From b01bf0b87807515db9e8e169f51275981534d50f Mon Sep 17 00:00:00 2001 From: Luke Taylor Date: Tue, 20 Dec 2005 23:26:38 +0000 Subject: [PATCH] Expanded Javadoc. --- .../ldap/LdapAuthenticationProvider.java | 39 ++++++++++++++++++- .../AbstractLdapAuthenticator.java | 18 ++++++++- .../DefaultLdapAuthoritiesPopulator.java | 13 ++++++- 3 files changed, 66 insertions(+), 4 deletions(-) diff --git a/core/src/main/java/org/acegisecurity/providers/ldap/LdapAuthenticationProvider.java b/core/src/main/java/org/acegisecurity/providers/ldap/LdapAuthenticationProvider.java index 32009373e5..7601460c90 100644 --- a/core/src/main/java/org/acegisecurity/providers/ldap/LdapAuthenticationProvider.java +++ b/core/src/main/java/org/acegisecurity/providers/ldap/LdapAuthenticationProvider.java @@ -27,7 +27,8 @@ import org.springframework.util.Assert; import javax.naming.directory.Attributes; /** - * The class responsible for LDAP authentication. + * An {@link org.acegisecurity.providers.AuthenticationProvider} implementation that + * provides integration with an LDAP server. * *

* There are many ways in which an LDAP directory can be configured so this class @@ -63,6 +64,42 @@ import javax.naming.directory.Attributes; * for example from a database. *

* + *

Configuration

+ * A simple configuration might be as follows: + * 
+ *    <bean id="initialDirContextFactory" class="org.acegisecurity.providers.ldap.DefaultInitialDirContextFactory">
+ *      <constructor-arg value="ldap://monkeymachine:389/dc=acegisecurity,dc=org"/>
+ *      <property name="managerDn"><value>cn=manager,dc=acegisecurity,dc=org</value></property>
+ *      <property name="managerPassword"><value>password</value></property>
+ *    </bean>
+ *
+ *    <bean id="ldapAuthProvider" class="org.acegisecurity.providers.ldap.LdapAuthenticationProvider">
+ *    <constructor-arg>
+ *      <bean class="org.acegisecurity.providers.ldap.authenticator.BindAuthenticator">
+ *         <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
+ *         <property name="userDnPatterns"><list><value>uid={0},ou=people</value></list></property>
+ *      </bean>
+ *    </constructor-arg>
+ *    <constructor-arg>
+ *      <bean class="org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator">
+ *         <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
+ *         <constructor-arg><value>ou=groups</value></constructor-arg>
+ *         <property name="groupRoleAttribute"><value>ou</value></property>
+ *      </bean>
+ *    </constructor-arg>
+ *  </bean>
+ *
+ *

+ * This would set up the provider to access an LDAP server with URL + * ldap://monkeymachine:389/dc=acegisecurity,dc=org. Authentication will be performed by + * attempting to bind with the DN uid=<user-login-name>,ou=people,dc=acegisecurity,dc=org. + * After successful authentication, roles will be assigned to the user by searching under the DN + * ou=groups,dc=acegisecurity,dc=org with the default filter (member=<user's-DN>). + * The role name will be taken from the "ou" attribute of each match. + *

+ * + * @see org.acegisecurity.providers.ldap.authenticator.BindAuthenticator + * @see org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator * * @author Luke Taylor * @version $Id$ diff --git a/core/src/main/java/org/acegisecurity/providers/ldap/authenticator/AbstractLdapAuthenticator.java b/core/src/main/java/org/acegisecurity/providers/ldap/authenticator/AbstractLdapAuthenticator.java index eca0a3ca6e..6ce6d42796 100644 --- a/core/src/main/java/org/acegisecurity/providers/ldap/authenticator/AbstractLdapAuthenticator.java +++ b/core/src/main/java/org/acegisecurity/providers/ldap/authenticator/AbstractLdapAuthenticator.java @@ -25,6 +25,8 @@ import java.util.List; import java.util.ArrayList; /** + * Base class for the authenticator implementations. + * * @author Luke Taylor * @version $Id$ */ @@ -33,11 +35,23 @@ public abstract class AbstractLdapAuthenticator implements LdapAuthenticator, //~ Instance fields ======================================================== - //private String[] userDnPattern = null; - private MessageFormat[] userDnFormat = null; private InitialDirContextFactory initialDirContextFactory; + + //private String[] userDnPattern = null; + + /** Stores the patterns which are used as potential DN matches */ + private MessageFormat[] userDnFormat = null; + + /** Optional search object which can be used to locate a user when a simple DN match isn't sufficient */ private LdapUserSearch userSearch; + + /** The attributes which will be retrieved from the directory. Null means all attributes */ private String[] userAttributes = null; + + /** + * The suffix to be added to the DN patterns, worked out internally from the root DN of the + * configured InitialDirContextFactory. + */ private String dnSuffix = ""; //~ Constructors =========================================================== diff --git a/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java b/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java index e48ea55f34..da69097736 100644 --- a/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java +++ b/core/src/main/java/org/acegisecurity/providers/ldap/populator/DefaultLdapAuthoritiesPopulator.java @@ -84,11 +84,22 @@ import java.util.HashSet; * setting the groupRoleAttribute property (the default is "cn"). *

*

+ * The configuration below shows how the group searc might be performed with the above schema. * 

  * <bean id="ldapAuthoritiesPopulator" class="org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator">
- * TODO
+ *   <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
+ *   <constructor-arg><value>ou=groups</value></constructor-arg>
+ *   <property name="groupRoleAttribute"><value>ou</value></property>
+ *
+ * <!-- the follwing properties are shown with their default values -->
+ *
+ *   <property name="searchSubTree"><value>false</value></property>
+ *   <property name="rolePrefix"><value>ROLE_</value></property>
+ *   <property name="convertToUpperCase"><value>true</value></property>
  * </bean>
  *
+ * A search for roles for user "uid=ben,ou=people,dc=acegisecurity,dc=org" would return the single + * granted authority "ROLE_DEVELOPER". *

* *