forked from honza-toegel/ebics-java-client
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1 from spaced/feature-ldap
Feature ldap
- Loading branch information
Showing
19 changed files
with
371 additions
and
100 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
37 changes: 37 additions & 0 deletions
37
.../src/main/kotlin/org/ebics/client/ebicsrestapi/ldap/ActiveDirectoryRoleMapperPopulator.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| package org.ebics.client.ebicsrestapi.ldap | ||
|
|
||
| import org.slf4j.LoggerFactory | ||
| import org.springframework.ldap.core.DirContextOperations | ||
| import org.springframework.ldap.core.DistinguishedName | ||
| import org.springframework.security.core.GrantedAuthority | ||
| import org.springframework.security.core.authority.AuthorityUtils | ||
| import org.springframework.security.core.authority.SimpleGrantedAuthority | ||
| import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator | ||
|
|
||
|
|
||
| /** | ||
| * Translates ad memberOf attribute to role based on ldap search property [LdapSearchProperties.mapping] | ||
| * inspired by [DefaultActiveDirectoryAuthoritiesPopulator] | ||
| */ | ||
| class ActiveDirectoryRoleMapperPopulator(val mapping: Map<String,Array<String>>?) : LdapAuthoritiesPopulator { | ||
| private val logger = LoggerFactory.getLogger(ActiveDirectoryRoleMapperPopulator::class.java) | ||
| override fun getGrantedAuthorities( | ||
| userData: DirContextOperations?, | ||
| username: String? | ||
| ): Collection<GrantedAuthority?>? { | ||
| val groups = userData?.getStringAttributes("memberOf") | ||
| if (groups == null) { | ||
| logger.debug("No values for 'memberOf' attribute."); | ||
| return AuthorityUtils.NO_AUTHORITIES; | ||
| } | ||
| if (logger.isDebugEnabled) logger.debug("'memberOf' attribute values: " + groups.asList()); | ||
|
|
||
| return buildList { | ||
| for (group in groups) { | ||
| val mappedRoles = mapping?.get(DistinguishedName(group).removeLast().value) | ||
| if (mappedRoles != null) mappedRoles.forEach{ r:String -> add(SimpleGrantedAuthority("ROLE_${r.uppercase()}"))} | ||
| } | ||
| } | ||
| } | ||
|
|
||
| } |
65 changes: 65 additions & 0 deletions
65
ebics-rest-api/src/main/kotlin/org/ebics/client/ebicsrestapi/ldap/LdapConfiguration.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| package org.ebics.client.ebicsrestapi.ldap | ||
|
|
||
| import org.springframework.boot.autoconfigure.ldap.LdapProperties | ||
| import org.springframework.boot.context.properties.EnableConfigurationProperties | ||
| import org.springframework.context.annotation.Bean | ||
| import org.springframework.context.annotation.Configuration | ||
| import org.springframework.context.annotation.Profile | ||
| import org.springframework.ldap.core.support.BaseLdapPathContextSource | ||
| import org.springframework.security.authentication.AuthenticationManager | ||
| import org.springframework.security.config.ldap.LdapBindAuthenticationManagerFactory | ||
| import org.springframework.security.core.GrantedAuthority | ||
| import org.springframework.security.core.authority.SimpleGrantedAuthority | ||
| import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider | ||
| import org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator | ||
| import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator | ||
|
|
||
| typealias AuthorityRecord = Map<String, List<String>> | ||
| typealias AuthorityMapper = (AuthorityRecord) -> GrantedAuthority? | ||
|
|
||
| @Configuration | ||
| @Profile("!dev") | ||
| @EnableConfigurationProperties(LdapSearchProperties::class) | ||
| class LdapConfiguration { | ||
|
|
||
| @Bean | ||
| @Profile("ldap-auth-group-search") | ||
| fun authorities(contextSource: BaseLdapPathContextSource, searchProperties: LdapSearchProperties): LdapAuthoritiesPopulator { | ||
| val authorities = DefaultLdapAuthoritiesPopulator(contextSource, searchProperties.group.base) | ||
| authorities.setGroupSearchFilter(searchProperties.group.filter) | ||
| val mapper: AuthorityMapper = { record -> | ||
| val roles = record["cn"] | ||
| val role = roles?.first() | ||
| val mappedRole = searchProperties.mapping?.get(role) | ||
| mappedRole?.first()?.let { r -> SimpleGrantedAuthority("ROLE_${r.uppercase()}") } | ||
| } | ||
|
|
||
| authorities.setAuthorityMapper(mapper) | ||
| return authorities | ||
| } | ||
|
|
||
| @Bean | ||
| @Profile("default", "ldap-auth-ad-memberof") | ||
| fun activeDirectoryAuthorities(searchProperties: LdapSearchProperties): LdapAuthoritiesPopulator { | ||
| return ActiveDirectoryRoleMapperPopulator(searchProperties.mapping) | ||
| } | ||
|
|
||
| @Bean | ||
| @Profile("default", "ldap-bind-default") | ||
| fun authenticationManager(contextSource: BaseLdapPathContextSource, authorities: LdapAuthoritiesPopulator, searchProperties: LdapSearchProperties): AuthenticationManager { | ||
| val factory = LdapBindAuthenticationManagerFactory(contextSource) | ||
| factory.setUserSearchFilter(searchProperties.user.filter) | ||
| factory.setUserSearchBase(searchProperties.user.base) | ||
| factory.setLdapAuthoritiesPopulator(authorities) | ||
| return factory.createAuthenticationManager() | ||
| } | ||
|
|
||
| @Bean | ||
| @Profile("ldap-bind-ad") | ||
| fun authenticationProvider(ldapProperties: LdapProperties, searchProperties: LdapSearchProperties, authorities: LdapAuthoritiesPopulator): ActiveDirectoryLdapAuthenticationProvider { | ||
| val adProvider = ActiveDirectoryLdapAuthenticationProvider(searchProperties.domain, ldapProperties.urls[0], ldapProperties.base) | ||
| adProvider.setAuthoritiesPopulator(authorities) | ||
| return adProvider | ||
| } | ||
|
|
||
| } |
19 changes: 19 additions & 0 deletions
19
ebics-rest-api/src/main/kotlin/org/ebics/client/ebicsrestapi/ldap/LdapSearchProperties.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| package org.ebics.client.ebicsrestapi.ldap | ||
|
|
||
|
|
||
| import org.springframework.boot.context.properties.ConfigurationProperties | ||
|
|
||
|
|
||
| @ConfigurationProperties(prefix = "spring.ldap.search") | ||
| data class LdapSearchProperties ( | ||
| val domain: String = "", | ||
| val group: LdapSearchPattern = LdapSearchPattern("","member={0}"), | ||
| val user: LdapSearchPattern = LdapSearchPattern("","(uid={0})"), | ||
| val mapping: Map<String,Array<String>>? // mapping of spring-role -> ldap-role | ||
| ) | ||
|
|
||
|
|
||
| data class LdapSearchPattern( | ||
| val base: String = "", | ||
| val filter: String = "" | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.