hanicz commented on code in PR #1357:
URL: https://github.com/apache/knox/pull/1357#discussion_r3869504563
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java:
##########
@@ -145,6 +151,19 @@ public void initialize(GatewayConfig config) throws
Exception {
workDir.mkdirs();
}
+ /**
+ * Validates that the bind dn, if configured, matches the base dn for the
embedded
+ * LDAP service (e.g. {@code ou=system} or {@code ou=people,<baseDn>}).
+ */
+ private void validateBindUser() throws Exception {
+ if (!StringUtils.isBlank(bindUser)) {
+ Dn bindUserDn = new Dn(bindUser);
+ if (!(bindUserDn.isDescendantOf("ou=system") ||
bindUserDn.isDescendantOf("ou=people," + this.baseDn))) {
+ throw new IllegalArgumentException("Bind user must be a
descendant of ou=system or ou=people" + this.baseDn);
Review Comment:
nit: missing `,` in message
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/authn/InMemoryBindAuthenticator.java:
##########
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.authn;
+
+import org.apache.directory.api.ldap.model.constants.AuthenticationLevel;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.name.Dn;
+import org.apache.directory.server.core.api.LdapPrincipal;
+import
org.apache.directory.server.core.api.interceptor.context.BindOperationContext;
+import org.apache.directory.server.core.authn.AbstractAuthenticator;
+
+import java.nio.charset.StandardCharsets;
+
+/**
+ * Authenticator for an in-memory user.
+ */
+public class InMemoryBindAuthenticator extends AbstractAuthenticator {
+
+ private final Dn bindDn;
+ private final String bindPassword;
+
+ public InMemoryBindAuthenticator(Dn bindDn, String bindPassword)
+ throws LdapException {
+ super(AuthenticationLevel.SIMPLE, bindDn);
+ this.bindDn = bindDn;
+ this.bindPassword = bindPassword;
+ }
+
+ @Override
+ public LdapPrincipal authenticate(BindOperationContext bindContext) throws
LdapException {
+ Dn dn = bindContext.getDn();
+
+ // Check if authenticating as the configured in-memory user
+ if (bindDn.equals(dn)) {
+ byte[] passwordBytes = bindContext.getCredentials();
+ String password = new String(passwordBytes,
StandardCharsets.UTF_8);
+ if (bindPassword.equals(password)) {
Review Comment:
I think if the password doesn't match this should throw a
LdapAuthenticationException.
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java:
##########
@@ -435,22 +453,24 @@ private void createBaseEntriesForDn(SchemaManager
schemaManager, String dn) thro
}
/**
- * Create the entry used by external clients to bind against the embedded
LDAP server.
- * The bind DN's parent container (e.g. {@code ou=system} or {@code
ou=people,<baseDn>})
- * must already exist. The entry is added using the privileged admin
session, which is
- * unaffected by the anonymous-access setting.
+ * Configure the Authenticator used by external clients to bind against
the embedded LDAP server.
*/
- private void createBindUser(SchemaManager schemaManager, String
bindPassword) throws Exception {
- Dn bindDn = new Dn(schemaManager, bindUser);
- if (!directoryService.getAdminSession().exists(bindDn)) {
- String rdnValue = bindDn.getRdn().getValue();
- Entry bindEntry = new DefaultEntry(schemaManager);
- bindEntry.setDn(bindDn);
- bindEntry.add("objectClass", "top", "person",
"organizationalPerson", "inetOrgPerson");
- bindEntry.add("cn", rdnValue);
- bindEntry.add("sn", rdnValue);
- bindEntry.add("userPassword", bindPassword);
- directoryService.getAdminSession().add(bindEntry);
+ private void configureInMemoryBindUser(String bindPassword) throws
Exception {
+ String id = "inmemoryuser";
Review Comment:
nit: this is an unused variable
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
