necouchman commented on a change in pull request #454: GUACAMOLE-793: CAS
Provider returns Group - like LDAP Provider
URL: https://github.com/apache/guacamole-client/pull/454#discussion_r352387091
##########
File path:
extensions/guacamole-auth-cas/src/main/java/org/apache/guacamole/auth/cas/ticket/TicketValidationService.java
##########
@@ -122,15 +128,41 @@
}
// Convert remaining attributes that have values to Strings
+ String groupAttribute = confService.getCasGroupAttribute();
+ // Use cas-member-attribute to retrieve and set group memberships
+ String groupDnFormat = confService.getCasGroupDnFormat();
+ String groupTemplate = "";
+ if (groupDnFormat != null) {
+ // if CAS is backended to LDAP, groups come in as RFC4514 DN
+ // syntax. If cas-group-dn-format is set, this strips
+ // an entry such as "CN=Foo,OU=Bar,DC=example,DC=com" to
+ // "Foo"
+ groupTemplate =
groupDnFormat.replace("%s","([A-Za-z0-9_\\(\\)\\-\\.\\s+]+)");
+ // the underlying parser aggregates all instances of the same
+ // attribute, so we need to be able to parse them out
+ groupTemplate=groupTemplate+",*\\s*";
+ } else {
+ groupTemplate = "([A-Za-z0-9_\\(\\)\\-\\.\\s+]+,*\\s*)";
+ }
for (Entry <String, Object> attr : ticketAttrs.entrySet()) {
String tokenName = TokenName.canonicalize(attr.getKey(),
CAS_ATTRIBUTE_TOKEN_PREFIX);
Object value = attr.getValue();
- if (value != null)
+ if (value != null) {
tokens.put(tokenName, value.toString());
+ if (attr.getKey().equals(groupAttribute)) {
+ String valueWithoutBrackets =
value.toString().substring(1,value.toString().length()-1);
+ // probably could move this up further for efficiency
+ Pattern pattern = Pattern.compile(groupTemplate);
+ Matcher matcher =
pattern.matcher(valueWithoutBrackets);
+ while (matcher.find()) {
+ effectiveGroups.add(matcher.group(1));
+ }
+ }
Review comment:
Keep in mind that, with the way you have written this code, here, the group
attribute will continue to be available in the tokens, as well. Which is fine
- this may be what you were going for, or it may not, just something to discuss
about the merits of doing things this way or not.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
