GetUserModelFromADPrivilegedAction.java

  1. /**
  2.  * Originally contributed by eMation (www.emation.pt)
  3.  */
  4. package org.itracker.services.authentication.adsson;

  5. import org.apache.log4j.Logger;
  6. import org.itracker.model.User;

  7. import javax.naming.Context;
  8. import javax.naming.NamingEnumeration;
  9. import javax.naming.NamingException;
  10. import javax.naming.PartialResultException;
  11. import javax.naming.directory.*;
  12. import java.security.PrivilegedAction;
  13. import java.util.Enumeration;
  14. import java.util.Hashtable;

  15. //TODO: Add Javadocs here

  16. /**
  17.  * @author ricardo
  18.  */
  19. public class GetUserModelFromADPrivilegedAction implements PrivilegedAction<Object> {

  20.     private static String ITRACKER_SUPER_USERS_GROUP = "ITracker Super Users";

  21.     private final Logger logger;
  22.     private String login;
  23.     private String providerUrl;
  24.     private String baseBranch;

  25.     public GetUserModelFromADPrivilegedAction(String login, String baseBranch, String providerUrl) {
  26.         this.logger = Logger.getLogger(getClass());
  27.         this.login = login;
  28.         this.providerUrl = providerUrl;
  29.         this.baseBranch = baseBranch;
  30.     }

  31.     public Object run() {
  32.         try {
  33.             return getUserInfo(login);
  34.         } catch (NamingException e) {
  35.             logger.error(e.getMessage());
  36.             return (null);
  37.         }
  38.     }

  39.     private User getUserInfo(String login) throws NamingException {
  40.         // Set up environment for creating initial context
  41.         Hashtable<String, String> env = new Hashtable<String, String>(11);
  42.         env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
  43.         // Must use fully qualified hostname
  44.         env.put(Context.PROVIDER_URL, providerUrl);
  45.         // Request the use of the "GSSAPI" SASL mechanism
  46.         // Authenticate by using already established Kerberos credentials
  47.         env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");

  48.         /* Create initial context */
  49.         DirContext ctx = new InitialDirContext(env);
  50.         // do something useful with ctx
  51.         SearchControls sc = new SearchControls();
  52.         sc.setCountLimit(1);
  53.         sc.setSearchScope(SearchControls.SUBTREE_SCOPE);
  54.         String filter = "(&(objectclass=user)(sAMAccountName=" + login + "))";
  55.         NamingEnumeration<?> answer = ctx.search(baseBranch, filter, sc);

  56.         if (!answer.hasMoreElements()) {
  57.             logger.error("A.D. had no info on " + login);
  58.             return (null);
  59.         }

  60.         SearchResult sr;
  61.         try {
  62.             sr = (SearchResult) answer.next();
  63.             logger.info("A.D. had info on " + login);
  64.         } catch (PartialResultException e) {
  65.             logger.error("A.D. had no info on " + login);
  66.             return (null);
  67.         }

  68.         Attributes attributes = sr.getAttributes();
  69.         String mail = "";
  70.         String firstName = "";
  71.         String lastName = "";

  72.         // check that properties are present
  73.         // active directory sometimes doesn't have "mail"
  74.         if ((attributes.get("givenName") == null) || (attributes.get("sn") == null)) {
  75.             logger.error("AD didn't return proper attributes. Check that it has at least [mail, givenName , sn]");
  76.             return (null);
  77.         }

  78.         if (attributes.get("mail") != null) {
  79.             mail = (String) attributes.get("Mail").get();
  80.         }
  81.         if (attributes.get("givenName") != null)
  82.             firstName = (String) attributes.get("givenName").get();
  83.         if (attributes.get("sn") != null) {
  84.             lastName = (String) attributes.get("sn").get();
  85.         }
  86.         logger.info("Got at least givenName and sn from A.D. for user " + login);

  87.         // create user
  88.         User user = new User();

  89.         user.setEmail(mail);
  90.         user.setFirstName(firstName);
  91.         user.setLastName(lastName);
  92.         user.setLogin(login);
  93.         user.setPassword("notused=");

  94.         // if user belongs to "ITracker Super Users" group
  95.         // make him a super user
  96.         user.setSuperUser(false);

  97.         logger.info("About to check if user " + login + " is a super user");
  98.         logger.debug("User attributes for user " + login + " " + attributes);
  99.         if (attributes.get("memberOf") != null) {
  100.             for (Enumeration<?> groups = attributes.get("memberOf").getAll(); groups.hasMoreElements(); ) {
  101.                 String group = (String) groups.nextElement();
  102.                 logger.info(login + " belongs to NT Group " + group);
  103.                 if (group.indexOf(ITRACKER_SUPER_USERS_GROUP) > 0) {
  104.                     user.setSuperUser(true);
  105.                     logger.info("User " + user.getLogin() + " was made an administrator ");
  106.                 }
  107.             }
  108.         } else {
  109.             logger.info("User attributes didn't contain memberOf...Looks like the A.D. user you specified in the adauth.properties properties file doesn't have enough permissions to check group membership for other users. Give that user enough privileges to read the memberOf attribute from A.D.");
  110.         }

  111.         if (user.isSuperUser()) {
  112.             logger.info(login + " is a super user");
  113.         } else {
  114.             logger.info(login + " is not a super user");
  115.         }

  116.         ctx.close();

  117.         return user;
  118.     }
  119. }