Examples of LdapPrincipal

com.sun.security.auth.LdapPrincipal
etf.org/rfc/rfc2253.txt">RFC 2253.
After successful authentication, a user {@link java.security.Principal}can be associated with a particular {@link javax.security.auth.Subject}to augment that Subject with an additional identity. Authorization decisions can then be based upon the Principals that are associated with a Subject.
This class is immutable. @since 1.6
org.apache.directory.server.core.LdapPrincipal
An alternative X500 user implementation that has access to the distinguished name of the principal as well as the String representation. @author Apache Directory Project @version $Rev: 918766 $
org.apache.directory.server.core.api.LdapPrincipal
An alternative X500 user implementation that has access to the distinguished name of the principal as well as the String representation. @author Apache Directory Project
org.apache.directory.server.core.authn.LdapPrincipal
An alternative X500 user implementation that has access to the distinguished name of the principal as well as the String representation. @author Apache Directory Project @version $Rev: 686316 $
org.apache.harmony.auth.LdapPrincipal
org.apache.ldap.server.authn.LdapPrincipal
An alternative X500 user implementation that has access to the distinguished name of the principal as well as the String representation. @author Apache Directory Project @version $Rev: 168482 $

Examples of org.apache.directory.server.core.api.LdapPrincipal

        {
            anonymousPrincipal = principal;
        }
        else
        {
            anonymousPrincipal = new LdapPrincipal( directoryService.getSchemaManager() );
        }


        // setup attribute type value
        OBJECT_CLASS_AT = directoryService.getSchemaManager().getAttributeType( SchemaConstants.OBJECT_CLASS_AT );
    }

View Full Code Here

Examples of org.apache.directory.server.core.api.LdapPrincipal

        if ( dn.isRootDse() )
        {
            return;
        }


        LdapPrincipal principal = lookupContext.getSession().getEffectivePrincipal();
        Dn userName = principal.getDn();
        Set<Dn> userGroups = groupCache.getGroups( userName.getNormName() );
        Collection<ACITuple> tuples = new HashSet<ACITuple>();
        addPerscriptiveAciTuples( lookupContext, tuples, dn, entry );
        addEntryAciTuples( tuples, entry );
        addSubentryAciTuples( lookupContext, tuples, dn, entry );


        // check that we have read access to the entry
        AciContext aciContext = new AciContext( schemaManager, lookupContext );
        aciContext.setUserGroupNames( userGroups );
        aciContext.setUserDn( userName );
        aciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
        aciContext.setEntryDn( dn );
        aciContext.setMicroOperations( LOOKUP_PERMS );
        aciContext.setAciTuples( tuples );
        aciContext.setEntry( entry );


        engine.checkPermission( aciContext );


        // check that we have read access to every attribute type and value
        for ( Attribute attribute : entry )
        {


            for ( Value<?> value : attribute )
            {
                AciContext valueAciContext = new AciContext( schemaManager, lookupContext );
                valueAciContext.setUserGroupNames( userGroups );
                valueAciContext.setUserDn( userName );
                valueAciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
                valueAciContext.setEntryDn( dn );
                valueAciContext.setAttributeType( attribute.getAttributeType() );
                valueAciContext.setAttrValue( value );
                valueAciContext.setMicroOperations( READ_PERMS );
                valueAciContext.setAciTuples( tuples );

View Full Code Here

Examples of org.apache.directory.server.core.api.LdapPrincipal

         * First call hasPermission() for entry level "Browse" and "ReturnDN" perm
         * tests.  If we hasPermission() returns false we immediately short the
         * process and return false.
         */


        LdapPrincipal principal = opContext.getSession().getEffectivePrincipal();
        Dn userDn = principal.getDn();
        Set<Dn> userGroups = groupCache.getGroups( userDn.getNormName() );
        Collection<ACITuple> tuples = new HashSet<ACITuple>();
        addPerscriptiveAciTuples( opContext, tuples, normName, clonedEntry );
        addEntryAciTuples( tuples, ( ( ClonedServerEntry ) clonedEntry ).getOriginalEntry() );
        addSubentryAciTuples( opContext, tuples, normName, ( ( ClonedServerEntry ) clonedEntry ).getOriginalEntry() );


        AciContext aciContext = new AciContext( schemaManager, opContext );
        aciContext.setUserGroupNames( userGroups );
        aciContext.setUserDn( userDn );
        aciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
        aciContext.setEntryDn( normName );
        aciContext.setMicroOperations( SEARCH_ENTRY_PERMS );
        aciContext.setAciTuples( tuples );
        aciContext.setEntry( ( ( ClonedServerEntry ) clonedEntry ).getOriginalEntry() );


        if ( !engine.hasPermission( aciContext ) )
        {
            return false;
        }


        /*
         * For each attribute type we check if access is allowed to the type.  If not
         * the attribute is yanked out of the entry to be returned.  If permission is
         * allowed we move on to check if the values are allowed.  Values that are
         * not allowed are removed from the attribute.  If the attribute has no more
         * values remaining then the entire attribute is removed.
         */
        List<AttributeType> attributeToRemove = new ArrayList<AttributeType>();


        for ( Attribute attribute : clonedEntry.getAttributes() )
        {
            // if attribute type scope access is not allowed then remove the attribute and continue
            AttributeType attributeType = attribute.getAttributeType();
            Attribute attr = clonedEntry.get( attributeType );


            aciContext = new AciContext( schemaManager, opContext );
            aciContext.setUserGroupNames( userGroups );
            aciContext.setUserDn( userDn );
            aciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
            aciContext.setEntryDn( normName );
            aciContext.setAttributeType( attributeType );
            aciContext.setMicroOperations( SEARCH_ATTRVAL_PERMS );
            aciContext.setAciTuples( tuples );
            aciContext.setEntry( clonedEntry );


            if ( !engine.hasPermission( aciContext ) )
            {
                attributeToRemove.add( attributeType );


                continue;
            }


            List<Value<?>> valueToRemove = new ArrayList<Value<?>>();


            // attribute type scope is ok now let's determine value level scope
            for ( Value<?> value : attr )
            {
                aciContext = new AciContext( schemaManager, opContext );
                aciContext.setUserGroupNames( userGroups );
                aciContext.setUserDn( userDn );
                aciContext.setAuthenticationLevel( principal.getAuthenticationLevel() );
                aciContext.setEntryDn( normName );
                aciContext.setAttributeType( attr.getAttributeType() );
                aciContext.setAttrValue( value );
                aciContext.setMicroOperations( SEARCH_ATTRVAL_PERMS );
                aciContext.setAciTuples( tuples );

View Full Code Here

Examples of org.apache.directory.server.core.authn.LdapPrincipal

            ctls.setSearchScope( SearchControls.SUBTREE_SCOPE );
            
            LdapDN adminDn = new LdapDN( ServerDNConstants.ADMIN_SYSTEM_DN_NORMALIZED );
            adminDn.normalize( directoryService.getRegistries().getAttributeTypeRegistry().getNormalizerMapping() );
            CoreSession adminSession = new DefaultCoreSession( 
                new LdapPrincipal( adminDn, AuthenticationLevel.STRONG ), directoryService );
            EntryFilteringCursor results = nexus.search( new SearchOperationContext( 
                adminSession, baseDn, AliasDerefMode.DEREF_ALWAYS, filter, ctls ) );
            
            while ( results.next() )
            {

View Full Code Here

Examples of org.apache.harmony.auth.LdapPrincipal

        userID = jndiNameCallback.getName();
        userPassword = jndiPasswordCallback.getPassword();
    }
    
    private void getPrinclpalsFromLdap() throws InvalidNameException{
        ldapPrincipal = new LdapPrincipal(ldapPrincipalEntryName); 
        userPrincipal = new UserPrincipal(userID);
        if(authzIdentity != null){
            extraUserPrincipal = new UserPrincipal(authzIdentity);
        }
    }

View Full Code Here

Examples of org.apache.ldap.server.authn.LdapPrincipal


    public void add( NextInterceptor next, String upName, Name normName, Attributes entry ) throws NamingException
    {
        // Access the principal requesting the operation, and bypass checks if it is the admin
        Invocation invocation = InvocationStack.getInstance().peek();
        LdapPrincipal user = ( ( ServerContext ) invocation.getCaller() ).getPrincipal();


        // bypass authz code if we are disabled
        if ( ! enabled )
        {
            next.add( upName, normName, entry );
            return;
        }


        // bypass authz code but manage caches if operation is performed by the admin
        if ( user.getName().equalsIgnoreCase( DirectoryPartitionNexus.ADMIN_PRINCIPAL ) )
        {
            next.add( upName, normName, entry );
            tupleCache.subentryAdded( upName, normName, entry );
            groupCache.groupAdded( upName, normName, entry );
            return;
        }


        // perform checks below here for all non-admin users
        SubentryService subentryService = ( SubentryService ) chain.get( "subentryService" );
        Attributes subentryAttrs = subentryService.getSubentryAttributes( normName, entry );
        NamingEnumeration attrList = entry.getAll();
        while( attrList.hasMore() )
        {
            subentryAttrs.put( ( Attribute ) attrList.next() );
        }


        // Assemble all the information required to make an access control decision
        Set userGroups = groupCache.getGroups( user.getName() );
        Collection tuples = new HashSet();


        // Build the total collection of tuples to be considered for add rights
        // NOTE: entryACI are NOT considered in adds (it would be a security breech)
        addPerscriptiveAciTuples( invocation.getProxy(), tuples, normName, subentryAttrs );
        addSubentryAciTuples( invocation.getProxy(), tuples, normName, subentryAttrs );


        // check if entry scope permission is granted
        DirectoryPartitionNexusProxy proxy = invocation.getProxy();
        engine.checkPermission( proxy, userGroups, user.getJndiName(), user.getAuthenticationLevel(),
                normName, null, null, ADD_PERMS, tuples, subentryAttrs );


        // now we must check if attribute type and value scope permission is granted
        NamingEnumeration attributeList = entry.getAll();
        while ( attributeList.hasMore() )
        {
            Attribute attr = ( Attribute ) attributeList.next();
            for ( int ii = 0; ii < attr.size(); ii++ )
            {
                engine.checkPermission( proxy, userGroups, user.getJndiName(),
                        user.getAuthenticationLevel(), normName, attr.getID(),
                        attr.get( ii ), ADD_PERMS, tuples, entry );
            }
        }


        // if we've gotten this far then access has been granted

View Full Code Here

0 1 2 3 4 5

TOP

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.