Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1661: Use a DistinguishedName to wrap the search base to avoid the need for JNDI escaping.

Browse Source
This commit is contained in:
Luke Taylor
2011-01-26 17:13:11 +00:00
parent 866615ceaa
commit 077af5e187
7 changed files with 78 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ldap/src/test/java/org/springframework/security/ldap/AbstractLdapIntegrationTests.java
View File

@@ -40,7 +40,7 @@ import org.springframework.security.ldap.server.ApacheDSContainer;
public abstract class AbstractLdapIntegrationTests {
// private static InMemoryXmlApplicationContext appContext;
private static ApacheDSContainer server;
private static BaseLdapPathContextSource contextSource;
private static DefaultSpringSecurityContextSource contextSource;
protected AbstractLdapIntegrationTests() {
}
@@ -48,7 +48,11 @@ public abstract class AbstractLdapIntegrationTests {
@BeforeClass
public static void startServer() throws Exception {
contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:53389/dc=springframework,dc=org");
((DefaultSpringSecurityContextSource)contextSource).afterPropertiesSet();
// OpenLDAP option
// contextSource = new DefaultSpringSecurityContextSource("ldap://127.0.0.1:22389/dc=springsource,dc=com");
// contextSource.setUserDn("cn=admin,dc=springsource,dc=com");
// contextSource.setPassword("password");
contextSource.afterPropertiesSet();
server = new ApacheDSContainer("dc=springframework,dc=org", "classpath:test-server.ldif");
server.afterPropertiesSet();
}
@@ -98,7 +102,7 @@ public abstract class AbstractLdapIntegrationTests {
try {
enumeration = ctx.listBindings(name);
while (enumeration.hasMore()) {
Binding element = (Binding) enumeration.next();
Binding element = enumeration.next();
DistinguishedName childName = new DistinguishedName(element.getName());
childName.prepend((DistinguishedName) name);

28
ldap/src/test/java/org/springframework/security/ldap/authentication/BindAuthenticatorTests.java
View File

@@ -17,7 +17,7 @@ package org.springframework.security.ldap.authentication;
import static org.junit.Assert.*;
import org.junit.Test;
import org.junit.*;
import org.springframework.ldap.core.DirContextOperations;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -80,8 +80,34 @@ public class BindAuthenticatorTests extends AbstractLdapIntegrationTests {
authenticator.setUserSearch(new FilterBasedLdapUserSearch("ou=people", "(cn={0})", getContextSource()));
authenticator.authenticate(new UsernamePasswordAuthenticationToken("mouse, jerry", "jerryspassword"));
authenticator.authenticate(new UsernamePasswordAuthenticationToken("slash/guy", "slashguyspassword"));
// SEC-1661
authenticator.setUserSearch(new FilterBasedLdapUserSearch("ou=\\\"quoted people\\\"", "(cn={0})", getContextSource()));
authenticator.authenticate(new UsernamePasswordAuthenticationToken("quoteguy", "quoteguyspassword"));
}
/*
@Test
public void messingWithEscapedChars() throws Exception {
Hashtable<String,String> env = new Hashtable<String,String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://127.0.0.1:22389/dc=springsource,dc=com");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, "cn=admin,dc=springsource,dc=com");
env.put(Context.SECURITY_CREDENTIALS, "password");
InitialDirContext idc = new InitialDirContext(env);
SearchControls searchControls = new SearchControls();
searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
DistinguishedName baseDn = new DistinguishedName("ou=\\\"quoted people\\\"");
NamingEnumeration<SearchResult> matches = idc.search(baseDn, "(cn=*)", new Object[] {"quoteguy"}, searchControls);
while(matches.hasMore()) {
SearchResult match = matches.next();
DistinguishedName dn = new DistinguishedName(match.getName());
System.out.println("**** Match: " + match.getName() + " ***** " + dn);
}
}
*/
@Test
public void testAuthenticationWithWrongPasswordFails() {
authenticator.setUserDnPatterns(new String[] {"uid={0},ou=people"});