Expanded Javadoc.
This commit is contained in:
Luke Taylor
parent
8585ddf48b
commit
b01bf0b878
|
|
@ -27,7 +27,8 @@ import org.springframework.util.Assert;
|
|||
import javax.naming.directory.Attributes;
|
||||
|
||||
/**
|
||||
* The class responsible for LDAP authentication.
|
||||
* An {@link org.acegisecurity.providers.AuthenticationProvider} implementation that
|
||||
* provides integration with an LDAP server.
|
||||
*
|
||||
* <p>
|
||||
* There are many ways in which an LDAP directory can be configured so this class
|
||||
|
|
@ -63,6 +64,42 @@ import javax.naming.directory.Attributes;
|
|||
* for example from a database.
|
||||
* </p>
|
||||
*
|
||||
* <h3>Configuration</h3>
|
||||
* A simple configuration might be as follows:
|
||||
* <pre>
|
||||
* <bean id="initialDirContextFactory" class="org.acegisecurity.providers.ldap.DefaultInitialDirContextFactory">
|
||||
* <constructor-arg value="ldap://monkeymachine:389/dc=acegisecurity,dc=org"/>
|
||||
* <property name="managerDn"><value>cn=manager,dc=acegisecurity,dc=org</value></property>
|
||||
* <property name="managerPassword"><value>password</value></property>
|
||||
* </bean>
|
||||
*
|
||||
* <bean id="ldapAuthProvider" class="org.acegisecurity.providers.ldap.LdapAuthenticationProvider">
|
||||
* <constructor-arg>
|
||||
* <bean class="org.acegisecurity.providers.ldap.authenticator.BindAuthenticator">
|
||||
* <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
|
||||
* <property name="userDnPatterns"><list><value>uid={0},ou=people</value></list></property>
|
||||
* </bean>
|
||||
* </constructor-arg>
|
||||
* <constructor-arg>
|
||||
* <bean class="org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator">
|
||||
* <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
|
||||
* <constructor-arg><value>ou=groups</value></constructor-arg>
|
||||
* <property name="groupRoleAttribute"><value>ou</value></property>
|
||||
* </bean>
|
||||
* </constructor-arg>
|
||||
* </bean>
|
||||
* </pre>
|
||||
* <p>
|
||||
* This would set up the provider to access an LDAP server with URL
|
||||
* <tt>ldap://monkeymachine:389/dc=acegisecurity,dc=org</tt>. Authentication will be performed by
|
||||
* attempting to bind with the DN <tt>uid=<user-login-name>,ou=people,dc=acegisecurity,dc=org</tt>.
|
||||
* After successful authentication, roles will be assigned to the user by searching under the DN
|
||||
* <tt>ou=groups,dc=acegisecurity,dc=org</tt> with the default filter <tt>(member=<user's-DN>)</tt>.
|
||||
* The role name will be taken from the "ou" attribute of each match.
|
||||
* </p>
|
||||
*
|
||||
* @see org.acegisecurity.providers.ldap.authenticator.BindAuthenticator
|
||||
* @see org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator
|
||||
*
|
||||
* @author Luke Taylor
|
||||
* @version $Id$
|
||||
|
|
|
|||
|
|
@ -25,6 +25,8 @@ import java.util.List;
|
|||
import java.util.ArrayList;
|
||||
|
||||
/**
|
||||
* Base class for the authenticator implementations.
|
||||
*
|
||||
* @author Luke Taylor
|
||||
* @version $Id$
|
||||
*/
|
||||
|
|
@ -33,11 +35,23 @@ public abstract class AbstractLdapAuthenticator implements LdapAuthenticator,
|
|||
|
||||
//~ Instance fields ========================================================
|
||||
|
||||
//private String[] userDnPattern = null;
|
||||
private MessageFormat[] userDnFormat = null;
|
||||
private InitialDirContextFactory initialDirContextFactory;
|
||||
|
||||
//private String[] userDnPattern = null;
|
||||
|
||||
/** Stores the patterns which are used as potential DN matches */
|
||||
private MessageFormat[] userDnFormat = null;
|
||||
|
||||
/** Optional search object which can be used to locate a user when a simple DN match isn't sufficient */
|
||||
private LdapUserSearch userSearch;
|
||||
|
||||
/** The attributes which will be retrieved from the directory. Null means all attributes */
|
||||
private String[] userAttributes = null;
|
||||
|
||||
/**
|
||||
* The suffix to be added to the DN patterns, worked out internally from the root DN of the
|
||||
* configured InitialDirContextFactory.
|
||||
*/
|
||||
private String dnSuffix = "";
|
||||
|
||||
//~ Constructors ===========================================================
|
||||
|
|
|
|||
|
|
@ -84,11 +84,22 @@ import java.util.HashSet;
|
|||
* setting the <tt>groupRoleAttribute</tt> property (the default is "cn").
|
||||
* </p>
|
||||
* <p>
|
||||
* The configuration below shows how the group searc might be performed with the above schema.
|
||||
* <pre>
|
||||
* <bean id="ldapAuthoritiesPopulator" class="org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator">
|
||||
* TODO
|
||||
* <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
|
||||
* <constructor-arg><value>ou=groups</value></constructor-arg>
|
||||
* <property name="groupRoleAttribute"><value>ou</value></property>
|
||||
*
|
||||
* <!-- the follwing properties are shown with their default values -->
|
||||
*
|
||||
* <property name="searchSubTree"><value>false</value></property>
|
||||
* <property name="rolePrefix"><value>ROLE_</value></property>
|
||||
* <property name="convertToUpperCase"><value>true</value></property>
|
||||
* </bean>
|
||||
* </pre>
|
||||
* A search for roles for user "uid=ben,ou=people,dc=acegisecurity,dc=org" would return the single
|
||||
* granted authority "ROLE_DEVELOPER".
|
||||
* </p>
|
||||
*
|
||||
*
|
||||
|
|
|
|||
Loading…
Reference in New Issue