Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert unnecessary commits from main

Browse Source 
Issue gh-15016
This commit is contained in:
Marcus Hert Da Coregio
2024-05-08 13:44:07 -03:00
parent e4745c99e9
commit 08f11f06ab
317 changed files with 1281 additions and 30496 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
ldap/src/integration-test/java/org/springframework/security/ldap/userdetails/LdapUserDetailsManagerTests.java
View File

@@ -49,7 +49,6 @@ import static org.mockito.Mockito.verify;
/**
* @author Luke Taylor
* @author Eddú Meléndez
* @author Roman Zabaluev
*/
@ExtendWith(SpringExtension.class)
@ContextConfiguration(classes = ApacheDsContainerConfig.class)
@@ -61,8 +60,6 @@ public class LdapUserDetailsManagerTests {
private static final List<GrantedAuthority> TEST_AUTHORITIES = AuthorityUtils.createAuthorityList("ROLE_CLOWNS",
"ROLE_ACROBATS");
private static final String DEFAULT_ROLE_PREFIX = "ROLE_";
private LdapUserDetailsManager mgr;
private SpringSecurityLdapTemplate template;
@@ -251,35 +248,4 @@ public class LdapUserDetailsManagerTests {
.isThrownBy(() -> this.mgr.changePassword("wrongpassword", "yossariansnewpassword"));
}
@Test
public void testRoleNamesStartWithDefaultRolePrefix() {
this.mgr.setUsernameMapper(new DefaultLdapUsernameToDnMapper("ou=people", "uid"));
this.mgr.setGroupSearchBase("ou=groups");
LdapUserDetails bob = (LdapUserDetails) this.mgr.loadUserByUsername("bob");
assertThat(bob.getAuthorities()).isNotEmpty();
bob.getAuthorities()
.stream()
.map(GrantedAuthority::getAuthority)
.forEach((authority) -> assertThat(authority).startsWith(DEFAULT_ROLE_PREFIX));
}
@Test
public void testRoleNamesStartWithCustomRolePrefix() {
var customPrefix = "GROUP_";
this.mgr.setRolePrefix(customPrefix);
this.mgr.setUsernameMapper(new DefaultLdapUsernameToDnMapper("ou=people", "uid"));
this.mgr.setGroupSearchBase("ou=groups");
LdapUserDetails bob = (LdapUserDetails) this.mgr.loadUserByUsername("bob");
assertThat(bob.getAuthorities()).isNotEmpty();
bob.getAuthorities()
.stream()
.map(GrantedAuthority::getAuthority)
.forEach((authority) -> assertThat(authority).startsWith(customPrefix));
}
}

56
ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2024 the original author or authors.
* Copyright 2002-2016 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,9 +17,12 @@
package org.springframework.security.ldap.authentication.ad;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.List;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -36,6 +39,7 @@ import org.springframework.core.log.LogMessage;
import org.springframework.dao.IncorrectResultSizeDataAccessException;
import org.springframework.ldap.CommunicationException;
import org.springframework.ldap.core.DirContextOperations;
import org.springframework.ldap.core.DistinguishedName;
import org.springframework.ldap.core.support.DefaultDirObjectFactory;
import org.springframework.ldap.support.LdapUtils;
import org.springframework.security.authentication.AccountExpiredException;
@@ -46,10 +50,11 @@ import org.springframework.security.authentication.InternalAuthenticationService
import org.springframework.security.authentication.LockedException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.ldap.SpringSecurityLdapTemplate;
import org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider;
import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
@@ -67,9 +72,9 @@ import org.springframework.util.StringUtils;
* <p>
* The user authorities are obtained from the data contained in the {@code memberOf}
* attribute.
* <p>
*
* <h3>Active Directory Sub-Error Codes</h3>
* <p>
*
* When an authentication fails, resulting in a standard LDAP 49 error code, Active
* Directory also supplies its own sub-error codes within the error message. These will be
* used to provide additional log information on why an authentication has failed. Typical
@@ -85,14 +90,13 @@ import org.springframework.util.StringUtils;
* <li>773 - user must reset password</li>
* <li>775 - account locked</li>
* </ul>
* <p>
*
* If you set the {@link #setConvertSubErrorCodesToExceptions(boolean)
* convertSubErrorCodesToExceptions} property to {@code true}, the codes will also be used
* to control the exception raised.
*
* @author Luke Taylor
* @author Rob Winch
* @author Roman Zabaluev
* @since 3.1
*/
public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLdapAuthenticationProvider {
@@ -131,12 +135,10 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLda
// Only used to allow tests to substitute a mock LdapContext
ContextFactory contextFactory = new ContextFactory();
private LdapAuthoritiesPopulator authoritiesPopulator = new DefaultActiveDirectoryAuthoritiesPopulator();
/**
* @param domain the domain name (can be null or empty)
* @param domain the domain name (may be null or empty)
* @param url an LDAP url (or multiple URLs)
* @param rootDn the root DN (can be null or empty)
* @param rootDn the root DN (may be null or empty)
*/
public ActiveDirectoryLdapAuthenticationProvider(String domain, String url, String rootDn) {
Assert.isTrue(StringUtils.hasText(url), "Url cannot be empty");
@@ -146,7 +148,7 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLda
}
/**
* @param domain the domain name (can be null or empty)
* @param domain the domain name (may be null or empty)
* @param url an LDAP url (or multiple URLs)
*/
public ActiveDirectoryLdapAuthenticationProvider(String domain, String url) {
@@ -184,7 +186,19 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLda
@Override
protected Collection<? extends GrantedAuthority> loadUserAuthorities(DirContextOperations userData, String username,
String password) {
return this.authoritiesPopulator.getGrantedAuthorities(userData, username);
String[] groups = userData.getStringAttributes("memberOf");
if (groups == null) {
this.logger.debug("No values for 'memberOf' attribute.");
return AuthorityUtils.NO_AUTHORITIES;
}
if (this.logger.isDebugEnabled()) {
this.logger.debug("'memberOf' attribute values: " + Arrays.asList(groups));
}
List<GrantedAuthority> authorities = new ArrayList<>(groups.length);
for (String group : groups) {
authorities.add(new SimpleGrantedAuthority(new DistinguishedName(group).removeLast().getValue()));
}
return authorities;
}
private DirContext bindAsUser(String username, String password) {
@@ -318,14 +332,14 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLda
+ "' does not contain the domain, and no domain has been configured");
throw badCredentials();
}
return rootDnFromDomain(bindPrincipal.substring(atChar + 1));
return rootDnFromDomain(bindPrincipal.substring(atChar + 1, bindPrincipal.length()));
}
private String rootDnFromDomain(String domain) {
String[] tokens = StringUtils.tokenizeToStringArray(domain, ".");
StringBuilder root = new StringBuilder();
for (String token : tokens) {
if (!root.isEmpty()) {
if (root.length() > 0) {
root.append(',');
}
root.append("dc=").append(token);
@@ -365,6 +379,7 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLda
* Defaults to: {@code (&(objectClass=user)(userPrincipalName={0}))}
* </p>
* @param searchFilter the filter string
*
* @since 3.2.6
*/
public void setSearchFilter(String searchFilter) {
@@ -382,19 +397,6 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends AbstractLda
this.contextEnvironmentProperties = new Hashtable<>(environment);
}
/**
* Set the strategy for obtaining the authorities for a given user after they've been
* authenticated. Consider adjusting this if you require a custom authorities mapping
* algorithm different from a default one. The default value is
* DefaultActiveDirectoryAuthoritiesPopulator.
* @param authoritiesPopulator authorities population strategy
* @since 6.3
*/
public void setAuthoritiesPopulator(LdapAuthoritiesPopulator authoritiesPopulator) {
Assert.notNull(authoritiesPopulator, "authoritiesPopulator must not be null");
this.authoritiesPopulator = authoritiesPopulator;
}
static class ContextFactory {
DirContext createContext(Hashtable<?, ?> env) throws NamingException {

68
ldap/src/main/java/org/springframework/security/ldap/authentication/ad/DefaultActiveDirectoryAuthoritiesPopulator.java
View File

@@ -1,68 +0,0 @@
/*
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.ldap.authentication.ad;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.ldap.core.DirContextOperations;
import org.springframework.ldap.core.DistinguishedName;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
/**
* The default strategy for obtaining user role information from the active directory.
* Creates the user authority list from the values of the {@code memberOf} attribute
* obtained from the user's Active Directory entry.
*
* @author Luke Taylor
* @author Roman Zabaluev
* @since 6.3
*/
public final class DefaultActiveDirectoryAuthoritiesPopulator implements LdapAuthoritiesPopulator {
private final Log logger = LogFactory.getLog(getClass());
@Override
public Collection<? extends GrantedAuthority> getGrantedAuthorities(DirContextOperations userData,
String username) {
String[] groups = userData.getStringAttributes("memberOf");
if (groups == null) {
this.logger.debug("No values for 'memberOf' attribute.");
return AuthorityUtils.NO_AUTHORITIES;
}
if (this.logger.isDebugEnabled()) {
this.logger.debug("'memberOf' attribute values: " + Arrays.asList(groups));
}
List<GrantedAuthority> authorities = new ArrayList<>(groups.length);
for (String group : groups) {
authorities.add(new SimpleGrantedAuthority(new DistinguishedName(group).removeLast().getValue()));
}
return authorities;
}
}

14
ldap/src/main/java/org/springframework/security/ldap/userdetails/LdapUserDetailsManager.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2024 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -104,7 +104,7 @@ public class LdapUserDetailsManager implements UserDetailsManager {
/** The attribute which contains members of a group */
private String groupMemberAttributeName = "uniquemember";
private String rolePrefix = "ROLE_";
private final String rolePrefix = "ROLE_";
/** The pattern to be used for the user search. {0} is the user's DN */
private String groupSearchFilter = "(uniquemember={0})";
@@ -403,16 +403,6 @@ public class LdapUserDetailsManager implements UserDetailsManager {
this.securityContextHolderStrategy = securityContextHolderStrategy;
}
/**
* Sets the role prefix used when converting authorities. The default value is "ROLE_"
* @param rolePrefix role prefix
* @since 6.3
*/
public void setRolePrefix(String rolePrefix) {
Assert.notNull(rolePrefix, "A rolePrefix must be supplied");
this.rolePrefix = rolePrefix;
}
private void changePasswordUsingAttributeModification(DistinguishedName userDn, String oldPassword,
String newPassword) {
ModificationItem[] passwordChange = new ModificationItem[] { new ModificationItem(DirContext.REPLACE_ATTRIBUTE,