public class AuthenticationInterceptor extends BaseInterceptor
Interceptor that authenticates users.| Modifier and Type | Class and Description |
|---|---|
private static class |
AuthenticationInterceptor.PwdModDetailsHolder |
| Modifier and Type | Field and Description |
|---|---|
private CoreSession |
adminSession |
private java.util.Set<Authenticator> |
authenticators
A Set of all the existing Authenticator to be used by the bind operation
|
private java.util.Map<org.apache.directory.api.ldap.model.constants.AuthenticationLevel,java.util.Collection<Authenticator>> |
authenticatorsMapByType
A map of authenticators associated with the authentication level required
|
private static boolean |
IS_DEBUG
Speedup for logs
|
private static org.slf4j.Logger |
LOG |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdAccountLockedTimeAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdChangedTimeAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdEndTimeAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdFailurTimeAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdGraceUseTimeAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdHistoryAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdLastSuccessAT |
private PpolicyConfigContainer |
pwdPolicyContainer
a container to hold all the ppolicies
|
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdPolicySubentryAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdResetAT |
private org.apache.directory.api.ldap.model.schema.AttributeType |
pwdStartTimeAT |
directoryService, dnFactory, PWD_POLICY_STATE_ATTRIBUTE_TYPES, schemaManager| Constructor and Description |
|---|
AuthenticationInterceptor()
Creates an authentication service interceptor.
|
| Modifier and Type | Method and Description |
|---|---|
void |
add(AddOperationContext addContext)
Filters
Partition#add( AddOperationContext ) call. |
void |
bind(BindOperationContext bindContext)
Filters
Partition#bind( BindOperationContext ) call. |
(package private) org.apache.directory.api.ldap.model.entry.Modification |
buildPwdHistory(ModifyOperationContext modifyContext,
org.apache.directory.api.ldap.model.entry.Attribute pwdHistoryAt,
int histSize,
byte[] newPassword,
boolean isPPolicyReqCtrlPresent)
Build the list of passwordHistory
|
private void |
check(OperationContext operationContext,
org.apache.directory.api.ldap.model.entry.Entry entry,
byte[] password,
PasswordPolicyConfiguration policyConfig) |
private void |
checkAuthenticated(OperationContext operation)
Check if the current operation has a valid PrincipalDN or not.
|
private void |
checkChangePwdAllowed(ModifyOperationContext modifyContext,
PasswordPolicyConfiguration policyConfig,
boolean isPPolicyReqCtrlPresent)
check that if the password modification is allowed by the PP config, or if the session is
the admin.
|
private void |
checkOldPwdRequired(ModifyOperationContext modifyContext,
PasswordPolicyConfiguration policyConfig,
AuthenticationInterceptor.PwdModDetailsHolder pwdModDetails,
boolean isPPolicyReqCtrlPresent)
If the PP config request it, the old password must be supplied in the modifications.
|
private void |
checkPwdMustChange(ModifyOperationContext modifyContext,
CoreSession userSession,
AuthenticationInterceptor.PwdModDetailsHolder pwdModDetails,
boolean isPPolicyReqCtrlPresent)
Check if the password has to be changed, but can't.
|
private void |
checkPwdReset(OperationContext opContext)
checks to see if the user's password should be changed before performing any operations
other than bind, password update, unbind, abandon or StartTLS
|
boolean |
compare(CompareOperationContext compareContext)
Filters
DefaultPartitionNexus#compare( CompareOperationContext ) call. |
void |
delete(DeleteOperationContext deleteContext)
Filters
Partition#delete( DeleteOperationContext ) call. |
void |
destroy()
Deinitializes and deregisters all
Authenticators from this service. |
java.util.Set<Authenticator> |
getAuthenticators() |
private java.util.Collection<Authenticator> |
getAuthenticators(org.apache.directory.api.ldap.model.constants.AuthenticationLevel type)
Returns the list of
Authenticators with the specified type. |
private AuthenticationInterceptor.PwdModDetailsHolder |
getPwdModDetails(ModifyOperationContext modifyContext,
PasswordPolicyConfiguration policyConfig) |
PasswordPolicyConfiguration |
getPwdPolicy(org.apache.directory.api.ldap.model.entry.Entry userEntry)
Gets the effective password policy of the given entry.
|
PpolicyConfigContainer |
getPwdPolicyContainer() |
private int |
getPwdTimeBeforeExpiry(org.apache.directory.api.ldap.model.entry.Entry userEntry,
PasswordPolicyConfiguration policyConfig) |
org.apache.directory.api.ldap.model.entry.Entry |
getRootDse(GetRootDseOperationContext getRootDseContext)
Filters
DefaultPartitionNexus#getRootDse( GetRootDseOperationContext ) call. |
boolean |
hasEntry(HasEntryOperationContext hasEntryContext)
Filters
Partition#hasEntry( HasEntryOperationContext ) call. |
void |
init(DirectoryService directoryService)
Registers and initializes all
Authenticators to this service. |
private void |
invalidateAuthenticatorCaches(org.apache.directory.api.ldap.model.name.Dn principalDn) |
private boolean |
isPwdMustReset(org.apache.directory.api.ldap.model.entry.Entry userEntry)
checks if the password must be changed after the initial bind
|
boolean |
isPwdPolicyEnabled() |
private boolean |
isPwdTooYoung(OperationContext operationContext,
org.apache.directory.api.ldap.model.entry.Entry userEntry,
PasswordPolicyConfiguration policyConfig)
checks if the password is too young
|
void |
loadPwdPolicyStateAttributeTypes()
Initialize the PasswordPolicy attributeTypes
|
org.apache.directory.api.ldap.model.entry.Entry |
lookup(LookupOperationContext lookupContext)
Filters
Partition#lookup( LookupOperationContext ) call. |
void |
modify(ModifyOperationContext modifyContext)
Filters
Partition#modify( ModifyOperationContext ) call. |
void |
move(MoveOperationContext moveContext)
Filters
Partition#move( MoveOperationContext ) call. |
void |
moveAndRename(MoveAndRenameOperationContext moveAndRenameContext)
Filters
Partition#moveAndRename( MoveAndRenameOperationContext) call. |
private void |
processModifyAddPwdAttributes(org.apache.directory.api.ldap.model.entry.Entry entry,
java.util.List<org.apache.directory.api.ldap.model.entry.Modification> mods,
AuthenticationInterceptor.PwdModDetailsHolder pwdModDetails)
Add the passwordPolicy related Attributes from the modified entry
|
private void |
processPasswordPolicydModify(ModifyOperationContext modifyContext)
Proceed with the Modification operation when the PasswordPolicy is activated.
|
private void |
processStandardModify(ModifyOperationContext modifyContext)
Proceed with the Modification operation when the PasswordPolicy is not activated.
|
private void |
purgeFailureTimes(PasswordPolicyConfiguration config,
org.apache.directory.api.ldap.model.entry.Attribute pwdFailTimeAt)
purges failure timestamps which are older than the configured interval
(section 7.6 in the draft)
|
private void |
register(Authenticator authenticator,
DirectoryService directoryService)
Initializes the specified
Authenticator and registers it to
this service. |
void |
rename(RenameOperationContext renameContext)
Filters
Partition#rename( RenameOperationContext ) call. |
EntryFilteringCursor |
search(SearchOperationContext searchContext)
Filters
Partition#search( SearchOperationContext ) call. |
private Authenticator |
selectAuthenticator(org.apache.directory.api.ldap.model.name.Dn bindDn,
org.apache.directory.api.ldap.model.constants.AuthenticationLevel level)
Return the selected authenticator given the DN and the level required.
|
void |
setAuthenticators(Authenticator[] authenticators) |
void |
setAuthenticators(java.util.Set<Authenticator> authenticators) |
private void |
setDefaultAuthenticators()
Initialize the set of authenticators with some default values
|
void |
setPwdPolicies(PpolicyConfigContainer policyContainer)
set all the password policies to be used by the server.
|
void |
setPwdPolicyContainer(PpolicyConfigContainer pwdPolicyContainer) |
void |
unbind(UnbindOperationContext unbindContext)
Filters
Partition#unbind( UnbindOperationContext ) call. |
private void |
validatePasswordLength(java.lang.String password,
PasswordPolicyConfiguration policyConfig)
validates the length of the password
|
private static final org.slf4j.Logger LOG
private static final boolean IS_DEBUG
private java.util.Set<Authenticator> authenticators
private final java.util.Map<org.apache.directory.api.ldap.model.constants.AuthenticationLevel,java.util.Collection<Authenticator>> authenticatorsMapByType
private CoreSession adminSession
private org.apache.directory.api.ldap.model.schema.AttributeType pwdResetAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdChangedTimeAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdHistoryAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdFailurTimeAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdAccountLockedTimeAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdLastSuccessAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdGraceUseTimeAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdPolicySubentryAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdStartTimeAT
private org.apache.directory.api.ldap.model.schema.AttributeType pwdEndTimeAT
private PpolicyConfigContainer pwdPolicyContainer
public AuthenticationInterceptor()
public void init(DirectoryService directoryService) throws org.apache.directory.api.ldap.model.exception.LdapException
Authenticators to this service.init in interface Interceptorinit in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void setDefaultAuthenticators()
public java.util.Set<Authenticator> getAuthenticators()
public void setAuthenticators(java.util.Set<Authenticator> authenticators)
authenticators - authenticators to be used by this AuthenticationInterceptorpublic void setAuthenticators(Authenticator[] authenticators)
authenticators - authenticators to be used by this AuthenticationInterceptorpublic void destroy()
Authenticators from this service.destroy in interface Interceptordestroy in class BaseInterceptorprivate void register(Authenticator authenticator, DirectoryService directoryService) throws org.apache.directory.api.ldap.model.exception.LdapException
Authenticator and registers it to
this service.authenticator - Authenticator to initialize and register by typedirectoryService - configuration info to supply to the Authenticator during initializationjavax.naming.Exception - if initialization fails.org.apache.directory.api.ldap.model.exception.LdapExceptionprivate java.util.Collection<Authenticator> getAuthenticators(org.apache.directory.api.ldap.model.constants.AuthenticationLevel type)
Authenticators with the specified type.type - type of Authenticator soughtpublic void add(AddOperationContext addContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#add( AddOperationContext ) call.add in interface Interceptoradd in class BaseInterceptoraddContext - The AddOperationContext instanceorg.apache.directory.api.ldap.model.exception.LdapException - If we had some error while processing the Add operationprivate Authenticator selectAuthenticator(org.apache.directory.api.ldap.model.name.Dn bindDn, org.apache.directory.api.ldap.model.constants.AuthenticationLevel level) throws org.apache.directory.api.ldap.model.exception.LdapUnwillingToPerformException, org.apache.directory.api.ldap.model.exception.LdapAuthenticationException
org.apache.directory.api.ldap.model.exception.LdapUnwillingToPerformExceptionorg.apache.directory.api.ldap.model.exception.LdapAuthenticationExceptionpublic void bind(BindOperationContext bindContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#bind( BindOperationContext ) call.bind in interface Interceptorbind in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic boolean compare(CompareOperationContext compareContext) throws org.apache.directory.api.ldap.model.exception.LdapException
DefaultPartitionNexus#compare( CompareOperationContext ) call.compare in interface Interceptorcompare in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void delete(DeleteOperationContext deleteContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#delete( DeleteOperationContext ) call.delete in interface Interceptordelete in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic org.apache.directory.api.ldap.model.entry.Entry getRootDse(GetRootDseOperationContext getRootDseContext) throws org.apache.directory.api.ldap.model.exception.LdapException
DefaultPartitionNexus#getRootDse( GetRootDseOperationContext ) call.getRootDse in interface InterceptorgetRootDse in class BaseInterceptorgetRootDseContext - The getRoot() operation contextorg.apache.directory.api.ldap.model.exception.LdapException - If we can't get back the RootDSE entrypublic boolean hasEntry(HasEntryOperationContext hasEntryContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#hasEntry( HasEntryOperationContext ) call.hasEntry in interface InterceptorhasEntry in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic org.apache.directory.api.ldap.model.entry.Entry lookup(LookupOperationContext lookupContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#lookup( LookupOperationContext ) call.lookup in interface Interceptorlookup in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void invalidateAuthenticatorCaches(org.apache.directory.api.ldap.model.name.Dn principalDn)
public void modify(ModifyOperationContext modifyContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#modify( ModifyOperationContext ) call.modify in interface Interceptormodify in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void processStandardModify(ModifyOperationContext modifyContext) throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void processPasswordPolicydModify(ModifyOperationContext modifyContext) throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionorg.apache.directory.api.ldap.model.entry.Modification buildPwdHistory(ModifyOperationContext modifyContext, org.apache.directory.api.ldap.model.entry.Attribute pwdHistoryAt, int histSize, byte[] newPassword, boolean isPPolicyReqCtrlPresent) throws org.apache.directory.api.ldap.model.exception.LdapOperationException
org.apache.directory.api.ldap.model.exception.LdapOperationExceptionprivate void processModifyAddPwdAttributes(org.apache.directory.api.ldap.model.entry.Entry entry,
java.util.List<org.apache.directory.api.ldap.model.entry.Modification> mods,
AuthenticationInterceptor.PwdModDetailsHolder pwdModDetails)
private void checkPwdMustChange(ModifyOperationContext modifyContext, CoreSession userSession, AuthenticationInterceptor.PwdModDetailsHolder pwdModDetails, boolean isPPolicyReqCtrlPresent) throws org.apache.directory.api.ldap.model.exception.LdapNoPermissionException
org.apache.directory.api.ldap.model.exception.LdapNoPermissionExceptionprivate void checkOldPwdRequired(ModifyOperationContext modifyContext, PasswordPolicyConfiguration policyConfig, AuthenticationInterceptor.PwdModDetailsHolder pwdModDetails, boolean isPPolicyReqCtrlPresent) throws org.apache.directory.api.ldap.model.exception.LdapNoPermissionException
org.apache.directory.api.ldap.model.exception.LdapNoPermissionExceptionprivate void checkChangePwdAllowed(ModifyOperationContext modifyContext, PasswordPolicyConfiguration policyConfig, boolean isPPolicyReqCtrlPresent) throws org.apache.directory.api.ldap.model.exception.LdapNoPermissionException
org.apache.directory.api.ldap.model.exception.LdapNoPermissionExceptionpublic void move(MoveOperationContext moveContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#move( MoveOperationContext ) call.move in interface Interceptormove in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void moveAndRename(MoveAndRenameOperationContext moveAndRenameContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#moveAndRename( MoveAndRenameOperationContext) call.moveAndRename in interface InterceptormoveAndRename in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void rename(RenameOperationContext renameContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#rename( RenameOperationContext ) call.rename in interface Interceptorrename in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic EntryFilteringCursor search(SearchOperationContext searchContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#search( SearchOperationContext ) call.search in interface Interceptorsearch in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void unbind(UnbindOperationContext unbindContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Partition#unbind( UnbindOperationContext ) call.unbind in interface Interceptorunbind in class BaseInterceptororg.apache.directory.api.ldap.model.exception.LdapExceptionprivate void checkAuthenticated(OperationContext operation) throws org.apache.directory.api.ldap.model.exception.LdapException
operation - the operation typejava.lang.Exceptionorg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void loadPwdPolicyStateAttributeTypes()
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapException - If the initialization failedprivate void check(OperationContext operationContext, org.apache.directory.api.ldap.model.entry.Entry entry, byte[] password, PasswordPolicyConfiguration policyConfig) throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void validatePasswordLength(java.lang.String password,
PasswordPolicyConfiguration policyConfig)
throws PasswordPolicyException
PasswordPolicyExceptionprivate int getPwdTimeBeforeExpiry(org.apache.directory.api.ldap.model.entry.Entry userEntry,
PasswordPolicyConfiguration policyConfig)
throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate boolean isPwdTooYoung(OperationContext operationContext, org.apache.directory.api.ldap.model.entry.Entry userEntry, PasswordPolicyConfiguration policyConfig) throws org.apache.directory.api.ldap.model.exception.LdapException
userEntry - the user's entryorg.apache.directory.api.ldap.model.exception.LdapExceptionprivate boolean isPwdMustReset(org.apache.directory.api.ldap.model.entry.Entry userEntry)
throws org.apache.directory.api.ldap.model.exception.LdapException
userEntry - the user's entryorg.apache.directory.api.ldap.model.exception.LdapExceptionprivate AuthenticationInterceptor.PwdModDetailsHolder getPwdModDetails(ModifyOperationContext modifyContext, PasswordPolicyConfiguration policyConfig) throws org.apache.directory.api.ldap.model.exception.LdapException
org.apache.directory.api.ldap.model.exception.LdapExceptionprivate void checkPwdReset(OperationContext opContext) throws org.apache.directory.api.ldap.model.exception.LdapException
opContext - the operation's contextorg.apache.directory.api.ldap.model.exception.LdapExceptionpublic PasswordPolicyConfiguration getPwdPolicy(org.apache.directory.api.ldap.model.entry.Entry userEntry) throws org.apache.directory.api.ldap.model.exception.LdapException
userEntry - the user's entryorg.apache.directory.api.ldap.model.exception.LdapExceptionpublic void setPwdPolicies(PpolicyConfigContainer policyContainer)
policyContainer - the container holding all the password policiespublic boolean isPwdPolicyEnabled()
public PpolicyConfigContainer getPwdPolicyContainer()
public void setPwdPolicyContainer(PpolicyConfigContainer pwdPolicyContainer)
pwdPolicyContainer - the pwdPolicyContainer to setprivate void purgeFailureTimes(PasswordPolicyConfiguration config, org.apache.directory.api.ldap.model.entry.Attribute pwdFailTimeAt)