mirror of
https://github.com/apache/zeppelin
synced 2026-05-24 09:38:26 +00:00
imporoving performance of ActiveDirectoryGroupRealm
This commit is contained in:
Prabhjyot Singh
parent
188ac170c7
commit
3e443d7f9c
1 changed files with 135 additions and 126 deletions
|
|
@ -16,12 +16,14 @@
|
|||
*/
|
||||
package org.apache.zeppelin.server;
|
||||
|
||||
import org.apache.shiro.authc.*;
|
||||
import org.apache.shiro.authz.AuthorizationException;
|
||||
import org.apache.shiro.authc.AuthenticationInfo;
|
||||
import org.apache.shiro.authc.AuthenticationToken;
|
||||
import org.apache.shiro.authc.SimpleAuthenticationInfo;
|
||||
import org.apache.shiro.authc.UsernamePasswordToken;
|
||||
import org.apache.shiro.authz.AuthorizationInfo;
|
||||
import org.apache.shiro.authz.SimpleAuthorizationInfo;
|
||||
import org.apache.shiro.realm.Realm;
|
||||
import org.apache.shiro.realm.ldap.AbstractLdapRealm;
|
||||
import org.apache.shiro.realm.ldap.DefaultLdapContextFactory;
|
||||
import org.apache.shiro.realm.ldap.LdapContextFactory;
|
||||
import org.apache.shiro.realm.ldap.LdapUtils;
|
||||
import org.apache.shiro.subject.PrincipalCollection;
|
||||
|
|
@ -39,76 +41,67 @@ import java.util.*;
|
|||
|
||||
|
||||
/**
|
||||
* Created for org.apache.zeppelin.server on 09/06/16.
|
||||
* A {@link Realm} that authenticates with an active directory LDAP
|
||||
* server to determine the roles for a particular user. This implementation
|
||||
* queries for the user's groups and then maps the group names to roles using the
|
||||
* {@link #groupRolesMap}.
|
||||
*
|
||||
* @since 0.1
|
||||
*/
|
||||
public class ActiveDirectoryGroupRealm extends AbstractLdapRealm {
|
||||
|
||||
private static final Logger log = LoggerFactory.getLogger(ActiveDirectoryGroupRealm.class);
|
||||
|
||||
private static final String ROLE_NAMES_DELIMETER = ",";
|
||||
|
||||
/*--------------------------------------------
|
||||
| I N S T A N C E V A R I A B L E S |
|
||||
============================================*/
|
||||
|
||||
/**
|
||||
* Mapping from fully qualified active directory
|
||||
* group names (e.g. CN=Group,OU=Company,DC=MyDomain,DC=local)
|
||||
* as returned by the active directory LDAP server to role names.
|
||||
*/
|
||||
private Map<String, String> groupRolesMap;
|
||||
private LdapContextFactory ldapContextFactory = null;
|
||||
|
||||
public ActiveDirectoryGroupRealm() {
|
||||
}
|
||||
|
||||
public void setLdapContextFactory(LdapContextFactory ldapContextFactory) {
|
||||
this.ldapContextFactory = ldapContextFactory;
|
||||
}
|
||||
|
||||
public LdapContextFactory ensureContextFactory() {
|
||||
if (this.ldapContextFactory == null) {
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("No LdapContextFactory specified - creating a default instance.");
|
||||
}
|
||||
|
||||
DefaultLdapContextFactory defaultFactory = new DefaultLdapContextFactory();
|
||||
defaultFactory.setPrincipalSuffix(this.principalSuffix);
|
||||
defaultFactory.setSearchBase(this.searchBase);
|
||||
defaultFactory.setUrl(this.url);
|
||||
defaultFactory.setSystemUsername(this.systemUsername);
|
||||
defaultFactory.setSystemPassword(this.systemPassword);
|
||||
this.ldapContextFactory = defaultFactory;
|
||||
}
|
||||
|
||||
return this.ldapContextFactory;
|
||||
}
|
||||
|
||||
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
|
||||
throws AuthenticationException {
|
||||
try {
|
||||
AuthenticationInfo info = this.queryForAuthenticationInfo(token, this.ensureContextFactory());
|
||||
return info;
|
||||
} catch (javax.naming.AuthenticationException var5) {
|
||||
throw new AuthenticationException("LDAP authentication failed.", var5);
|
||||
} catch (NamingException var6) {
|
||||
String msg = "LDAP naming error while attempting to authenticate user.";
|
||||
throw new AuthenticationException(msg, var6);
|
||||
}
|
||||
}
|
||||
|
||||
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
|
||||
try {
|
||||
AuthorizationInfo info = this.queryForAuthorizationInfo(principals,
|
||||
this.ensureContextFactory());
|
||||
return info;
|
||||
} catch (NamingException var5) {
|
||||
String msg = "LDAP naming error while attempting to retrieve authorization for user ["
|
||||
+ principals + "].";
|
||||
throw new AuthorizationException(msg, var5);
|
||||
}
|
||||
}
|
||||
/*--------------------------------------------
|
||||
| C O N S T R U C T O R S |
|
||||
============================================*/
|
||||
|
||||
public void setGroupRolesMap(Map<String, String> groupRolesMap) {
|
||||
this.groupRolesMap = groupRolesMap;
|
||||
}
|
||||
|
||||
protected AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token,
|
||||
LdapContextFactory ldapContextFactory)
|
||||
throws NamingException {
|
||||
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
|
||||
LdapContext ctx = null;
|
||||
/*--------------------------------------------
|
||||
| M E T H O D S |
|
||||
============================================*/
|
||||
|
||||
|
||||
/**
|
||||
* Builds an {@link AuthenticationInfo} object by querying the active directory LDAP context for
|
||||
* the specified username. This method binds to the LDAP server using the provided username
|
||||
* and password - which if successful, indicates that the password is correct.
|
||||
* <p/>
|
||||
* This method can be overridden by subclasses to query the LDAP server in a more complex way.
|
||||
*
|
||||
* @param token the authentication token provided by the user.
|
||||
* @param ldapContextFactory the factory used to build connections to the LDAP server.
|
||||
* @return an {@link AuthenticationInfo} instance containing information retrieved from LDAP.
|
||||
* @throws NamingException if any LDAP errors occur during the search.
|
||||
*/
|
||||
protected AuthenticationInfo queryForAuthenticationInfo(
|
||||
AuthenticationToken token, LdapContextFactory ldapContextFactory) throws NamingException {
|
||||
|
||||
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
|
||||
|
||||
// Binds using the username and password provided by the user.
|
||||
LdapContext ctx = null;
|
||||
try {
|
||||
String userPrincipalName = upToken.getUsername();
|
||||
if (userPrincipalName == null) {
|
||||
return null;
|
||||
}
|
||||
if (this.principalSuffix != null) {
|
||||
userPrincipalName = upToken.getUsername() + this.principalSuffix;
|
||||
}
|
||||
|
|
@ -118,115 +111,131 @@ public class ActiveDirectoryGroupRealm extends AbstractLdapRealm {
|
|||
LdapUtils.closeContext(ctx);
|
||||
}
|
||||
|
||||
return this.buildAuthenticationInfo(upToken.getUsername(), upToken.getPassword());
|
||||
return buildAuthenticationInfo(upToken.getUsername(), upToken.getPassword());
|
||||
}
|
||||
|
||||
protected AuthenticationInfo buildAuthenticationInfo(String username, char[] password) {
|
||||
return new SimpleAuthenticationInfo(username, password, this.getName());
|
||||
return new SimpleAuthenticationInfo(username, password, getName());
|
||||
}
|
||||
|
||||
protected AuthorizationInfo queryForAuthorizationInfo(PrincipalCollection principals,
|
||||
LdapContextFactory ldapContextFactory)
|
||||
throws NamingException {
|
||||
String username = (String) this.getAvailablePrincipal(principals);
|
||||
|
||||
/**
|
||||
* Builds an {@link org.apache.shiro.authz.AuthorizationInfo} object by querying the active
|
||||
* directory LDAP context for the groups that a user is a member of. The groups are then
|
||||
* translated to role names by using the configured {@link #groupRolesMap}.
|
||||
* <p/>
|
||||
* This implementation expects the <tt>principal</tt> argument to be a String username.
|
||||
* <p/>
|
||||
* Subclasses can override this method to determine authorization data (roles, permissions, etc)
|
||||
* in a more complex way. Note that this default implementation does not support permissions,
|
||||
* only roles.
|
||||
*
|
||||
* @param principals the principal of the Subject whose account is being retrieved.
|
||||
* @param ldapContextFactory the factory used to create LDAP connections.
|
||||
* @return the AuthorizationInfo for the given Subject principal.
|
||||
* @throws NamingException if an error occurs when searching the LDAP server.
|
||||
*/
|
||||
protected AuthorizationInfo queryForAuthorizationInfo(
|
||||
PrincipalCollection principals,
|
||||
LdapContextFactory ldapContextFactory) throws NamingException {
|
||||
|
||||
String username = (String) getAvailablePrincipal(principals);
|
||||
|
||||
// Perform context search
|
||||
LdapContext ldapContext = ldapContextFactory.getSystemLdapContext();
|
||||
|
||||
Set roleNames;
|
||||
Set<String> roleNames;
|
||||
|
||||
try {
|
||||
roleNames = this.getRoleNamesForUser(username, ldapContext);
|
||||
roleNames = getRoleNamesForUser(username, ldapContext);
|
||||
} finally {
|
||||
LdapUtils.closeContext(ldapContext);
|
||||
}
|
||||
|
||||
return this.buildAuthorizationInfo(roleNames);
|
||||
return buildAuthorizationInfo(roleNames);
|
||||
}
|
||||
|
||||
protected AuthorizationInfo buildAuthorizationInfo(Set<String> roleNames) {
|
||||
return new SimpleAuthorizationInfo(roleNames);
|
||||
}
|
||||
|
||||
public Set<String> getRoleNamesForUser(String username, LdapContext ldapContext)
|
||||
private Set<String> getRoleNamesForUser(String username, LdapContext ldapContext)
|
||||
throws NamingException {
|
||||
LinkedHashSet roleNames = new LinkedHashSet();
|
||||
Set<String> roleNames = new LinkedHashSet<>();
|
||||
|
||||
SearchControls searchCtls = new SearchControls();
|
||||
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
|
||||
String userPrincipalName = username;
|
||||
if (this.principalSuffix != null) {
|
||||
userPrincipalName = username + this.principalSuffix;
|
||||
if (principalSuffix != null) {
|
||||
userPrincipalName += principalSuffix;
|
||||
}
|
||||
|
||||
String searchFilter = "(&(objectClass=*)(userPrincipalName=*))";
|
||||
String searchFilter = "(&(objectClass=*)(userPrincipalName=" + userPrincipalName + "))";
|
||||
Object[] searchArguments = new Object[]{userPrincipalName};
|
||||
NamingEnumeration answer = ldapContext.search(
|
||||
this.searchBase,
|
||||
searchFilter,
|
||||
searchArguments,
|
||||
|
||||
NamingEnumeration answer = ldapContext.search(searchBase, searchFilter, searchArguments,
|
||||
searchCtls);
|
||||
|
||||
while (true) {
|
||||
Attributes attrs;
|
||||
do {
|
||||
if (!answer.hasMoreElements()) {
|
||||
return roleNames;
|
||||
}
|
||||
while (answer.hasMoreElements()) {
|
||||
SearchResult sr = (SearchResult) answer.next();
|
||||
|
||||
SearchResult sr = (SearchResult) answer.next();
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("Retrieving group names for user [" + sr.getName() + "]");
|
||||
}
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("Retrieving group names for user [" + sr.getName() + "]");
|
||||
}
|
||||
|
||||
attrs = sr.getAttributes();
|
||||
} while (attrs == null);
|
||||
Attributes attrs = sr.getAttributes();
|
||||
|
||||
NamingEnumeration ae = attrs.getAll();
|
||||
if (attrs != null) {
|
||||
NamingEnumeration ae = attrs.getAll();
|
||||
while (ae.hasMore()) {
|
||||
Attribute attr = (Attribute) ae.next();
|
||||
|
||||
while (ae.hasMore()) {
|
||||
Attribute attr = (Attribute) ae.next();
|
||||
if (attr.getID().equals("memberOf")) {
|
||||
Collection groupNames = LdapUtils.getAllAttributeValues(attr);
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("Groups found for user [" + username + "]: " + groupNames);
|
||||
if (attr.getID().equals("memberOf")) {
|
||||
|
||||
Collection<String> groupNames = LdapUtils.getAllAttributeValues(attr);
|
||||
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("Groups found for user [" + username + "]: " + groupNames);
|
||||
}
|
||||
|
||||
Collection<String> rolesForGroups = getRoleNamesForGroups(groupNames);
|
||||
roleNames.addAll(rolesForGroups);
|
||||
}
|
||||
|
||||
Collection rolesForGroups = this.getRoleNamesForGroups(groupNames);
|
||||
roleNames.addAll(rolesForGroups);
|
||||
}
|
||||
}
|
||||
}
|
||||
return roleNames;
|
||||
}
|
||||
|
||||
/**
|
||||
* This method is called by the default implementation to translate Active Directory group names
|
||||
* to role names. This implementation uses the {@link #groupRolesMap} to map group names to role
|
||||
* names.
|
||||
*
|
||||
* @param groupNames the group names that apply to the current user.
|
||||
* @return a collection of roles that are implied by the given role names.
|
||||
*/
|
||||
protected Collection<String> getRoleNamesForGroups(Collection<String> groupNames) {
|
||||
HashSet roleNames = new HashSet(groupNames.size());
|
||||
if (this.groupRolesMap != null) {
|
||||
Iterator i$ = groupNames.iterator();
|
||||
Set<String> roleNames = new HashSet<String>(groupNames.size());
|
||||
|
||||
if (groupRolesMap != null) {
|
||||
for (String groupName : groupNames) {
|
||||
String strRoleNames = groupRolesMap.get(groupName);
|
||||
if (strRoleNames != null) {
|
||||
for (String roleName : strRoleNames.split(ROLE_NAMES_DELIMETER)) {
|
||||
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("User is member of group [" + groupName + "] so adding role [" +
|
||||
roleName + "]");
|
||||
}
|
||||
|
||||
roleNames.add(roleName);
|
||||
|
||||
while (true) {
|
||||
String groupName;
|
||||
String strRoleNames;
|
||||
do {
|
||||
if (!i$.hasNext()) {
|
||||
return roleNames;
|
||||
}
|
||||
|
||||
groupName = (String) i$.next();
|
||||
strRoleNames = (String) this.groupRolesMap.get(groupName);
|
||||
} while (strRoleNames == null);
|
||||
|
||||
String[] arr$ = strRoleNames.split(",");
|
||||
int len$ = arr$.length;
|
||||
|
||||
for (int i$1 = 0; i$1 < len$; ++i$1) {
|
||||
String roleName = arr$[i$1];
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("User is member of group [" +
|
||||
groupName + "] so adding role [" + roleName + "]");
|
||||
}
|
||||
|
||||
roleNames.add(roleName);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
return roleNames;
|
||||
}
|
||||
return roleNames;
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue