Package com.atlassian.crowd.directory

Class SpringLDAPConnector

java.lang.Object

com.atlassian.crowd.directory.SpringLDAPConnector

All Implemented Interfaces:

LDAPDirectory, RemoteDirectory, Attributes

Direct Known Subclasses:

RFC2307Directory, RFC4519Directory

public abstract class SpringLDAPConnector
extends Object
implements LDAPDirectory

This class implements a remote LDAP directory using Spring LdapTemplate.

Warning: CWD-2494: When read timeout is enabled, operations can fail randomly with "javax.naming.NamingException: LDAP response read timed out..." error message without waiting for the timeout to pass.

Field Summary

Fields

Modifier and Type	Field	Description
protected AttributeValuesHolder	attributes
protected Supplier<org.springframework.ldap.core.ContextSource>	contextSource
protected Supplier<org.springframework.ldap.transaction.compensating.manager.ContextSourceTransactionManager>	contextSourceTransactionManager
static final int	DEFAULT_PAGE_SIZE
protected final com.atlassian.event.api.EventPublisher	eventPublisher
protected LDAPPropertiesMapper	ldapPropertiesMapper
protected final LDAPQueryTranslater	ldapQueryTranslater
protected Supplier<SpringLdapTemplateWrapper>	ldapTemplate
protected Converter	nameConverter
protected SearchDN	searchDN

Constructor Summary

Constructors

Constructor	Description
SpringLDAPConnector(LDAPQueryTranslater ldapQueryTranslater, com.atlassian.event.api.EventPublisher eventPublisher, InstanceFactory instanceFactory, LdapContextSourceProvider ldapContextSourceProvider)

Method Summary

Modifier and Type	Method	Description
protected void	addDefaultSnToUserAttributes(Attributes attrs, String defaultSnValue)	A default install of many directory servers (inc.
protected void	addDefaultValueToUserAttributesForAttribute(String attributeName, Attributes attrs, String defaultValue)
Group	addGroup(GroupTemplate group)
LDAPUserWithAttributes	addUser(UserTemplate user, PasswordCredential credential)	Adds a user to LDAP.
LDAPUserWithAttributes	addUser(UserTemplateWithAttributes user, PasswordCredential credential)	Adds a user to LDAP.
User	authenticate(String name, PasswordCredential credential)
protected ContextMapperWithRequiredAttributes<AvatarReference.BlobAvatar>	avatarMapper()
BoundedCount	countDirectMembersOfGroup(String groupName, int querySizeHint)
protected static ModificationItem	createModificationItem(String directoryAttributeName, String oldValue, String newValue)	This method is not suitable for generic attribute updates as it only supports single attribute-value mappings (ie.
void	expireAllPasswords()
protected <T extends LDAPDirectoryEntity> T	findEntityByDN(CrowdLdapName entityDn, CrowdLdapName baseDn, String filter, ContextMapperWithRequiredAttributes contextMapper, Class<T> entityClass)
<T extends LDAPDirectoryEntity> T	findEntityByDN(CrowdLdapName dn, Class<T> entityClass)	Finds a directory entity (principal, group or role) by their distinguished name.
<T extends LDAPDirectoryEntity> T	findEntityByDN(String dn, Class<T> entityClass)
LDAPGroupWithAttributes	findGroupByName(String name)
protected LDAPGroupWithAttributes	findGroupByNameAndType(String name, GroupType groupType)
LDAPGroupWithAttributes	findGroupWithAttributesByName(String name)
LDAPUserWithAttributes	findUserByExternalId(String externalId)
LDAPUserWithAttributes	findUserByName(String name)
LDAPUserWithAttributes	findUserWithAttributesByName(String name)
boolean	getAttributeAsBoolean(String name, boolean defaultValue)
long	getAttributeAsLong(String name, long defaultValue)
RemoteDirectory	getAuthoritativeDirectory()
protected Map<String,Object>	getBaseEnvironmentProperties()	Returns the properties used to set up the Ldap ContextSource.
org.springframework.ldap.core.ContextSource	getContextSource()	Exposed so that delegated directories can get a handle on the underlying LDAP context.
protected abstract LDAPCredentialEncoder	getCredentialEncoder()
protected List<AttributeMapper>	getCustomGroupAttributeMappers()	As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).
protected List<AttributeMapper>	getCustomUserAttributeMappers(UserContextMapperConfig config)
long	getDirectoryId()
ContextMapperWithRequiredAttributes<LDAPGroupWithAttributes>	getGroupContextMapper(GroupType groupType, boolean withAllAttributes)	Returns a ContextMapper ready to translate LDAP objects into Groups.
ContextMapperWithRequiredAttributes<LDAPGroupWithAttributes>	getGroupContextMapper(GroupType groupType, boolean withAllAttributes, boolean withMemberAttributes)	Returns a ContextMapper ready to translate LDAP objects into Groups.
protected String	getInitialGroupMemberDN()	Returns the default container member DN.
Set<String>	getKeys()
LDAPPropertiesMapper	getLdapPropertiesMapper()
protected List<AttributeMapper>	getMemberOnlyGroupAttributeMappers()	As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).
protected Attributes	getNewGroupAttributes(Group group)
protected void	getNewGroupDirectorySpecificAttributes(Group group, Attributes attributes)	Populates attributes object with directory-specific attributes.
protected Attributes	getNewUserAttributes(User user, PasswordCredential credential)	Translates the User into LDAP attributes, in preparation for creating a new user.
protected void	getNewUserDirectorySpecificAttributes(User user, Attributes attributes)	Populates attributes object with directory-specific attributes.
protected List<AttributeMapper>	getRequiredCustomGroupAttributeMappers()	Returns a set of attributes which are expected to be present in all cases (ie Active Directory's objectGUID) Due to performance reasons returning mappers for heavy attributes (such as memberships) should be avoided
protected SearchControls	getSearchControls(ContextMapperWithRequiredAttributes<?> mapper, int scope)
SearchDN	getSearchDN()
AvatarReference.BlobAvatar	getUserAvatarByName(String username, int sizeHint)
protected List<ModificationItem>	getUserModificationItems(User userTemplate, LDAPUserWithAttributes currentUser)
String	getValue(String name)
Set<String>	getValues(String name)
boolean	isEmpty()
boolean	isRolesDisabled()
protected org.springframework.ldap.core.CollectingNameClassPairCallbackHandler	pageSearchResults(CrowdLdapName baseDN, String filter, org.springframework.ldap.core.ContextMapper contextMapper, SearchControls searchControls, org.springframework.ldap.core.DirContextProcessor ldapRequestControls, int maxResults)	Performs a paged results search on an LDAP directory server searching using the LDAP paged results control option to fetch results in chunks rather than all at once.
protected LDAPGroupWithAttributes	postprocessGroup(LDAPGroupWithAttributes group)	Perform any post-processing on the passed group.
protected List<LDAPGroupWithAttributes>	postprocessGroups(List<LDAPGroupWithAttributes> groups)	Perform any post-processing on groups.
void	removeGroup(String name)
void	removeGroupAttributes(String groupName, String attributeName)
void	removeUser(String name)
void	removeUserAttributes(String username, String attributeName)
Group	renameGroup(String oldName, String newName)
User	renameUser(String oldName, String newName)
protected <T> List<T>	searchEntities(CrowdLdapName baseDN, String filter, ContextMapperWithRequiredAttributes<T> contextMapper, int startIndex, int maxResults)	Executes a search with paging if paged results is supported.
protected <T> List<T>	searchEntitiesWithRequestControls(CrowdLdapName baseDN, String filter, ContextMapperWithRequiredAttributes<T> contextMapper, SearchControls searchControls, org.springframework.ldap.core.DirContextProcessor ldapRequestControls, int startIndex, int maxResults)
<T> List<T>	searchGroupObjects(EntityQuery<?> query, ContextMapperWithRequiredAttributes<T> mapper)
protected <T> List<T>	searchGroupObjectsOfSpecifiedGroupType(EntityQuery<?> query, ContextMapperWithRequiredAttributes<T> mapper)	This method expects that the query contains a non-null groupType in the entityDescriptor.
<T> List<T>	searchGroupRelationships(MembershipQuery<T> query)
protected abstract <T> Iterable<T>	searchGroupRelationshipsWithGroupTypeSpecified(MembershipQuery<T> query)	Execute the search for group relationships given that a group of type GROUP or LEGACY_ROLE has been specified in the EntityDescriptor for the group(s).
<T> List<T>	searchGroups(EntityQuery<T> query)
<T> List<T>	searchUserObjects(EntityQuery<?> query, ContextMapperWithRequiredAttributes<T> mapper)
<T> List<T>	searchUsers(EntityQuery<T> query)
<T> List<T>	searchUsers(EntityQuery<T> query, boolean includeMembershipForAllDetails)
void	setAttributes(Map<String,String> attributes)	Called by the DirectoryInstanceLoader after constructing an InternalDirectory.
void	setDirectoryId(long id)	Called by the DirectoryInstanceLoader after constructing an InternalDirectory.
protected void	setLdapPropertiesMapperAttributes(Map<String,String> attributes)
void	storeGroupAttributes(String groupName, Map<String,Set<String>> attributes)
void	storeUserAttributes(String username, Map<String,Set<String>> attributes)
boolean	supportsInactiveAccounts()	Storing active/inactive flag for users in LDAP in general is currently not supported.
boolean	supportsNestedGroups()
boolean	supportsPasswordExpiration()	We don't support expiring passwords in LDAP directories (yet).
boolean	supportsSettingEncryptedCredential()
void	testConnection()
protected <T extends LDAPDirectoryEntity> RuntimeException	typedEntityNotFoundException(String name, Class<T> entityClass)
Group	updateGroup(GroupTemplate group)
User	updateUser(UserTemplate user)
void	updateUserCredential(String name, PasswordCredential credential)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.atlassian.crowd.directory.RemoteDirectory

addGroupToGroup, addUserToGroup, getDescriptiveName, getLocallyFilteredGroupNames, getMemberships, isGroupDirectGroupMember, isUserDirectGroupMember, removeGroupFromGroup, removeUserFromGroup, updateUserFromRemoteDirectory, userAuthenticated

Field Details

DEFAULT_PAGE_SIZE

public static final int DEFAULT_PAGE_SIZE

See Also:

• Constant Field Values

attributes

protected volatile AttributeValuesHolder attributes

ldapTemplate

protected volatile Supplier<SpringLdapTemplateWrapper> ldapTemplate

contextSource

protected volatile Supplier<org.springframework.ldap.core.ContextSource> contextSource

nameConverter

protected volatile Converter nameConverter

searchDN

protected volatile SearchDN searchDN

ldapPropertiesMapper

protected volatile LDAPPropertiesMapper ldapPropertiesMapper

contextSourceTransactionManager

protected volatile Supplier<org.springframework.ldap.transaction.compensating.manager.ContextSourceTransactionManager> contextSourceTransactionManager

ldapQueryTranslater

protected final LDAPQueryTranslater ldapQueryTranslater

eventPublisher

protected final com.atlassian.event.api.EventPublisher eventPublisher

Constructor Details

SpringLDAPConnector

public SpringLDAPConnector(LDAPQueryTranslater ldapQueryTranslater,
 com.atlassian.event.api.EventPublisher eventPublisher,
 InstanceFactory instanceFactory,
 LdapContextSourceProvider ldapContextSourceProvider)

Method Details

countDirectMembersOfGroup

public BoundedCount countDirectMembersOfGroup(String groupName,
 int querySizeHint)
                                       throws OperationFailedException

Specified by:

countDirectMembersOfGroup in interface RemoteDirectory

Throws:

OperationFailedException

getDirectoryId

public long getDirectoryId()

Specified by:

getDirectoryId in interface RemoteDirectory

setDirectoryId

public void setDirectoryId(long id)

Called by the DirectoryInstanceLoader after constructing an InternalDirectory.

Specified by:

setDirectoryId in interface RemoteDirectory

Parameters:

id - The unique id of the Directory stored in the database.

setAttributes

public void setAttributes(Map<String,String> attributes)

Called by the DirectoryInstanceLoader after constructing an InternalDirectory.

Specified by:

setAttributes in interface RemoteDirectory

Parameters:

attributes - attributes map.

setLdapPropertiesMapperAttributes

protected void setLdapPropertiesMapperAttributes(Map<String,String> attributes)

getContextSource

public org.springframework.ldap.core.ContextSource getContextSource()

Exposed so that delegated directories can get a handle on the underlying LDAP context.

Returns:

ContextSource.

getLdapPropertiesMapper

public LDAPPropertiesMapper getLdapPropertiesMapper()

getValues

public Set<String> getValues(String name)

Specified by:

getValues in interface Attributes

getValue

public String getValue(String name)

Specified by:

getValue in interface Attributes

isEmpty

public boolean isEmpty()

Specified by:

isEmpty in interface Attributes

getAttributeAsLong

public long getAttributeAsLong(String name,
 long defaultValue)

getAttributeAsBoolean

public boolean getAttributeAsBoolean(String name,
 boolean defaultValue)

getKeys

public Set<String> getKeys()

Specified by:

getKeys in interface Attributes

getSearchDN

public SearchDN getSearchDN()

getSearchControls

protected SearchControls getSearchControls(ContextMapperWithRequiredAttributes<?> mapper,
 int scope)

getBaseEnvironmentProperties

protected Map<String,Object> getBaseEnvironmentProperties()

Returns the properties used to set up the Ldap ContextSource.

Returns:

the properties used to set up the Ldap ContextSource.

pageSearchResults

protected org.springframework.ldap.core.CollectingNameClassPairCallbackHandler pageSearchResults(CrowdLdapName baseDN,
 String filter,
 org.springframework.ldap.core.ContextMapper contextMapper,
 SearchControls searchControls,
 org.springframework.ldap.core.DirContextProcessor ldapRequestControls,
 int maxResults)
                                                                                          throws OperationFailedException

Performs a paged results search on an LDAP directory server searching using the LDAP paged results control option to fetch results in chunks rather than all at once.

Parameters:

baseDN - The DN to begin the search from.

filter - The search filter.

contextMapper - Maps from LDAP search results into objects such as Groups.

searchControls - The LDAP search scope type.

ldapRequestControls - Any LDAP request controls (set to null if you do not need additional request controls for the search).

maxResults - maximum number of results to return. Set to -1 if no result limiting is desired (WARNING: doing so is obviously a hazard).

Returns:

The search results.

Throws:

OperationFailedException - Search failed due to a communication error to the remote directory

searchEntities

protected <T> List<T> searchEntities(CrowdLdapName baseDN,
 String filter,
 ContextMapperWithRequiredAttributes<T> contextMapper,
 int startIndex,
 int maxResults)
                              throws OperationFailedException

Executes a search with paging if paged results is supported.

Parameters:

baseDN - base DN of search.

filter - encoded LDAP search filter.

contextMapper - directory context to object mapper.

startIndex - index to start at. Set to 0 to start from the first result.

maxResults - maximum number of results to return. Set to -1 if no result limiting is desired (WARNING: doing so is obviously a hazard).

Returns:

list of entities of type corresponding to the contextMapper's output.

Throws:

OperationFailedException - a Communication error occurred when trying to talk to a remote directory

searchEntitiesWithRequestControls

protected <T> List<T> searchEntitiesWithRequestControls(CrowdLdapName baseDN,
 String filter,
 ContextMapperWithRequiredAttributes<T> contextMapper,
 SearchControls searchControls,
 org.springframework.ldap.core.DirContextProcessor ldapRequestControls,
 int startIndex,
 int maxResults)
                                                 throws OperationFailedException

Throws:

OperationFailedException

createModificationItem

protected static ModificationItem createModificationItem(String directoryAttributeName,
 String oldValue,
 String newValue)

This method is not suitable for generic attribute updates as it only supports single attribute-value mappings (ie. suitable for field values as opposed to custom attributes).

Parameters:

directoryAttributeName - the name of the attribute in LDAP to potentially add or modify.

oldValue - the value load from the LDAP directory (i.e. already processed by DirectoryAttributeRetriever.fromSavedLDAPValue(String))

newValue - the value which should be saved into LDAP (i.e. NOT processed by DirectoryAttributeRetriever.toSaveableLDAPValue(String) yet)

getCustomUserAttributeMappers

protected List<AttributeMapper> getCustomUserAttributeMappers(UserContextMapperConfig config)

Returns:

a collection of custom attribute mappers. By default just return an empty list.

getGroupContextMapper

public ContextMapperWithRequiredAttributes<LDAPGroupWithAttributes> getGroupContextMapper(GroupType groupType,
 boolean withAllAttributes)

Returns a ContextMapper ready to translate LDAP objects into Groups.

Parameters:

groupType - the GroupType

withAllAttributes - determines if all additional attribute mappers should be included. Some directories may include additional attributes, which are expected to be present in all cases

Returns:

a ContextMapper ready to translate LDAP objects into Groups and fetches all member objects

getGroupContextMapper

public ContextMapperWithRequiredAttributes<LDAPGroupWithAttributes> getGroupContextMapper(GroupType groupType,
 boolean withAllAttributes,
 boolean withMemberAttributes)

Returns a ContextMapper ready to translate LDAP objects into Groups.

Parameters:

groupType - the GroupType

withAllAttributes - determines if all additional attribute mappers should be included. Some directories may include additional attributes, which are expected to be present in all cases

withMemberAttributes - include the additional attributes mappers to obtain group members.

Returns:

a ContextMapper ready to translate LDAP objects into Groups and fetches all member objects

getCustomGroupAttributeMappers

protected List<AttributeMapper> getCustomGroupAttributeMappers()

As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).

Returns:

collection of custom attribute mappers (cannot be null but can be an empty list).

getMemberOnlyGroupAttributeMappers

protected List<AttributeMapper> getMemberOnlyGroupAttributeMappers()

As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).

Returns:

collection of custom attribute mappers (cannot be null but can be an empty list).

getRequiredCustomGroupAttributeMappers

protected List<AttributeMapper> getRequiredCustomGroupAttributeMappers()

Returns a set of attributes which are expected to be present in all cases (ie Active Directory's objectGUID) Due to performance reasons returning mappers for heavy attributes (such as memberships) should be avoided

Returns:

a list of mappers for attributes required to be present in all cases

findUserByName

public LDAPUserWithAttributes findUserByName(String name)
                                      throws UserNotFoundException,
OperationFailedException

Specified by:

findUserByName in interface RemoteDirectory

Throws:

UserNotFoundException

OperationFailedException

findUserWithAttributesByName

public LDAPUserWithAttributes findUserWithAttributesByName(String name)
                                                    throws UserNotFoundException,
OperationFailedException

Specified by:

findUserWithAttributesByName in interface RemoteDirectory

Throws:

UserNotFoundException

OperationFailedException

findUserByExternalId

public LDAPUserWithAttributes findUserByExternalId(String externalId)
                                            throws UserNotFoundException,
OperationFailedException

Specified by:

findUserByExternalId in interface RemoteDirectory

Throws:

UserNotFoundException

OperationFailedException

searchUserObjects

public <T> List<T> searchUserObjects(EntityQuery<?> query,
 ContextMapperWithRequiredAttributes<T> mapper)
                              throws OperationFailedException,
IllegalArgumentException

Throws:

OperationFailedException

IllegalArgumentException

removeUser

public void removeUser(String name)
                throws UserNotFoundException,
OperationFailedException

Specified by:

removeUser in interface RemoteDirectory

Throws:

UserNotFoundException

OperationFailedException

updateUserCredential

public void updateUserCredential(String name,
 PasswordCredential credential)
                          throws InvalidCredentialException,
UserNotFoundException,
OperationFailedException

Specified by:

updateUserCredential in interface RemoteDirectory

Throws:

InvalidCredentialException

UserNotFoundException

OperationFailedException

renameUser

public User renameUser(String oldName,
 String newName)
                throws UserNotFoundException,
InvalidUserException,
OperationFailedException

Specified by:

renameUser in interface RemoteDirectory

Throws:

UserNotFoundException

InvalidUserException

OperationFailedException

storeUserAttributes

public void storeUserAttributes(String username,
 Map<String,Set<String>> attributes)
                         throws UserNotFoundException,
OperationFailedException

Specified by:

storeUserAttributes in interface RemoteDirectory

Throws:

UserNotFoundException

OperationFailedException

removeUserAttributes

public void removeUserAttributes(String username,
 String attributeName)
                          throws UserNotFoundException,
OperationFailedException

Specified by:

removeUserAttributes in interface RemoteDirectory

Throws:

UserNotFoundException

OperationFailedException

getNewUserAttributes

protected Attributes getNewUserAttributes(User user,
 PasswordCredential credential)
                                   throws InvalidCredentialException,
org.springframework.ldap.NamingException

Translates the User into LDAP attributes, in preparation for creating a new user.

Parameters:

user - The user object to translate into LDAP attributes

credential - raw password.

Returns:

An Attributes object populated with directory-specific information.

Throws:

InvalidCredentialException - The password, if supplied, was invalid in some manner.

org.springframework.ldap.NamingException - If the User could not be translated to an Attributes

getNewUserDirectorySpecificAttributes

protected void getNewUserDirectorySpecificAttributes(User user,
 Attributes attributes)

Populates attributes object with directory-specific attributes.

Overrider of this method can take advantage of the default group attributes mapping logic in {#getNewUserAttributes(User)}.

Note that the attribute values supplied here will be used raw. This entails that overrider is responsible for supplying values in a format supported by the directory. In some directory implementations, for example, a blank string ("") is considered illegal. Overrider thus would have to make sure the method does not generate a value as such.

Parameters:

user - (potential) source of information that needs to be added.

attributes - attributes to add directory-specific information to.

addUser

public LDAPUserWithAttributes addUser(UserTemplate user,
 PasswordCredential credential)
                               throws InvalidUserException,
InvalidCredentialException,
OperationFailedException

Adds a user to LDAP.

Specified by:

addUser in interface RemoteDirectory

Parameters:

user - template of the user to add.

credential - password.

Returns:

LDAP user retrieved from LDAP after successfully adding the user to LDAP.

Throws:

InvalidUserException - if the user to create was deemed invalid by the LDAP server or already exists.

InvalidCredentialException - if the password credential was deemed invalid by the password encoder.

OperationFailedException - if we were unable to add the user to LDAP.

addUser

public LDAPUserWithAttributes addUser(UserTemplateWithAttributes user,
 PasswordCredential credential)
                               throws InvalidUserException,
InvalidCredentialException,
OperationFailedException

Adds a user to LDAP.

Specified by:

addUser in interface RemoteDirectory

Parameters:

user - template of the user to add.

credential - password.

Returns:

LDAP user retrieved from LDAP after successfully adding the user to LDAP.

Throws:

InvalidUserException - if the user to create was deemed invalid by the LDAP server or already exists.

InvalidCredentialException - if the password credential was deemed invalid by the password encoder.

OperationFailedException - if we were unable to add the user to LDAP.

addDefaultSnToUserAttributes

protected void addDefaultSnToUserAttributes(Attributes attrs,
 String defaultSnValue)

A default install of many directory servers (inc. Sun DSEE 6.2 and Apache DS 1.0.2) requires the following to be set before user creation is allowed:

 objectClass -> inetorgperson
 cn          ->
 sn          ->
 

If a call is being made from an external system (eg JIRA), the user is created with the bare minimum of attributes, then later updated. We need to make sure to add sn if it's not present in the information provided.

Parameters:

attrs - The LDAP user attributes to be checked and potentially updated.

defaultSnValue - default lastname/surname value

addDefaultValueToUserAttributesForAttribute

protected void addDefaultValueToUserAttributesForAttribute(String attributeName,
 Attributes attrs,
 String defaultValue)

findEntityByDN

public <T extends LDAPDirectoryEntity> T findEntityByDN(String dn,
 Class<T> entityClass)
                                                 throws UserNotFoundException,
GroupNotFoundException,
OperationFailedException

Throws:

UserNotFoundException

GroupNotFoundException

OperationFailedException

findEntityByDN

public <T extends LDAPDirectoryEntity> T findEntityByDN(CrowdLdapName dn,
 Class<T> entityClass)
                                                 throws UserNotFoundException,
GroupNotFoundException,
OperationFailedException

Description copied from interface: LDAPDirectory

Finds a directory entity (principal, group or role) by their distinguished name.

The object class of an entity is used to determine the entity type.

If an object represents both a group and role, then the object is mapped to a group.

Specified by:

findEntityByDN in interface LDAPDirectory

Parameters:

dn - standardised distinguished name.

entityClass - class of the entity to find (either LDAPUserWithAttributes or LDAPGroupWithAttributes).

Returns:

directory entity corresponding to DN.

Throws:

UserNotFoundException - if a user does not exist at the specified DN or the DN does not exist in the directory. This will also be thrown if the entity DOES exist but does not match the base DN or object filter for the entity type.

GroupNotFoundException - if a user does not exist at the specified DN or the DN does not exist in the directory. This will also be thrown if the entity DOES exist but does not match the base DN or object filter for the entity type.

OperationFailedException - if underlying directory implementation failed to execute the operation.

typedEntityNotFoundException

protected <T extends LDAPDirectoryEntity>
RuntimeException typedEntityNotFoundException(String name,
 Class<T> entityClass)
                                       throws UserNotFoundException,
GroupNotFoundException

Throws:

UserNotFoundException

GroupNotFoundException

findEntityByDN

protected <T extends LDAPDirectoryEntity> T findEntityByDN(CrowdLdapName entityDn,
 CrowdLdapName baseDn,
 String filter,
 ContextMapperWithRequiredAttributes contextMapper,
 Class<T> entityClass)
                                                    throws UserNotFoundException,
GroupNotFoundException,
OperationFailedException

Throws:

UserNotFoundException

GroupNotFoundException

OperationFailedException

updateUser

public User updateUser(UserTemplate user)
                throws UserNotFoundException,
OperationFailedException

Specified by:

updateUser in interface RemoteDirectory

Throws:

UserNotFoundException

OperationFailedException

getUserModificationItems

protected List<ModificationItem> getUserModificationItems(User userTemplate,
 LDAPUserWithAttributes currentUser)

searchUsers

public <T> List<T> searchUsers(EntityQuery<T> query)
                        throws OperationFailedException

Specified by:

searchUsers in interface RemoteDirectory

Throws:

OperationFailedException

searchUsers

public <T> List<T> searchUsers(EntityQuery<T> query,
 boolean includeMembershipForAllDetails)
                        throws OperationFailedException

Throws:

OperationFailedException

authenticate

public User authenticate(String name,
 PasswordCredential credential)
                  throws InvalidAuthenticationException,
UserNotFoundException,
OperationFailedException

Specified by:

authenticate in interface RemoteDirectory

Throws:

InvalidAuthenticationException

UserNotFoundException

OperationFailedException

findGroupByName

public LDAPGroupWithAttributes findGroupByName(String name)
                                        throws GroupNotFoundException,
OperationFailedException

Specified by:

findGroupByName in interface RemoteDirectory

Throws:

GroupNotFoundException

OperationFailedException

findGroupWithAttributesByName

public LDAPGroupWithAttributes findGroupWithAttributesByName(String name)
                                                      throws GroupNotFoundException,
OperationFailedException

Specified by:

findGroupWithAttributesByName in interface RemoteDirectory

Throws:

GroupNotFoundException

OperationFailedException

findGroupByNameAndType

protected LDAPGroupWithAttributes findGroupByNameAndType(String name,
 GroupType groupType)
                                                  throws GroupNotFoundException,
OperationFailedException

Throws:

GroupNotFoundException

OperationFailedException

searchGroupObjectsOfSpecifiedGroupType

protected <T> List<T> searchGroupObjectsOfSpecifiedGroupType(EntityQuery<?> query,
 ContextMapperWithRequiredAttributes<T> mapper)
                                                      throws OperationFailedException

This method expects that the query contains a non-null groupType in the entityDescriptor.

Parameters:

query - search query.

Returns:

list of results.

Throws:

OperationFailedException - represents a Communication error when trying to talk to a remote directory

searchGroupObjects

public <T> List<T> searchGroupObjects(EntityQuery<?> query,
 ContextMapperWithRequiredAttributes<T> mapper)
                               throws OperationFailedException

Throws:

OperationFailedException

searchGroups

public <T> List<T> searchGroups(EntityQuery<T> query)
                         throws OperationFailedException

Specified by:

searchGroups in interface RemoteDirectory

Throws:

OperationFailedException

postprocessGroups

protected List<LDAPGroupWithAttributes> postprocessGroups(List<LDAPGroupWithAttributes> groups)

Perform any post-processing on groups.

Parameters:

groups - to post-process

Returns:

list of groups that have been processed if required

postprocessGroup

protected LDAPGroupWithAttributes postprocessGroup(LDAPGroupWithAttributes group)

Perform any post-processing on the passed group.

Parameters:

group - to post-process

Returns:

the group (updated if required)

Throws:

OperationFailedException - if processing encounters a problem with the underlying directory

getNewGroupAttributes

protected Attributes getNewGroupAttributes(Group group)
                                    throws org.springframework.ldap.NamingException

Throws:

org.springframework.ldap.NamingException

getNewGroupDirectorySpecificAttributes

protected void getNewGroupDirectorySpecificAttributes(Group group,
 Attributes attributes)

Populates attributes object with directory-specific attributes.

Overrider of this method can take advantage of the default group attributes mapping logic in {#getNewGroupAttributes(Group)}.

Note that the attribute values supplied here will be used raw. This entails that overrider is responsible for supplying values in a format supported by the directory. In some directory implementations, for example, a blank string ("") is considered illegal. Overrider thus would have to make sure the method does not generate a value as such.

Parameters:

group - (potential) source of information that needs to be added.

attributes - attributes to add directory-specific information to.

getInitialGroupMemberDN

protected String getInitialGroupMemberDN()

Returns the default container member DN.

If this method returns null or blank string, no member DN will be added.

Returns:

empty member.

addGroup

public Group addGroup(GroupTemplate group)
               throws InvalidGroupException,
OperationFailedException

Specified by:

addGroup in interface RemoteDirectory

Throws:

InvalidGroupException

OperationFailedException

updateGroup

public Group updateGroup(GroupTemplate group)
                  throws GroupNotFoundException,
OperationFailedException

Specified by:

updateGroup in interface RemoteDirectory

Throws:

GroupNotFoundException

OperationFailedException

removeGroup

public void removeGroup(String name)
                 throws GroupNotFoundException,
OperationFailedException

Specified by:

removeGroup in interface RemoteDirectory

Throws:

GroupNotFoundException

OperationFailedException

renameGroup

public Group renameGroup(String oldName,
 String newName)
                  throws GroupNotFoundException,
InvalidGroupException,
OperationFailedException

Specified by:

renameGroup in interface RemoteDirectory

Throws:

GroupNotFoundException

InvalidGroupException

OperationFailedException

storeGroupAttributes

public void storeGroupAttributes(String groupName,
 Map<String,Set<String>> attributes)
                          throws GroupNotFoundException,
OperationFailedException

Specified by:

storeGroupAttributes in interface RemoteDirectory

Throws:

GroupNotFoundException

OperationFailedException

removeGroupAttributes

public void removeGroupAttributes(String groupName,
 String attributeName)
                           throws GroupNotFoundException,
OperationFailedException

Specified by:

removeGroupAttributes in interface RemoteDirectory

Throws:

GroupNotFoundException

OperationFailedException

searchGroupRelationships

public <T> List<T> searchGroupRelationships(MembershipQuery<T> query)
                                     throws OperationFailedException

Specified by:

searchGroupRelationships in interface RemoteDirectory

Throws:

OperationFailedException

searchGroupRelationshipsWithGroupTypeSpecified

protected abstract <T> Iterable<T> searchGroupRelationshipsWithGroupTypeSpecified(MembershipQuery<T> query)
                                                                           throws OperationFailedException

Execute the search for group relationships given that a group of type GROUP or LEGACY_ROLE has been specified in the EntityDescriptor for the group(s).

Parameters:

query - membership query with all GroupType's not null.

Returns:

list of members or memberships depending on the query.

Throws:

OperationFailedException - if the operation failed due to a communication error with the remote directory, or if the query is invalid

getCredentialEncoder

protected abstract LDAPCredentialEncoder getCredentialEncoder()

Returns:

the credential encoder to use with this directory; must not be null.

supportsSettingEncryptedCredential

public boolean supportsSettingEncryptedCredential()

Specified by:

supportsSettingEncryptedCredential in interface RemoteDirectory

supportsPasswordExpiration

public boolean supportsPasswordExpiration()

We don't support expiring passwords in LDAP directories (yet).

Specified by:

supportsPasswordExpiration in interface RemoteDirectory

Returns:

false, always.

expireAllPasswords

public void expireAllPasswords()
                        throws OperationFailedException

Specified by:

expireAllPasswords in interface RemoteDirectory

Throws:

OperationFailedException

supportsNestedGroups

public boolean supportsNestedGroups()

Specified by:

supportsNestedGroups in interface RemoteDirectory

isRolesDisabled

public boolean isRolesDisabled()

Specified by:

isRolesDisabled in interface RemoteDirectory

testConnection

public void testConnection()
                    throws OperationFailedException

Specified by:

testConnection in interface RemoteDirectory

Throws:

OperationFailedException

supportsInactiveAccounts

public boolean supportsInactiveAccounts()

Storing active/inactive flag for users in LDAP in general is currently not supported.

Specified by:

supportsInactiveAccounts in interface RemoteDirectory

Returns:

false

getAuthoritativeDirectory

public RemoteDirectory getAuthoritativeDirectory()

Specified by:

getAuthoritativeDirectory in interface RemoteDirectory

avatarMapper

protected ContextMapperWithRequiredAttributes<AvatarReference.BlobAvatar> avatarMapper()

getUserAvatarByName

public AvatarReference.BlobAvatar getUserAvatarByName(String username,
 int sizeHint)
                                               throws OperationFailedException

Specified by:

getUserAvatarByName in interface RemoteDirectory

Throws:

OperationFailedException