inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-08-07 17:49:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged V3.2 to HEAD

Browse Source 
15236: ETHREEOH-2508: Support for posixGroup class in Fedora Directory Server
      - If group member attribute doesn't parse as a DN, assume it contains a user ID directly

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@15239 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261
This commit is contained in:
Dave Ward
2009-07-16 17:20:55 +00:00
parent 714481a6ac
commit 7e95d1e5c8
1 changed files with 96 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
source/java/org/alfresco/repo/security/sync/ldap/LDAPUserRegistry.java
View File

@@ -36,6 +36,7 @@ import java.util.TimeZone;
import java.util.TreeMap;
import java.util.TreeSet;
import javax.naming.InvalidNameException;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
@@ -469,6 +470,15 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
try
{
ctx = this.ldapInitialContextFactory.getDefaultIntialDirContext(this.queryBatchSize);
LdapName groupDistinguishedNamePrefix = new LdapName(this.groupSearchBase);
LdapName userDistinguishedNamePrefix = new LdapName(this.userSearchBase);
// Work out whether the user and group trees are disjoint. This may allow us to optimize reverse DN
// resolution.
boolean disjoint = !groupDistinguishedNamePrefix.startsWith(userDistinguishedNamePrefix)
&& !userDistinguishedNamePrefix.startsWith(groupDistinguishedNamePrefix);
do
{
NamingEnumeration<SearchResult> searchResults;
@@ -485,14 +495,6 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
}, userSearchCtls);
}
LdapName groupDistinguishedNamePrefix = new LdapName(this.groupSearchBase);
LdapName userDistinguishedNamePrefix = new LdapName(this.userSearchBase);
// Work out whether the user and group trees are disjoint. This may allow us to optimize reverse DN
// resolution.
boolean disjoint = !groupDistinguishedNamePrefix.startsWith(userDistinguishedNamePrefix)
&& !userDistinguishedNamePrefix.startsWith(groupDistinguishedNamePrefix);
while (searchResults.hasMoreElements())
{
SearchResult result = searchResults.next();
@@ -546,15 +548,19 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
String attribute = (String) memAttribute.get(i);
if (attribute != null)
{
try
{
// Attempt to parse the member attribute as a DN. If this fails we have a fallback
// in the catch block
LdapName distinguishedName = new LdapName(attribute);
Attribute nameAttribute;
// If the user and group search bases are different we may be able to recognise user and
// group DNs without a secondary lookup
// If the user and group search bases are different we may be able to recognise user
// and group DNs without a secondary lookup
if (disjoint)
{
Attributes nameAttributes = distinguishedName.getRdn(distinguishedName.size() - 1)
.toAttributes();
Attributes nameAttributes = distinguishedName.getRdn(
distinguishedName.size() - 1).toAttributes();
// Recognise user DNs
if (distinguishedName.startsWith(userDistinguishedNamePrefix)
@@ -579,7 +585,6 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
{
try
{
Attributes childAttributes = ctx.getAttributes(attribute, new String[]
{
"objectclass", this.groupIdAttributeName, this.userIdAttributeName
@@ -598,8 +603,9 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
}
else
{
LDAPUserRegistry.logger.warn("User missing user id attribute DN ="
+ attribute + " att = " + this.userIdAttributeName);
LDAPUserRegistry.logger
.warn("User missing user id attribute DN =" + attribute
+ " att = " + this.userIdAttributeName);
continue;
}
}
@@ -620,7 +626,8 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
}
else
{
LDAPUserRegistry.logger.warn("Missing GID on " + childAttributes);
LDAPUserRegistry.logger.warn("Missing GID on "
+ childAttributes);
continue;
}
}
@@ -640,6 +647,12 @@ public class LDAPUserRegistry implements UserRegistry, InitializingBean, Activat
}
LDAPUserRegistry.logger.warn("Failed to resolve distinguished name: " + attribute);
}
catch (InvalidNameException e)
{
// The member attribute didn't parse as a DN. So assume we have a group class like posixGroup (FDS) that directly lists user names
childAssocs.add(attribute);
}
}
}
}
}