inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-07 17:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged V3.2 to HEAD

Browse Source 
15236: ETHREEOH-2508: Support for posixGroup class in Fedora Directory Server
      - If group member attribute doesn't parse as a DN, assume it contains a user ID directly

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@15239 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Dave Ward
2009-07-16 17:20:55 +00:00
parent 714481a6ac
commit 7e95d1e5c8
1 changed files with 96 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
source/java/org/alfresco/repo/security/sync/ldap/LDAPUserRegistry.java
View File

@@ -36,6 +36,7 @@ import java.util.TimeZone;
import java.util.TreeMap; import java.util.TreeMap;
import java.util.TreeSet; import java.util.TreeSet;
import javax.naming.InvalidNameException;
import javax.naming.NamingEnumeration; import javax.naming.NamingEnumeration;
import javax.naming.NamingException; import javax.naming.NamingException;
import javax.naming.directory.Attribute; import javax.naming.directory.Attribute;
@@ -469,6 +470,15 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
try try
{ {
ctx = this.ldapInitialContextFactory.getDefaultIntialDirContext(this.queryBatchSize); ctx = this.ldapInitialContextFactory.getDefaultIntialDirContext(this.queryBatchSize);
LdapName groupDistinguishedNamePrefix = new LdapName(this.groupSearchBase);
LdapName userDistinguishedNamePrefix = new LdapName(this.userSearchBase);
// Work out whether the user and group trees are disjoint. This may allow us to optimize reverse DN
// resolution.
boolean disjoint = !groupDistinguishedNamePrefix.startsWith(userDistinguishedNamePrefix)
&& !userDistinguishedNamePrefix.startsWith(groupDistinguishedNamePrefix);
do do
{ {
NamingEnumeration<SearchResult> searchResults; NamingEnumeration<SearchResult> searchResults;
@@ -485,14 +495,6 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
}, userSearchCtls); }, userSearchCtls);
} }
LdapName groupDistinguishedNamePrefix = new LdapName(this.groupSearchBase);
LdapName userDistinguishedNamePrefix = new LdapName(this.userSearchBase);
// Work out whether the user and group trees are disjoint. This may allow us to optimize reverse DN
// resolution.
boolean disjoint = !groupDistinguishedNamePrefix.startsWith(userDistinguishedNamePrefix)
&& !userDistinguishedNamePrefix.startsWith(groupDistinguishedNamePrefix);
while (searchResults.hasMoreElements()) while (searchResults.hasMoreElements())
{ {
SearchResult result = searchResults.next(); SearchResult result = searchResults.next();
@@ -546,15 +548,19 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
String attribute = (String) memAttribute.get(i); String attribute = (String) memAttribute.get(i);
if (attribute != null) if (attribute != null)
{ {
try
{
// Attempt to parse the member attribute as a DN. If this fails we have a fallback
// in the catch block
LdapName distinguishedName = new LdapName(attribute); LdapName distinguishedName = new LdapName(attribute);
Attribute nameAttribute; Attribute nameAttribute;
// If the user and group search bases are different we may be able to recognise user and // If the user and group search bases are different we may be able to recognise user
// group DNs without a secondary lookup // and group DNs without a secondary lookup
if (disjoint) if (disjoint)
{ {
Attributes nameAttributes = distinguishedName.getRdn(distinguishedName.size() - 1) Attributes nameAttributes = distinguishedName.getRdn(
.toAttributes(); distinguishedName.size() - 1).toAttributes();
// Recognise user DNs // Recognise user DNs
if (distinguishedName.startsWith(userDistinguishedNamePrefix) if (distinguishedName.startsWith(userDistinguishedNamePrefix)
@@ -579,7 +585,6 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
{ {
try try
{ {
Attributes childAttributes = ctx.getAttributes(attribute, new String[] Attributes childAttributes = ctx.getAttributes(attribute, new String[]
{ {
"objectclass", this.groupIdAttributeName, this.userIdAttributeName "objectclass", this.groupIdAttributeName, this.userIdAttributeName
@@ -598,8 +603,9 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
} }
else else
{ {
LDAPUserRegistry.logger.warn("User missing user id attribute DN =" LDAPUserRegistry.logger
+ attribute + " att = " + this.userIdAttributeName); .warn("User missing user id attribute DN =" + attribute
+ " att = " + this.userIdAttributeName);
continue; continue;
} }
} }
@@ -620,7 +626,8 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
} }
else else
{ {
LDAPUserRegistry.logger.warn("Missing GID on " + childAttributes); LDAPUserRegistry.logger.warn("Missing GID on "
+ childAttributes);
continue; continue;
} }
} }
@@ -640,6 +647,12 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
} }
LDAPUserRegistry.logger.warn("Failed to resolve distinguished name: " + attribute); LDAPUserRegistry.logger.warn("Failed to resolve distinguished name: " + attribute);
} }
catch (InvalidNameException e)
{
// The member attribute didn't parse as a DN. So assume we have a group class like posixGroup (FDS) that directly lists user names
childAssocs.add(attribute);
}
}
} }
} }
} }