrefix, getUserDnSuffix, getUserDnTemplate, queryForAuthenticationInfo, setContextFactoryafterCacheManagerSet, checkPermission, checkPermission, checkPermission, checkPermissions, checkPermissions, checkPermissions, checkRole, checkRole, checkRoles, checkRoles, checkRoles, clearCachedAuthorizationInfo, doClearCache, getAuthorizationCache, getAuthorizationCacheKey, getAuthorizationCacheName, getAuthorizationInfo, getPermissionResolver, getPermissions, getRolePermissionResolver, hasAllRoles, hasRole, hasRole, hasRoles, hasRoles, isAuthorizationCachingEnabled, isPermitted, isPermitted, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, isPermittedAll, onInit, setAuthorizationCache, setAuthorizationCacheName, setAuthorizationCachingEnabled, setName, setPermissionResolver, setRolePermissionResolverassertCredentialsMatch, clearCachedAuthenticationInfo, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, supportsclearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabledprotected org.apache.shiro.authc.AuthenticationInfo doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token)
throws org.apache.shiro.authc.AuthenticationException
doGetAuthenticationInfo in class org.apache.shiro.realm.ldap.DefaultLdapRealmorg.apache.shiro.authc.AuthenticationExceptionprotected org.apache.shiro.authz.AuthorizationInfo queryForAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection principals,
org.apache.shiro.realm.ldap.LdapContextFactory ldapContextFactory)
throws NamingException
queryForAuthorizationInfo in class org.apache.shiro.realm.ldap.DefaultLdapRealmprincipals - the principals of the Subject whose AuthenticationInfo should
be queried from the LDAP server.ldapContextFactory - factory used to retrieve LDAP connections.AuthorizationInfo instance containing information
retrieved from the LDAP server.NamingException - if any LDAP errors occur during the search.public String getSearchBase()
public void setSearchBase(String searchBase)
public String getUserSearchBase()
public void setUserSearchBase(String userSearchBase)
public String getGroupSearchBase()
public void setGroupSearchBase(String groupSearchBase)
public String getGroupObjectClass()
public void setGroupObjectClass(String groupObjectClassAttribute)
public String getMemberAttribute()
public void setMemberAttribute(String memberAttribute)
public String getGroupIdAttribute()
public void setGroupIdAttribute(String groupIdAttribute)
public void setMemberAttributeValueTemplate(String template)
public void setPermissionsByRole(String permissionsByRoleStr)
public boolean isAuthorizationEnabled()
public void setAuthorizationEnabled(boolean authorizationEnabled)
public String getUserSearchAttributeName()
public void setUserSearchAttributeName(String userSearchAttributeName)
public String getUserObjectClass()
public void setUserObjectClass(String userObjectClass)
public String getPrincipalRegex()
public void setPrincipalRegex(String regex)
public String getUserSearchAttributeTemplate()
public void setUserSearchAttributeTemplate(String template)
public String getUserSearchFilter()
public void setUserSearchFilter(String filter)
public String getUserSearchScope()
public void setUserSearchScope(String scope)
public void setUserDnTemplate(String template) throws IllegalArgumentException
setUserDnTemplate in class org.apache.shiro.realm.ldap.DefaultLdapRealmIllegalArgumentExceptionprotected String getUserDn(String principal) throws IllegalArgumentException, IllegalStateException
LdapContext from the LdapContextFactory.
If the the userDnTemplate property has been set, this implementation will construct
the User DN by substituting the specified principal into the configured template. If the
userDnTemplate has not been set, the method argument will be returned directly
(indicating that the submitted authentication token principal is the User DN).getUserDn in class org.apache.shiro.realm.ldap.DefaultLdapRealmprincipal - the principal to substitute into the configured userDnTemplate.LdapContext.IllegalArgumentException - if the method argument is null or emptyIllegalStateException - if the userDnTemplate has not been set.LdapContextFactory.getLdapContext(Object, Object)protected org.apache.shiro.authc.AuthenticationInfo createAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken token,
Object ldapPrincipal,
Object ldapCredentials,
LdapContext ldapContext)
throws NamingException
createAuthenticationInfo in class org.apache.shiro.realm.ldap.DefaultLdapRealmNamingExceptionCopyright © 2023 The Apache Software Foundation. All rights reserved.