Skip to content

Commit

Permalink
Addition of group research for a user through group members
Browse files Browse the repository at this point in the history
  • Loading branch information
Thomas GRAVIOU committed Dec 23, 2016
1 parent 0e5d038 commit a245488
Showing 1 changed file with 71 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,9 @@ public class LDAPConnector {
final public static String GROUP_ATTRIBUTE = "GROUP_ATTRIBUTE";
final public static String GROUP_MEMBERS_ATTRIBUTE_NAME = "GROUP_MEMBERS_ATTRIBUTE_NAME";
final public static String ACCESS_GROUP_NAME = "ACCESS_GROUP_NAME";


final public static String GROUPS_FETCH_BY_MEMBER_OF = "GROUPS_FETCH_BY_MEMBER_OF";


private String host;
private int port;
Expand All @@ -70,7 +72,9 @@ public class LDAPConnector {
private String[] groupAttributeNames;
private String groupMembersAttributeName;
private String accessGroupName;


private boolean groupsFetchByMemberOf;

public LDAPConnector(Map<String, Object> configuration) {
this.host = (String) configuration.get(HOST);
this.port = Integer.parseInt((String) configuration.get(PORT));
Expand All @@ -94,6 +98,7 @@ public LDAPConnector(Map<String, Object> configuration) {
this.groupAttributeNames = (String[]) configuration.get(GROUP_ATTRIBUTE);
this.groupMembersAttributeName = (String) configuration.get(GROUP_MEMBERS_ATTRIBUTE_NAME);
this.accessGroupName = (String) configuration.get(ACCESS_GROUP_NAME);
this.groupsFetchByMemberOf = Boolean.valueOf((String) configuration.get(GROUPS_FETCH_BY_MEMBER_OF));
}

protected LDAPConnection connectToLDAP() {
Expand Down Expand Up @@ -376,15 +381,25 @@ private String getGroupName(String groupDistingushedName) {
}

}

public List<String> getUserGroup(String userName) throws LDAPException {
if(groupsFetchByMemberOf){
return getUserGroupByUserMemberOf(userName);
}
else{
return getUserGroupByGroupMember(userName);
}
}

public List<String> getUserGroup(String username) throws LDAPException {
public List<String> getUserGroupByUserMemberOf(String username) throws LDAPException {

logger.debug("IN");

List<String> userGroups = new ArrayList<String>();

try {
LDAPEntry entry = getUserById(username);


LDAPAttribute groupAttribute = entry.getAttribute(userMemberOfAttributeName);
if(groupAttribute == null) {
Expand All @@ -409,6 +424,59 @@ public List<String> getUserGroup(String username) throws LDAPException {
return userGroups;
}

public List<String> getUserGroupByGroupMember(String username) throws LDAPException {

logger.debug("IN");

LDAPConnection connection = null;
List<String> userGroups = new ArrayList<String>();
LDAPEntry user = getUserById(username);
String userDN = user.getDN();
try {
connection = this.connectToLDAPAsAdmin();

String searchPath = groupSearchPath;

if (StringUtilities.isEmpty(searchPath)) {
searchPath = baseDN;
} else {
if(StringUtilities.isNotEmpty(baseDN)) {
searchPath += "," + baseDN;
}
}


String searchQuery = "(&(objectclass=" + groupObjectClass + ")(" + groupMembersAttributeName + "=" + userDN + "))";
LDAPSearchResults searchResults = connection.search(searchPath, LDAPConnection.SCOPE_SUB,
searchQuery, groupAttributeNames, false);

while (searchResults.hasMore()) {
LDAPEntry entry = searchResults.next();
System.out.println(entry.getDN());
if (entry != null) {

String groupDistingushedName = entry.getDN();

if (isValidGroup(groupDistingushedName)) {
String groupName = getGroupName(groupDistingushedName);
if (!isAccessGroupDefined() || !isAccessGroup(groupName)) {
userGroups.add(groupName);
}
}
}
}

} catch(Throwable t) {
throw new RuntimeException("An unexpected error occured while serching users of Access group", t);
} finally {
closeConnection(connection);
logger.debug("OUT");
}

return userGroups;
}


private boolean isAccessGroup(String groupName) {
return accessGroupName.equals(groupName);
}
Expand Down

1 comment on commit a245488

@petosorus
Copy link

@petosorus petosorus commented on a245488 Dec 23, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Our OpenLDAP doesn't have a memberOf attribute on the member objects.
We request the groups of a user by checking in which groups they are a value of the member attribute.

This requires a new <GROUPS_FETCH_BY_MEMBEROF>false</GROUPS_FETCH_BY_MEMBEROF> parameter in the ldap_authorizations.xml. True is the normal lookup, false is my lookup.
You also need to set <GROUP_MEMBERS_ATTRIBUTE_NAME> to the name of the field mapping users to groups. By default, that name is member.

Please sign in to comment.