handavid commented on code in PR #1357:
URL: https://github.com/apache/knox/pull/1357#discussion_r3875411088
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java:
##########
@@ -435,22 +453,24 @@ private void createBaseEntriesForDn(SchemaManager
schemaManager, String dn) thro
}
/**
- * Create the entry used by external clients to bind against the embedded
LDAP server.
- * The bind DN's parent container (e.g. {@code ou=system} or {@code
ou=people,<baseDn>})
- * must already exist. The entry is added using the privileged admin
session, which is
- * unaffected by the anonymous-access setting.
+ * Configure the Authenticator used by external clients to bind against
the embedded LDAP server.
*/
- private void createBindUser(SchemaManager schemaManager, String
bindPassword) throws Exception {
- Dn bindDn = new Dn(schemaManager, bindUser);
- if (!directoryService.getAdminSession().exists(bindDn)) {
- String rdnValue = bindDn.getRdn().getValue();
- Entry bindEntry = new DefaultEntry(schemaManager);
- bindEntry.setDn(bindDn);
- bindEntry.add("objectClass", "top", "person",
"organizationalPerson", "inetOrgPerson");
- bindEntry.add("cn", rdnValue);
- bindEntry.add("sn", rdnValue);
- bindEntry.add("userPassword", bindPassword);
- directoryService.getAdminSession().add(bindEntry);
+ private void configureInMemoryBindUser(String bindPassword) throws
Exception {
+ String id = "inmemoryuser";
Review Comment:
removed
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java:
##########
@@ -145,6 +151,19 @@ public void initialize(GatewayConfig config) throws
Exception {
workDir.mkdirs();
}
+ /**
+ * Validates that the bind dn, if configured, matches the base dn for the
embedded
+ * LDAP service (e.g. {@code ou=system} or {@code ou=people,<baseDn>}).
+ */
+ private void validateBindUser() throws Exception {
+ if (!StringUtils.isBlank(bindUser)) {
+ Dn bindUserDn = new Dn(bindUser);
+ if (!(bindUserDn.isDescendantOf("ou=system") ||
bindUserDn.isDescendantOf("ou=people," + this.baseDn))) {
+ throw new IllegalArgumentException("Bind user must be a
descendant of ou=system or ou=people" + this.baseDn);
Review Comment:
added
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
