diff --git a/src/docbkx/user-authentication.xml b/src/docbkx/user-authentication.xml
index 2bbf2bab..4cada665 100644
--- a/src/docbkx/user-authentication.xml
+++ b/src/docbkx/user-authentication.xml
@@ -15,11 +15,7 @@
context using the supplied principal and credentials. A custom
authenticate method could look like this:
-
- Using ContextSource for user
- authentication
-
- public boolean authenticate(String userDn, String credentials) {
+ public boolean authenticate(String userDn, String credentials) {
DirContext ctx = null;
try {
ctx = contextSource.getContext(userDn, credentials);
@@ -32,21 +28,16 @@
// It is imperative that the created DirContext instance is always closed
LdapUtils.closeContext(ctx);
}
-}
-
+}The userDn supplied to the authenticate
+ method needs to be the full DN of the user to authenticate (regardless of
+ the base setting on the
+ ContextSource). You will typically need to perform an
+ LDAP search based on e.g. the user name to get this DN:
- The userDn supplied to the authenticate method
- needs to be the full DN of the user to authenticate (regardless of the
- base setting on the ContextSource).
- You will typically need to perform an LDAP search based on e.g. the user
- name to get this DN:
-
-
- Finding a user based on uid attribute.
-
- private String getDnForUser(String uid) {
+ private String getDnForUser(String uid) {
Filter f = new EqualsFilter("uid", uid);
- List result = ldapTemplate.search(DistinguishedName.EMPTY_PATH, f.toString(), new AbstractContextMapper() {
+ List result = ldapTemplate.search(DistinguishedName.EMPTY_PATH, f.toString(),
+ new AbstractContextMapper() {
protected Object doMapFromContext(DirContextOperations ctx) {
return ctx.getNameInNamespace();
}
@@ -57,12 +48,9 @@
}
return (String)result.get(0);
-}
-
-
- There are some drawbacks to this approach. The user is forced to
- concern herself with the DN of the user, she can only search for the
- user's uid, and the search always starts at the root of the tree (the
+}There are some drawbacks to this approach. The user is
+ forced to concern herself with the DN of the user, she can only search for
+ the user's uid, and the search always starts at the root of the tree (the
empty path). A more flexible method would let the user specify the search
base, the search filter, and the credentials. Spring LDAP 1.3.0 introduced
new authenticate methods in LdapTemplate that provide this
@@ -70,11 +58,13 @@
- boolean authenticate(Name base, String filter, String password);
+ boolean authenticate(Name base, String filter, String
+ password);
- boolean authenticate(String base, String filter, String password);
+ boolean authenticate(String base, String filter, String
+ password);
@@ -105,11 +95,7 @@
method where a hard-coded lookup operation is performed
on the authenticated context:
-
- Performing an LDAP operation on returned
- DirContext objects.
-
- public boolean authenticate(String userDn, String credentials) {
+ public boolean authenticate(String userDn, String credentials) {
DirContext ctx = null;
try {
ctx = contextSource.getContext(userDn, credentials);
@@ -125,10 +111,7 @@
// It is imperative that the created DirContext instance is always closed
LdapUtils.closeContext(ctx);
}
-}
-
-
- It would be better if the operation could be provided as an
+}It would be better if the operation could be provided as an
implementation of a callback interface, thus not limiting the operation to
always be a lookup. Spring LDAP 1.3.0 introduced the
callback interface
@@ -207,11 +190,7 @@ ldapTemplate.authenticate("", "(uid=john.doe)", "secret", contextCallback));A convenient collecting implementation of the error callback
interface is also provided:
-
- Convenience implementation of
- AuthenticationErrorCallback.
-
- public final class CollectingAuthenticationErrorCallback implements AuthenticationErrorCallback {
+ public final class CollectingAuthenticationErrorCallback implements AuthenticationErrorCallback {
private Exception error;
public void execute(Exception e) {
@@ -221,8 +200,7 @@ ldapTemplate.authenticate("", "(uid=john.doe)", "secret", contextCallback));
- The code needed for authenticating a user and retrieving the
+}The code needed for authenticating a user and retrieving the
authentication exception in case of an error boils down to this:
@@ -254,4 +232,4 @@ if (!result) {
mature security framework addressing the above aspects as well as several
others.
-
\ No newline at end of file
+