JResourceLDAP.java

package org.objectweb.jonas.security.realm.factory;

import java.security.NoSuchAlgorithmException;
import java.text.MessageFormat;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Hashtable;
import java.util.Iterator;
import java.util.Vector;

import javax.naming.AuthenticationException;
import javax.naming.Context;
import javax.naming.Name;
import javax.naming.NameParser;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;

import org.objectweb.util.monolog.api.BasicLevel;

import org.objectweb.jonas.security.realm.lib.HashHelper;
import org.objectweb.jonas.security.realm.principals.LDAPUser;
import org.objectweb.jonas.security.realm.principals.User;

public class JResourceLDAP extends JResource implements JResourceLDAPMBean {

    private static final String FACTORY_TYPE = "org.objectweb.jonas.security.realm.factory.JResourceLDAP";

    private static final String FACTORY_NAME = "org.objectweb.jonas.security.realm.factory.JResourceLDAPFactory";

    private static final String BIND_AUTHENTICATION_MODE = "bind";

    private static final String COMPARE_AUTHENTICATION_MODE = "compare";

    private String initialContextFactory = null;

    private String providerUrl = null;

    private String securityAuthentication = null;

    private String securityPrincipal = null;

    private String securityCredentials = null;

    private String securityProtocol = null;

    private String language = null;

    private String referral = null;

    private String stateFactories = null;

    private String authenticationMode = null;

    private String userPasswordAttribute = null;

    private String userRolesAttribute = null;

    private String roleNameAttribute = null;

    private String baseDN = null;

    private String userDN = null;

    private String userSearchFilter = null;

    private String roleDN = null;

    private String roleSearchFilter = null;

    private String algorithm = null;

    public JResourceLDAP() throws Exception {
        super();
    }

    public User findUser(String username) throws JResourceException {

        // No username. failed
        if (username == null) {
            return null;
        }

        // User to return
        LDAPUser user = new LDAPUser();
        user.setName(username);
        try {

            // Attributes for performing the search
            DirContext dirContext = getDirContext();
            SearchControls sctls = new SearchControls();

            String[] attributes = null;
            if (authenticationMode.equals(COMPARE_AUTHENTICATION_MODE)) {
                attributes = new String[] {userPasswordAttribute, userRolesAttribute};
            } else {
                attributes = new String[0];
            }
            sctls.setReturningAttributes(attributes);
            sctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "userDN = '" + userDN + "'");
                getLogger().log(BasicLevel.DEBUG, "baseDN = '" + baseDN + "'");
            }

            String lookupUserDN = null;
            // DN of the user. If no specific user DN, use the baseDN
            if (userDN != null && !userDN.equals("")) {
                lookupUserDN = userDN.concat(",").concat(baseDN);
            } else {
                lookupUserDN = baseDN;
            }
            Object[] arguments = {username};
            lookupUserDN = MessageFormat.format(lookupUserDN, arguments);
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "lookupUserDN = '" + lookupUserDN + "'");
            }

            // Search the DN with the user filter with the specific argument and
            // specific search controls
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "search : lookupUserDN = '" + lookupUserDN + "', searchFilter = '"
                        + userSearchFilter + "', username = '" + username + "'");
            }
            NamingEnumeration answer = dirContext
                    .search(lookupUserDN, userSearchFilter, new Object[] {username}, sctls);
            // No answer
            if (answer == null || !answer.hasMore()) {
                if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                    if (answer == null) {
                        getLogger().log(BasicLevel.DEBUG, "answer is null");
                    } else {
                        getLogger().log(BasicLevel.DEBUG, "no anwser");
                    }
                }
                return null;
            }

            // Get first answer
            SearchResult firstAnswer = (SearchResult) answer.next();
            // More than one answer. Not so good.
            if (answer.hasMore()) {
                return null;
            }

            // Build full User DN
            NameParser nameParser = dirContext.getNameParser("");
            Name contextName = nameParser.parse(dirContext.getNameInNamespace());

            // Add the lookupUserDN to the context name -> baseDN
            Name baseDNName = contextName.addAll(nameParser.parse(lookupUserDN));

            // Add the uid retrieve from the search to the baseDN --> user DN
            Name userFullDN = baseDNName.addAll(nameParser.parse(firstAnswer.getName()));
            user.setDN(userFullDN.toString());

            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "DN found : '" + userFullDN + "'");
            }

            // Get the user attributes
            Attributes userAttributes = firstAnswer.getAttributes();
            if (userAttributes == null) {
                if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                    getLogger().log(BasicLevel.DEBUG, "No user attributes found");
                }
                return null;
            }

            String password = null;
            // Retrieve password if in compare mode
            if (authenticationMode.equals(COMPARE_AUTHENTICATION_MODE)) {
                password = readValueFromAttribute(userPasswordAttribute, userAttributes);
                if (password != null) {
                    user.setPassword(password);
                }
            }

            // Add the roles which are found from the user
            String roles = readValuesFromAttribute(userRolesAttribute, userAttributes);
            user.setRoles(roles);

        } catch (javax.naming.NamingException ne) {
            throw new JResourceException("Could not find user :" + ne.getMessage());
        }
        return user;
    }

    public boolean isValidUser(User user, String credentials) {

        // null password ... can't authenticate
        if (credentials == null || user == null) {
            return false;
        }

        // Choose the right method
        if (authenticationMode.equals(COMPARE_AUTHENTICATION_MODE)) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "Compare mode");
            }
            return isValidUserCompare(user, credentials);
        } else if (authenticationMode.equals(BIND_AUTHENTICATION_MODE)) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "Bind mode");
            }
            return isValidUserBind(user, credentials);
        } else {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "No authentication mode found, return false");
            }
            return false;
        }

    }

    public boolean isValidUserBind(User user, String credentials) {

        // Get the DN of the ldap user
        if (!(user instanceof LDAPUser)) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "Not instance of LDAPUser");
            }
            return false;
        }

        String dn = ((LDAPUser) user).getDN();
        if (dn == null) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "No DN found in User");
            }
            return false;
        }

        //Make our env
        Hashtable env = getEnvInitialDirContext();
        env.put(Context.SECURITY_PRINCIPAL, dn);
        env.put(Context.SECURITY_CREDENTIALS, credentials);

        boolean validated = false;
        try {
            DirContext dirContext = new InitialDirContext(env);
            validated = true;
            dirContext.close();
        } catch (AuthenticationException e) {
            // not validated
            getLogger().log(BasicLevel.ERROR, "Can't make an initial dir context : " + e.getMessage());
        } catch (NamingException ne) {
            // not validated
            getLogger().log(BasicLevel.ERROR, "Naming exception " + ne.getMessage());
        }
        return validated;
    }

    public boolean isValidUserCompare(User user, String credentials) {

        boolean validated = false;

        //Get algorithm and hashpassword
        String pass = user.getHashPassword().getPassword();
        String algo = user.getHashPassword().getAlgorithm();

        // Crypt password ?
        if (algo != null && pass != null) {
            try {
                validated = HashHelper.hashPassword(credentials, algo).equalsIgnoreCase(pass);
            } catch (NoSuchAlgorithmException nsae) {
                getLogger().log(BasicLevel.ERROR, "Can't make a password with the algorithm " + algo + ". "
                        + nsae.getMessage());
            }
        } else if ((algorithm != null) && (!algorithm.equals(""))) {
            // Encode password with the specified algorithm (no clear)
            try {
                validated = HashHelper.hashPassword(credentials, algorithm).equalsIgnoreCase(pass);
            } catch (NoSuchAlgorithmException nsae) {
                getLogger().log(BasicLevel.ERROR, "Can't make a password with the algorithm " + algorithm + ". "
                        + nsae.getMessage());
            }
        } else {
            // clear
            validated = credentials.equals(pass);
        }
        return validated;
    }

    public ArrayList getArrayListCombinedRoles(User user) throws JResourceException {

        ArrayList allCombinedRoles = new ArrayList();
        // Return empty array if user null
        if (user == null) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "User is empty, return empty array of roles");
            }
            return allCombinedRoles;
        }

        // Add all user roles found with the user ldap entry
        String[] userRoles = user.getArrayRoles();
        for (int r = 0; r < userRoles.length; r++) {
            String roleName = userRoles[r];
            if (!allCombinedRoles.contains(roleName)) {
                allCombinedRoles.add(roleName);
            }
        }

        // Add roles found in ldap
        if (!(user instanceof LDAPUser)) {
            return allCombinedRoles;
        }
        String dn = ((LDAPUser) user).getDN();

        // No valid info
        if (dn == null) {
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "DN of user is empty, return empty array of roles");
            }
            return allCombinedRoles;
        }

        try {
            // Attributes for performing the search
            DirContext dirContext = getDirContext();
            SearchControls sctls = new SearchControls();

            String[] attributes = new String[] {roleNameAttribute};
            sctls.setReturningAttributes(attributes);
            sctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "roleDN = '" + roleDN + "'");
                getLogger().log(BasicLevel.DEBUG, "baseDN = '" + baseDN + "'");
            }

            // DN of the role. If no specific role DN, use the baseDN
            String lookupRoleDN = null;
            if ((roleDN != null) && (!roleDN.equals(""))) {
                lookupRoleDN = roleDN.concat(",").concat(baseDN);
            } else {
                lookupRoleDN = baseDN;
            }

            // Search the DN with the role filter with the specific argument and
            // specific search controls
            if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                getLogger().log(BasicLevel.DEBUG, "search with lookupRoleDN = '" + lookupRoleDN + "', rolesearchFilter = '"
                        + roleSearchFilter + "', dn = '" + dn + "'");
            }

            NamingEnumeration answers = dirContext.search(lookupRoleDN, roleSearchFilter, new Object[] {dn}, sctls);

            if (answers == null) {
                if (getLogger().isLoggable(BasicLevel.DEBUG)) {
                    getLogger().log(BasicLevel.DEBUG, "answer is null");
                }
                return allCombinedRoles;
            }

            Vector vRoles = new Vector();
            while (answers.hasMore()) {
                SearchResult answer = (SearchResult) answers.next();
                Attributes roleAttributes = answer.getAttributes();
                if (roleAttributes == null) {
                    continue;
                }
                addValueFromAttributeToVector(roleNameAttribute, roleAttributes, vRoles);
            }

            for (Enumeration e = vRoles.elements(); e.hasMoreElements();) {
                String roleName = (String) e.nextElement();
                if (!allCombinedRoles.contains(roleName)) {
                    allCombinedRoles.add(roleName);
                }
            }
        } catch (javax.naming.NamingException ne) {
            throw new JResourceException("Could not find roles from the user :" + ne.getMessage());
        }
        user.setCombinedRoles(allCombinedRoles);
        if (getLogger().isLoggable(BasicLevel.DEBUG)) {
            StringBuffer rolesStr = new StringBuffer();
            for (Iterator it = allCombinedRoles.iterator(); it.hasNext();) {
                rolesStr.append((String) it.next());
                rolesStr.append(",");
            }
            getLogger().log(BasicLevel.DEBUG, "Roles are : " + rolesStr + " for user '" + user.getName() + "'");
        }

        return allCombinedRoles;
    }

    public String toXML() {

        // Required values

        StringBuffer xml = new StringBuffer("    <ldaprealm name=\"");
        xml.append(getName());

        xml.append("\"\n               baseDN=\"");
        if (baseDN != null) {
            xml.append(baseDN);
        }

        if ((initialContextFactory != null) && (!initialContextFactory.equals(""))) {
            xml.append("\"\n               initialContextFactory=\"");
            xml.append(initialContextFactory);
        }

        if ((providerUrl != null) && (!providerUrl.equals(""))) {
            xml.append("\"\n               providerUrl=\"");
            xml.append(providerUrl);
        }

        if ((securityAuthentication != null) && (!securityAuthentication.equals(""))) {
            xml.append("\"\n               securityAuthentication=\"");
            xml.append(securityAuthentication);
        }

        if ((securityPrincipal != null) && (!securityPrincipal.equals(""))) {
            xml.append("\"\n               securityPrincipal=\"");
            xml.append(securityPrincipal);
        }

        if ((securityCredentials != null) && (!securityCredentials.equals(""))) {
            xml.append("\"\n               securityCredentials=\"");
            xml.append(securityCredentials);
        }

        if ((authenticationMode != null) && (!authenticationMode.equals(""))) {
            xml.append("\"\n               authenticationMode=\"");
            xml.append(authenticationMode);
        }

        if ((userPasswordAttribute != null) && (!userPasswordAttribute.equals(""))) {
            xml.append("\"\n               userPasswordAttribute=\"");
            xml.append(userPasswordAttribute);
        }

        if ((userRolesAttribute != null) && (!userRolesAttribute.equals(""))) {
            xml.append("\"\n               userRolesAttribute=\"");
            xml.append(userRolesAttribute);
        }

        if ((roleNameAttribute != null) && (!roleNameAttribute.equals(""))) {
            xml.append("\"\n               roleNameAttribute=\"");
            xml.append(roleNameAttribute);
        }

        if ((userDN != null) && (!userDN.equals(""))) {
            xml.append("\"\n               userDN=\"");
            xml.append(userDN);
        }

        if ((userSearchFilter != null) && (!userSearchFilter.equals(""))) {
            xml.append("\"\n               userSearchFilter=\"");
            xml.append(userSearchFilter);
        }

        if ((roleDN != null) && (!roleDN.equals(""))) {
            xml.append("\"\n               roleDN=\"");
            xml.append(roleDN);
        }

        if ((roleSearchFilter != null) && (!roleSearchFilter.equals(""))) {
            xml.append("\"\n               roleSearchFilter=\"");
            xml.append(roleSearchFilter);
        }

        // Optional values
        if ((securityProtocol != null) && (!securityProtocol.equals(""))) {
            xml.append("\"\n               securityProtocol=\"");
            xml.append(securityProtocol);
        }

        if ((language != null) && (!language.equals(""))) {
            xml.append("\"\n               language=\"");
            xml.append(language);
        }

        if ((referral != null) && (!referral.equals(""))) {
            xml.append("\"\n               referral=\"");
            xml.append(referral);
        }

        if ((stateFactories != null) && (!stateFactories.equals(""))) {
            xml.append("\"\n               stateFactories=\"");
            xml.append(stateFactories);
        }

        if ((algorithm != null) && (!algorithm.equals(""))) {
            xml.append("\"\n               algorithm=\"");
            xml.append(algorithm);
        }

        xml.append("\" />");

        return xml.toString();
    }

    public String toString() {
        return this.toXML();
    }

    public Reference getReference() throws NamingException {

        // Build the reference to the factory FACTORY_TYPE
        Reference reference = new Reference(FACTORY_TYPE, FACTORY_NAME, null);

        // Add ref addr
        reference.add(new StringRefAddr("name", getName()));
        reference.add(new StringRefAddr("initialContextFactory", getInitialContextFactory()));
        reference.add(new StringRefAddr("providerUrl", getProviderUrl()));
        reference.add(new StringRefAddr("securityAuthentication", getSecurityAuthentication()));
        reference.add(new StringRefAddr("securityPrincipal", getSecurityPrincipal()));
        reference.add(new StringRefAddr("securityCredentials", getSecurityCredentials()));
        reference.add(new StringRefAddr("securityProtocol", getSecurityProtocol()));
        reference.add(new StringRefAddr("language", getLanguage()));
        reference.add(new StringRefAddr("referral", getReferral()));
        reference.add(new StringRefAddr("stateFactories", getStateFactories()));
        reference.add(new StringRefAddr("authenticationMode", getAuthenticationMode()));
        reference.add(new StringRefAddr("userPasswordAttribute", getUserPasswordAttribute()));
        reference.add(new StringRefAddr("userRolesAttribute", getUserRolesAttribute()));
        reference.add(new StringRefAddr("roleNameAttribute", getRoleNameAttribute()));
        reference.add(new StringRefAddr("baseDN", getBaseDN()));
        reference.add(new StringRefAddr("userDN", getUserDN()));
        reference.add(new StringRefAddr("userSearchFilter", getUserSearchFilter()));
        reference.add(new StringRefAddr("roleDN", getRoleDN()));
        reference.add(new StringRefAddr("roleSearchFilter", getRoleSearchFilter()));
        reference.add(new StringRefAddr("algorithm", algorithm));

        return reference;
    }


    public void setInitialContextFactory(String initialContextFactory) {
        this.initialContextFactory = initialContextFactory;
    }

    public void setProviderUrl(String providerUrl) {
        this.providerUrl = providerUrl;
    }

    public void setSecurityAuthentication(String securityAuthentication) {
        this.securityAuthentication = securityAuthentication;
    }

    public void setSecurityPrincipal(String securityPrincipal) {
        this.securityPrincipal = securityPrincipal;
    }

    public void setSecurityCredentials(String securityCredentials) {
        this.securityCredentials = securityCredentials;
    }

    public void setSecurityProtocol(String securityProtocol) {
        this.securityProtocol = securityProtocol;
    }

    public void setLanguage(String language) {
        this.language = language;
    }

    public void setReferral(String referral) {
        this.referral = referral;
    }

    public void setStateFactories(String stateFactories) {
        this.stateFactories = stateFactories;
    }

    public void setAuthenticationMode(String authenticationMode) {
        this.authenticationMode = authenticationMode;
    }

    public void setUserPasswordAttribute(String userPasswordAttribute) {
        this.userPasswordAttribute = userPasswordAttribute;
    }

    public void setUserRolesAttribute(String userRolesAttribute) {
        this.userRolesAttribute = userRolesAttribute;
    }

    public void setRoleNameAttribute(String roleNameAttribute) {
        this.roleNameAttribute = roleNameAttribute;
    }

    public void setBaseDN(String baseDN) {
        // empty value can't be set
        if ((baseDN != null) && (!baseDN.equals(""))) {
            this.baseDN = baseDN;
        }
    }

    public void setUserDN(String userDN) {
        if ((userDN != null) && (!userDN.equals(""))) {
            this.userDN = userDN;
        }
    }

    public void setUserSearchFilter(String userSearchFilter) {
        this.userSearchFilter = userSearchFilter;
    }

    public void setRoleDN(String roleDN) {
        this.roleDN = roleDN;
    }

    public void setRoleSearchFilter(String roleSearchFilter) {
        this.roleSearchFilter = roleSearchFilter;
    }

    public void setAlgorithm(String algorithm) {
        this.algorithm = algorithm;
    }

    public String getInitialContextFactory() {
        return initialContextFactory;
    }

    public String getProviderUrl() {
        return providerUrl;
    }

    public String getSecurityAuthentication() {
        return securityAuthentication;
    }

    public String getSecurityPrincipal() {
        return securityPrincipal;
    }

    public String getSecurityCredentials() {
        return securityCredentials;
    }

    public String getSecurityProtocol() {
        return securityProtocol;
    }

    public String getLanguage() {
        return language;
    }

    public String getReferral() {
        return referral;
    }

    public String getStateFactories() {
        return stateFactories;
    }

    public String getAuthenticationMode() {
        return authenticationMode;
    }

    public String getUserPasswordAttribute() {
        return userPasswordAttribute;
    }

    public String getUserRolesAttribute() {
        return userRolesAttribute;
    }

    public String getRoleNameAttribute() {
        return roleNameAttribute;
    }

    public String getBaseDN() {
        return baseDN;
    }

    public String getUserDN() {
        return userDN;
    }

    public String getUserSearchFilter() {
        return userSearchFilter;
    }

    public String getRoleDN() {
        return roleDN;
    }

    public String getRoleSearchFilter() {
        return roleSearchFilter;
    }

    public String getAlgorithm() {
        return algorithm;
    }

    protected DirContext getDirContext() throws NamingException {
        DirContext dirContext = null;
        // Get the InitialDirContext with our env
        dirContext = new InitialDirContext(getEnvInitialDirContext());

        return dirContext;
    }

    private Hashtable getEnvInitialDirContext() {

        // The environment is a hashtable
        Hashtable env = new Hashtable();
        env.put(Context.INITIAL_CONTEXT_FACTORY, initialContextFactory);
        env.put(Context.PROVIDER_URL, providerUrl);
        env.put(Context.SECURITY_AUTHENTICATION, securityAuthentication);
        if ((securityPrincipal != null) && (!securityPrincipal.equals(""))) {
            env.put(Context.SECURITY_PRINCIPAL, securityPrincipal);
        }
        if ((securityCredentials != null) && (!securityCredentials.equals(""))) {
            env.put(Context.SECURITY_CREDENTIALS, securityCredentials);
        }
        if ((language != null) && (!language.equals(""))) {
            env.put(Context.LANGUAGE, language);
        }
        if ((referral != null) && (!referral.equals(""))) {
            env.put(Context.REFERRAL, referral);
        }
        if ((securityProtocol != null) && (!securityProtocol.equals(""))) {
            env.put(Context.SECURITY_PROTOCOL, securityProtocol);
        }
        if ((stateFactories != null) && (!stateFactories.equals(""))) {
            env.put(Context.STATE_FACTORIES, stateFactories);
        }
        return env;
    }

    private String readValueFromAttribute(String attrID, Attributes attributes) throws NamingException {

        // No attributes or the attrID is null (must be a non null attribute)
        if (attributes == null || attrID == null) {
            return null;
        }

        Attribute attribute = attributes.get(attrID);

        // Attribute not found
        if (attribute == null) {
            return null;
        }

        Object o = attribute.get();
        String value = null;

        if (o instanceof byte[]) {
            value = new String((byte[]) o);
        } else {
            value = o.toString();
        }

        return value;
    }

    private String readValuesFromAttribute(String attrID, Attributes attributes) throws NamingException {

        // No attributes or the attrID is null (must be a non null attribute)
        if (attributes == null || attrID == null) {
            return null;
        }

        Attribute attribute = attributes.get(attrID);

        // Attribute not found
        if (attribute == null) {
            return null;
        }

        String value = null;
        NamingEnumeration e = attribute.getAll();
        while (e.hasMore()) {
            String s = (String) e.next();
            if (value == null) {
                value = s;
            } else {
                value = value + "," + s;
            }
        }
        return value;
    }

    private void addValueFromAttributeToVector(String attrID, Attributes attributes, Vector v) throws NamingException {

        // No attributes or the attrID is null (must be a non null attribute)
        if (attributes == null || attrID == null) {
            return;
        }

        Attribute attribute = attributes.get(attrID);

        // Attribute not found
        if (attribute == null) {
            return;
        }

        NamingEnumeration e = attribute.getAll();
        while (e.hasMore()) {
            v.add(e.next());
        }

    }

    public void removeMBeans() throws JResourceException {
        //no MBeans
    }

}

---