Showing the changes to java/pkg/com/sun/security/auth/module/LdapLoginModule.java (1 of 18352 files). Show all
Unified · Split
| @@ -0,0 +1,1017 @@ | |||
| 1 | /* | ||
| 2 | * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. | ||
| 3 | * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. | ||
| 4 | * | ||
| 5 | * This code is free software; you can redistribute it and/or modify it | ||
| 6 | * under the terms of the GNU General Public License version 2 only, as | ||
| 7 | * published by the Free Software Foundation. Oracle designates this | ||
| 8 | * particular file as subject to the "Classpath" exception as provided | ||
| 9 | * by Oracle in the LICENSE file that accompanied this code. | ||
| 10 | * | ||
| 11 | * This code is distributed in the hope that it will be useful, but WITHOUT | ||
| 12 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or | ||
| 13 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | ||
| 14 | * version 2 for more details (a copy is included in the LICENSE file that | ||
| 15 | * accompanied this code). | ||
| 16 | * | ||
| 17 | * You should have received a copy of the GNU General Public License version | ||
| 18 | * 2 along with this work; if not, write to the Free Software Foundation, | ||
| 19 | * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | ||
| 20 | * | ||
| 21 | * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA | ||
| 22 | * or visit www.oracle.com if you need additional information or have any | ||
| 23 | * questions. | ||
| 24 | */ | ||
| 25 | |||
| 26 | package com.sun.security.auth.module; | ||
| 27 | |||
| 28 | import java.io.IOException; | ||
| 29 | import java.security.AccessController; | ||
| 30 | import java.net.SocketPermission; | ||
| 31 | import java.security.Principal; | ||
| 32 | import java.security.PrivilegedAction; | ||
| 33 | import java.util.Arrays; | ||
| 34 | import java.util.Hashtable; | ||
| 35 | import java.util.Iterator; | ||
| 36 | import java.util.Map; | ||
| 37 | import java.util.ResourceBundle; | ||
| 38 | import java.util.regex.Matcher; | ||
| 39 | import java.util.regex.Pattern; | ||
| 40 | import java.util.Set; | ||
| 41 | |||
| 42 | import javax.naming.*; | ||
| 43 | import javax.naming.directory.*; | ||
| 44 | import javax.naming.ldap.*; | ||
| 45 | import javax.security.auth.*; | ||
| 46 | import javax.security.auth.callback.*; | ||
| 47 | import javax.security.auth.login.*; | ||
| 48 | import javax.security.auth.spi.*; | ||
| 49 | |||
| 50 | import com.sun.security.auth.LdapPrincipal; | ||
| 51 | import com.sun.security.auth.UserPrincipal; | ||
| 52 | |||
| 53 | import sun.security.util.AuthResources; | ||
| 54 | |||
| 55 | /** | ||
| 56 | * This {@link LoginModule} performs LDAP-based authentication. | ||
| 57 | * A username and password is verified against the corresponding user | ||
| 58 | * credentials stored in an LDAP directory. | ||
| 59 | * This module requires the supplied {@link CallbackHandler} to support a | ||
| 60 | * {@link NameCallback} and a {@link PasswordCallback}. | ||
| 61 | * If authentication is successful then a new {@link LdapPrincipal} is created | ||
| 62 | * using the user's distinguished name and a new {@link UserPrincipal} is | ||
| 63 | * created using the user's username and both are associated | ||
| 64 | * with the current {@link Subject}. | ||
| 65 | * | ||
| 66 | * <p> This module operates in one of three modes: <i>search-first</i>, | ||
| 67 | * <i>authentication-first</i> or <i>authentication-only</i>. | ||
| 68 | * A mode is selected by specifying a particular set of options. | ||
| 69 | * | ||
| 70 | * <p> In search-first mode, the LDAP directory is searched to determine the | ||
| 71 | * user's distinguished name and then authentication is attempted. | ||
| 72 | * An (anonymous) search is performed using the supplied username in | ||
| 73 | * conjunction with a specified search filter. | ||
| 74 | * If successful then authentication is attempted using the user's | ||
| 75 | * distinguished name and the supplied password. | ||
| 76 | * To enable this mode, set the <code>userFilter</code> option and omit the | ||
| 77 | * <code>authIdentity</code> option. | ||
| 78 | * Use search-first mode when the user's distinguished name is not | ||
| 79 | * known in advance. | ||
| 80 | * | ||
| 81 | * <p> In authentication-first mode, authentication is attempted using the | ||
| 82 | * supplied username and password and then the LDAP directory is searched. | ||
| 83 | * If authentication is successful then a search is performed using the | ||
| 84 | * supplied username in conjunction with a specified search filter. | ||
| 85 | * To enable this mode, set the <code>authIdentity</code> and the | ||
| 86 | * <code>userFilter</code> options. | ||
| 87 | * Use authentication-first mode when accessing an LDAP directory | ||
| 88 | * that has been configured to disallow anonymous searches. | ||
| 89 | * | ||
| 90 | * <p> In authentication-only mode, authentication is attempted using the | ||
| 91 | * supplied username and password. The LDAP directory is not searched because | ||
| 92 | * the user's distinguished name is already known. | ||
| 93 | * To enable this mode, set the <code>authIdentity</code> option to a valid | ||
| 94 | * distinguished name and omit the <code>userFilter</code> option. | ||
| 95 | * Use authentication-only mode when the user's distinguished name is | ||
| 96 | * known in advance. | ||
| 97 | * | ||
| 98 | * <p> The following option is mandatory and must be specified in this | ||
| 99 | * module's login {@link Configuration}: | ||
| 100 | * <dl><dt></dt><dd> | ||
| 101 | * <dl> | ||
| 102 | * <dt> <code>userProvider=<b>ldap_urls</b></code> | ||
| 103 | * </dt> | ||
| 104 | * <dd> This option identifies the LDAP directory that stores user entries. | ||
| 105 | * <b>ldap_urls</b> is a list of space-separated LDAP URLs | ||
| 106 | * (<a href="http://www.ietf.org/rfc/rfc2255.txt">RFC 2255</a>) | ||
| 107 | * that identifies the LDAP server to use and the position in | ||
| 108 | * its directory tree where user entries are located. | ||
| 109 | * When several LDAP URLs are specified then each is attempted, | ||
| 110 | * in turn, until the first successful connection is established. | ||
| 111 | * Spaces in the distinguished name component of the URL must be escaped | ||
| 112 | * using the standard mechanism of percent character ('<code>%</code>') | ||
| 113 | * followed by two hexadecimal digits (see {@link java.net.URI}). | ||
| 114 | * Query components must also be omitted from the URL. | ||
| 115 | * | ||
| 116 | * <p> | ||
| 117 | * Automatic discovery of the LDAP server via DNS | ||
| 118 | * (<a href="http://www.ietf.org/rfc/rfc2782.txt">RFC 2782</a>) | ||
| 119 | * is supported (once DNS has been configured to support such a service). | ||
| 120 | * It is enabled by omitting the hostname and port number components from | ||
| 121 | * the LDAP URL. </dd> | ||
| 122 | * </dl></dl> | ||
| 123 | * | ||
| 124 | * <p> This module also recognizes the following optional {@link Configuration} | ||
| 125 | * options: | ||
| 126 | * <dl><dt></dt><dd> | ||
| 127 | * <dl> | ||
| 128 | * <dt> <code>userFilter=<b>ldap_filter</b></code> </dt> | ||
| 129 | * <dd> This option specifies the search filter to use to locate a user's | ||
| 130 | * entry in the LDAP directory. It is used to determine a user's | ||
| 131 | * distinguished name. | ||
| 132 | * <code><b>ldap_filter</b></code> is an LDAP filter string | ||
| 133 | * (<a href="http://www.ietf.org/rfc/rfc2254.txt">RFC 2254</a>). | ||
| 134 | * If it contains the special token "<code><b>{USERNAME}</b></code>" | ||
| 135 | * then that token will be replaced with the supplied username value | ||
| 136 | * before the filter is used to search the directory. </dd> | ||
| 137 | * | ||
| 138 | * <dt> <code>authIdentity=<b>auth_id</b></code> </dt> | ||
| 139 | * <dd> This option specifies the identity to use when authenticating a user | ||
| 140 | * to the LDAP directory. | ||
| 141 | * <code><b>auth_id</b></code> may be an LDAP distinguished name string | ||
| 142 | * (<a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a>) or some | ||
| 143 | * other string name. | ||
| 144 | * It must contain the special token "<code><b>{USERNAME}</b></code>" | ||
| 145 | * which will be replaced with the supplied username value before the | ||
| 146 | * name is used for authentication. | ||
| 147 | * Note that if this option does not contain a distinguished name then | ||
| 148 | * the <code>userFilter</code> option must also be specified. </dd> | ||
| 149 | * | ||
| 150 | * <dt> <code>authzIdentity=<b>authz_id</b></code> </dt> | ||
| 151 | * <dd> This option specifies an authorization identity for the user. | ||
| 152 | * <code><b>authz_id</b></code> is any string name. | ||
| 153 | * If it comprises a single special token with curly braces then | ||
| 154 | * that token is treated as a attribute name and will be replaced with a | ||
| 155 | * single value of that attribute from the user's LDAP entry. | ||
| 156 | * If the attribute cannot be found then the option is ignored. | ||
| 157 | * When this option is supplied and the user has been successfully | ||
| 158 | * authenticated then an additional {@link UserPrincipal} | ||
| 159 | * is created using the authorization identity and it is assocated with | ||
| 160 | * the current {@link Subject}. </dd> | ||
| 161 | * | ||
| 162 | * <dt> <code>useSSL</code> </dt> | ||
| 163 | * <dd> if <code>false</code>, this module does not establish an SSL connection | ||
| 164 | * to the LDAP server before attempting authentication. SSL is used to | ||
| 165 | * protect the privacy of the user's password because it is transmitted | ||
| 166 | * in the clear over LDAP. | ||
| 167 | * By default, this module uses SSL. </dd> | ||
| 168 | * | ||
| 169 | * <dt> <code>useFirstPass</code> </dt> | ||
| 170 | * <dd> if <code>true</code>, this module retrieves the username and password | ||
| 171 | * from the module's shared state, using "javax.security.auth.login.name" | ||
| 172 | * and "javax.security.auth.login.password" as the respective keys. The | ||
| 173 | * retrieved values are used for authentication. If authentication fails, | ||
| 174 | * no attempt for a retry is made, and the failure is reported back to | ||
| 175 | * the calling application.</dd> | ||
| 176 | * | ||
| 177 | * <dt> <code>tryFirstPass</code> </dt> | ||
| 178 | * <dd> if <code>true</code>, this module retrieves the username and password | ||
| 179 | * from the module's shared state, using "javax.security.auth.login.name" | ||
| 180 | * and "javax.security.auth.login.password" as the respective keys. The | ||
| 181 | * retrieved values are used for authentication. If authentication fails, | ||
| 182 | * the module uses the {@link CallbackHandler} to retrieve a new username | ||
| 183 | * and password, and another attempt to authenticate is made. If the | ||
| 184 | * authentication fails, the failure is reported back to the calling | ||
| 185 | * application.</dd> | ||
| 186 | * | ||
| 187 | * <dt> <code>storePass</code> </dt> | ||
| 188 | * <dd> if <code>true</code>, this module stores the username and password | ||
| 189 | * obtained from the {@link CallbackHandler} in the module's shared state, | ||
| 190 | * using | ||
| 191 | * "javax.security.auth.login.name" and | ||
| 192 | * "javax.security.auth.login.password" as the respective keys. This is | ||
| 193 | * not performed if existing values already exist for the username and | ||
| 194 | * password in the shared state, or if authentication fails.</dd> | ||
| 195 | * | ||
| 196 | * <dt> <code>clearPass</code> </dt> | ||
| 197 | * <dd> if <code>true</code>, this module clears the username and password | ||
| 198 | * stored in the module's shared state after both phases of authentication | ||
| 199 | * (login and commit) have completed.</dd> | ||
| 200 | * | ||
| 201 | * <dt> <code>debug</code> </dt> | ||
| 202 | * <dd> if <code>true</code>, debug messages are displayed on the standard | ||
| 203 | * output stream. | ||
| 204 | * </dl> | ||
| 205 | * </dl> | ||
| 206 | * | ||
| 207 | * <p> | ||
| 208 | * Arbitrary | ||
| 209 | * <a href="{@docRoot}/../../../../../technotes/guides/jndi/jndi-ldap-gl.html#PROP">JNDI properties</a> | ||
| 210 | * may also be specified in the {@link Configuration}. | ||
| 211 | * They are added to the environment and passed to the LDAP provider. | ||
| 212 | * Note that the following four JNDI properties are set by this module directly | ||
| 213 | * and are ignored if also present in the configuration: | ||
| 214 | * <ul> | ||
| 215 | * <li> <code>java.naming.provider.url</code> | ||
| 216 | * <li> <code>java.naming.security.principal</code> | ||
| 217 | * <li> <code>java.naming.security.credentials</code> | ||
| 218 | * <li> <code>java.naming.security.protocol</code> | ||
| 219 | * </ul> | ||
| 220 | * | ||
| 221 | * <p> | ||
| 222 | * Three sample {@link Configuration}s are shown below. | ||
| 223 | * The first one activates search-first mode. It identifies the LDAP server | ||
| 224 | * and specifies that users' entries be located by their <code>uid</code> and | ||
| 225 | * <code>objectClass</code> attributes. It also specifies that an identity | ||
| 226 | * based on the user's <code>employeeNumber</code> attribute should be created. | ||
| 227 | * The second one activates authentication-first mode. It requests that the | ||
| 228 | * LDAP server be located dynamically, that authentication be performed using | ||
| 229 | * the supplied username directly but without the protection of SSL and that | ||
| 230 | * users' entries be located by one of three naming attributes and their | ||
| 231 | * <code>objectClass</code> attribute. | ||
| 232 | * The third one activates authentication-only mode. It identifies alternative | ||
| 233 | * LDAP servers, it specifies the distinguished name to use for | ||
| 234 | * authentication and a fixed identity to use for authorization. No directory | ||
| 235 | * search is performed. | ||
| 236 | * | ||
| 237 | * <pre> | ||
| 238 | * | ||
| 239 | * ExampleApplication { | ||
| 240 | * com.sun.security.auth.module.LdapLoginModule REQUIRED | ||
| 241 | * userProvider="ldap://ldap-svr/ou=people,dc=example,dc=com" | ||
| 242 | * userFilter="(&(uid={USERNAME})(objectClass=inetOrgPerson))" | ||
| 243 | * authzIdentity="{EMPLOYEENUMBER}" | ||
| 244 | * debug=true; | ||
| 245 | * }; | ||
| 246 | * | ||
| 247 | * ExampleApplication { | ||
| 248 | * com.sun.security.auth.module.LdapLoginModule REQUIRED | ||
| 249 | * userProvider="ldap:///cn=users,dc=example,dc=com" | ||
| 250 | * authIdentity="{USERNAME}" | ||
| 251 | * userFilter="(&(|(samAccountName={USERNAME})(userPrincipalName={USERNAME})(cn={USERNAME}))(objectClass=user))" | ||
| 252 | * useSSL=false | ||
| 253 | * debug=true; | ||
| 254 | * }; | ||
| 255 | * | ||
| 256 | * ExampleApplication { | ||
| 257 | * com.sun.security.auth.module.LdapLoginModule REQUIRED | ||
| 258 | * userProvider="ldap://ldap-svr1 ldap://ldap-svr2" | ||
| 259 | * authIdentity="cn={USERNAME},ou=people,dc=example,dc=com" | ||
| 260 | * authzIdentity="staff" | ||
| 261 | * debug=true; | ||
| 262 | * }; | ||
| 263 | * | ||
| 264 | * </pre> | ||
| 265 | * | ||
| 266 | * <dl> | ||
| 267 | * <dt><b>Note:</b> </dt> | ||
| 268 | * <dd>When a {@link SecurityManager} is active then an application | ||
| 269 | * that creates a {@link LoginContext} and uses a {@link LoginModule} | ||
| 270 | * must be granted certain permissions. | ||
| 271 | * <p> | ||
| 272 | * If the application creates a login context using an <em>installed</em> | ||
| 273 | * {@link Configuration} then the application must be granted the | ||
| 274 | * {@link AuthPermission} to create login contexts. | ||
| 275 | * For example, the following security policy allows an application in | ||
| 276 | * the user's current directory to instantiate <em>any</em> login context: | ||
| 277 | * <pre> | ||
| 278 | * | ||
| 279 | * grant codebase "file:${user.dir}/" { | ||
| 280 | * permission javax.security.auth.AuthPermission "createLoginContext.*"; | ||
| 281 | * }; | ||
| 282 | * </pre> | ||
| 283 | * | ||
| 284 | * Alternatively, if the application creates a login context using a | ||
| 285 | * <em>caller-specified</em> {@link Configuration} then the application | ||
| 286 | * must be granted the permissions required by the {@link LoginModule}. | ||
| 287 | * <em>This</em> module requires the following two permissions: | ||
| 288 | * <p> | ||
| 289 | * <ul> | ||
| 290 | * <li> The {@link SocketPermission} to connect to an LDAP server. | ||
| 291 | * <li> The {@link AuthPermission} to modify the set of {@link Principal}s | ||
| 292 | * associated with a {@link Subject}. | ||
| 293 | * </ul> | ||
| 294 | * <p> | ||
| 295 | * For example, the following security policy grants an application in the | ||
| 296 | * user's current directory all the permissions required by this module: | ||
| 297 | * <pre> | ||
| 298 | * | ||
| 299 | * grant codebase "file:${user.dir}/" { | ||
| 300 | * permission java.net.SocketPermission "*:389", "connect"; | ||
| 301 | * permission java.net.SocketPermission "*:636", "connect"; | ||
| 302 | * permission javax.security.auth.AuthPermission "modifyPrincipals"; | ||
| 303 | * }; | ||
| 304 | * </pre> | ||
| 305 | * </dd> | ||
| 306 | * </dl> | ||
| 307 | * | ||
| 308 | * @since 1.6 | ||
| 309 | */ | ||
| 310 | public class LdapLoginModule implements LoginModule { | ||
| 311 | |||
| 312 | // Use the default classloader for this class to load the prompt strings. | ||
| 313 | private static final ResourceBundle rb = AccessController.doPrivileged( | ||
| 314 | new PrivilegedAction<ResourceBundle>() { | ||
| 315 | public ResourceBundle run() { | ||
| 316 | return ResourceBundle.getBundle( | ||
| 317 | "sun.security.util.AuthResources"); | ||
| 318 | } | ||
| 319 | } | ||
| 320 | ); | ||
| 321 | |||
| 322 | // Keys to retrieve the stored username and password | ||
| 323 | private static final String USERNAME_KEY = "javax.security.auth.login.name"; | ||
| 324 | private static final String PASSWORD_KEY = | ||
| 325 | "javax.security.auth.login.password"; | ||
| 326 | |||
| 327 | // Option names | ||
| 328 | private static final String USER_PROVIDER = "userProvider"; | ||
| 329 | private static final String USER_FILTER = "userFilter"; | ||
| 330 | private static final String AUTHC_IDENTITY = "authIdentity"; | ||
| 331 | private static final String AUTHZ_IDENTITY = "authzIdentity"; | ||
| 332 | |||
| 333 | // Used for the username token replacement | ||
| 334 | private static final String USERNAME_TOKEN = "{USERNAME}"; | ||
| 335 | private static final Pattern USERNAME_PATTERN = | ||
| 336 | Pattern.compile("\\{USERNAME\\}"); | ||
| 337 | |||
| 338 | // Configurable options | ||
| 339 | private String userProvider; | ||
| 340 | private String userFilter; | ||
| 341 | private String authcIdentity; | ||
| 342 | private String authzIdentity; | ||
| 343 | private String authzIdentityAttr = null; | ||
| 344 | private boolean useSSL = true; | ||
| 345 | private boolean authFirst = false; | ||
| 346 | private boolean authOnly = false; | ||
| 347 | private boolean useFirstPass = false; | ||
| 348 | private boolean tryFirstPass = false; | ||
| 349 | private boolean storePass = false; | ||
| 350 | private boolean clearPass = false; | ||
| 351 | private boolean debug = false; | ||
| 352 | |||
| 353 | // Authentication status | ||
| 354 | private boolean succeeded = false; | ||
| 355 | private boolean commitSucceeded = false; | ||
| 356 | |||
| 357 | // Supplied username and password | ||
| 358 | private String username; | ||
| 359 | private char[] password; | ||
| 360 | |||
| 361 | // User's identities | ||
| 362 | private LdapPrincipal ldapPrincipal; | ||
| 363 | private UserPrincipal userPrincipal; | ||
| 364 | private UserPrincipal authzPrincipal; | ||
| 365 | |||
| 366 | // Initial state | ||
| 367 | private Subject subject; | ||
| 368 | private CallbackHandler callbackHandler; | ||
| 369 | private Map sharedState; | ||
| 370 | private Map<String, ?> options; | ||
| 371 | private LdapContext ctx; | ||
| 372 | private Matcher identityMatcher = null; | ||
| 373 | private Matcher filterMatcher = null; | ||
| 374 | private Hashtable ldapEnvironment; | ||
| 375 | private SearchControls constraints = null; | ||
| 376 | |||
| 377 | /** | ||
| 378 | * Initialize this <code>LoginModule</code>. | ||
| 379 | * | ||
| 380 | * @param subject the <code>Subject</code> to be authenticated. | ||
| 381 | * @param callbackHandler a <code>CallbackHandler</code> to acquire the | ||
| 382 | * username and password. | ||
| 383 | * @param sharedState shared <code>LoginModule</code> state. | ||
| 384 | * @param options options specified in the login | ||
| 385 | * <code>Configuration</code> for this particular | ||
| 386 | * <code>LoginModule</code>. | ||
| 387 | */ | ||
| 388 | public void initialize(Subject subject, CallbackHandler callbackHandler, | ||
| 389 | Map<String, ?> sharedState, Map<String, ?> options) { | ||
| 390 | |||
| 391 | this.subject = subject; | ||
| 392 | this.callbackHandler = callbackHandler; | ||
| 393 | this.sharedState = sharedState; | ||
| 394 | this.options = options; | ||
| 395 | |||
| 396 | ldapEnvironment = new Hashtable(9); | ||
| 397 | ldapEnvironment.put(Context.INITIAL_CONTEXT_FACTORY, | ||
| 398 | "com.sun.jndi.ldap.LdapCtxFactory"); | ||
| 399 | |||
| 400 | // Add any JNDI properties to the environment | ||
| 401 | for (String key : options.keySet()) { | ||
| 402 | if (key.indexOf(".") > -1) { | ||
| 403 | ldapEnvironment.put(key, options.get(key)); | ||
| 404 | } | ||
| 405 | } | ||
| 406 | |||
| 407 | // initialize any configured options | ||
| 408 | |||
| 409 | userProvider = (String)options.get(USER_PROVIDER); | ||
| 410 | if (userProvider != null) { | ||
| 411 | ldapEnvironment.put(Context.PROVIDER_URL, userProvider); | ||
| 412 | } | ||
| 413 | |||
| 414 | authcIdentity = (String)options.get(AUTHC_IDENTITY); | ||
| 415 | if (authcIdentity != null && | ||
| 416 | (authcIdentity.indexOf(USERNAME_TOKEN) != -1)) { | ||
| 417 | identityMatcher = USERNAME_PATTERN.matcher(authcIdentity); | ||
| 418 | } | ||
| 419 | |||
| 420 | userFilter = (String)options.get(USER_FILTER); | ||
| 421 | if (userFilter != null) { | ||
| 422 | if (userFilter.indexOf(USERNAME_TOKEN) != -1) { | ||
| 423 | filterMatcher = USERNAME_PATTERN.matcher(userFilter); | ||
| 424 | } | ||
| 425 | constraints = new SearchControls(); | ||
| 426 | constraints.setSearchScope(SearchControls.SUBTREE_SCOPE); | ||
| 427 | constraints.setReturningAttributes(new String[0]); //return no attrs | ||
| 428 | constraints.setReturningObjFlag(true); // to get the full DN | ||
| 429 | } | ||
| 430 | |||
| 431 | authzIdentity = (String)options.get(AUTHZ_IDENTITY); | ||
| 432 | if (authzIdentity != null && | ||
| 433 | authzIdentity.startsWith("{") && authzIdentity.endsWith("}")) { | ||
| 434 | if (constraints != null) { | ||
| 435 | authzIdentityAttr = | ||
| 436 | authzIdentity.substring(1, authzIdentity.length() - 1); | ||
| 437 | constraints.setReturningAttributes( | ||
| 438 | new String[]{authzIdentityAttr}); | ||
| 439 | } | ||
| 440 | authzIdentity = null; // set later, from the specified attribute | ||
| 441 | } | ||
| 442 | |||
| 443 | // determine mode | ||
| 444 | if (authcIdentity != null) { | ||
| 445 | if (userFilter != null) { | ||
| 446 | authFirst = true; // authentication-first mode | ||
| 447 | } else { | ||
| 448 | authOnly = true; // authentication-only mode | ||
| 449 | } | ||
| 450 | } | ||
| 451 | |||
| 452 | if ("false".equalsIgnoreCase((String)options.get("useSSL"))) { | ||
| 453 | useSSL = false; | ||
| 454 | ldapEnvironment.remove(Context.SECURITY_PROTOCOL); | ||
| 455 | } else { | ||
| 456 | ldapEnvironment.put(Context.SECURITY_PROTOCOL, "ssl"); | ||
| 457 | } | ||
| 458 | |||
| 459 | tryFirstPass = | ||
| 460 | "true".equalsIgnoreCase((String)options.get("tryFirstPass")); | ||
| 461 | |||
| 462 | useFirstPass = | ||
| 463 | "true".equalsIgnoreCase((String)options.get("useFirstPass")); | ||
| 464 | |||
| 465 | storePass = "true".equalsIgnoreCase((String)options.get("storePass")); | ||
| 466 | |||
| 467 | clearPass = "true".equalsIgnoreCase((String)options.get("clearPass")); | ||
| 468 | |||
| 469 | debug = "true".equalsIgnoreCase((String)options.get("debug")); | ||
| 470 | |||
| 471 | if (debug) { | ||
| 472 | if (authFirst) { | ||
| 473 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 474 | "authentication-first mode; " + | ||
| 475 | (useSSL ? "SSL enabled" : "SSL disabled")); | ||
| 476 | } else if (authOnly) { | ||
| 477 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 478 | "authentication-only mode; " + | ||
| 479 | (useSSL ? "SSL enabled" : "SSL disabled")); | ||
| 480 | } else { | ||
| 481 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 482 | "search-first mode; " + | ||
| 483 | (useSSL ? "SSL enabled" : "SSL disabled")); | ||
| 484 | } | ||
| 485 | } | ||
| 486 | } | ||
| 487 | |||
| 488 | /** | ||
| 489 | * Begin user authentication. | ||
| 490 | * | ||
| 491 | * <p> Acquire the user's credentials and verify them against the | ||
| 492 | * specified LDAP directory. | ||
| 493 | * | ||
| 494 | * @return true always, since this <code>LoginModule</code> | ||
| 495 | * should not be ignored. | ||
| 496 | * @exception FailedLoginException if the authentication fails. | ||
| 497 | * @exception LoginException if this <code>LoginModule</code> | ||
| 498 | * is unable to perform the authentication. | ||
| 499 | */ | ||
| 500 | public boolean login() throws LoginException { | ||
| 501 | |||
| 502 | if (userProvider == null) { | ||
| 503 | throw new LoginException | ||
| 504 | ("Unable to locate the LDAP directory service"); | ||
| 505 | } | ||
| 506 | |||
| 507 | if (debug) { | ||
| 508 | System.out.println("\t\t[LdapLoginModule] user provider: " + | ||
| 509 | userProvider); | ||
| 510 | } | ||
| 511 | |||
| 512 | // attempt the authentication | ||
| 513 | if (tryFirstPass) { | ||
| 514 | |||
| 515 | try { | ||
| 516 | // attempt the authentication by getting the | ||
| 517 | // username and password from shared state | ||
| 518 | attemptAuthentication(true); | ||
| 519 | |||
| 520 | // authentication succeeded | ||
| 521 | succeeded = true; | ||
| 522 | if (debug) { | ||
| 523 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 524 | "tryFirstPass succeeded"); | ||
| 525 | } | ||
| 526 | return true; | ||
| 527 | |||
| 528 | } catch (LoginException le) { | ||
| 529 | // authentication failed -- try again below by prompting | ||
| 530 | cleanState(); | ||
| 531 | if (debug) { | ||
| 532 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 533 | "tryFirstPass failed: " + le.toString()); | ||
| 534 | } | ||
| 535 | } | ||
| 536 | |||
| 537 | } else if (useFirstPass) { | ||
| 538 | |||
| 539 | try { | ||
| 540 | // attempt the authentication by getting the | ||
| 541 | // username and password from shared state | ||
| 542 | attemptAuthentication(true); | ||
| 543 | |||
| 544 | // authentication succeeded | ||
| 545 | succeeded = true; | ||
| 546 | if (debug) { | ||
| 547 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 548 | "useFirstPass succeeded"); | ||
| 549 | } | ||
| 550 | return true; | ||
| 551 | |||
| 552 | } catch (LoginException le) { | ||
| 553 | // authentication failed | ||
| 554 | cleanState(); | ||
| 555 | if (debug) { | ||
| 556 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 557 | "useFirstPass failed"); | ||
| 558 | } | ||
| 559 | throw le; | ||
| 560 | } | ||
| 561 | } | ||
| 562 | |||
| 563 | // attempt the authentication by prompting for the username and pwd | ||
| 564 | try { | ||
| 565 | attemptAuthentication(false); | ||
| 566 | |||
| 567 | // authentication succeeded | ||
| 568 | succeeded = true; | ||
| 569 | if (debug) { | ||
| 570 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 571 | "authentication succeeded"); | ||
| 572 | } | ||
| 573 | return true; | ||
| 574 | |||
| 575 | } catch (LoginException le) { | ||
| 576 | cleanState(); | ||
| 577 | if (debug) { | ||
| 578 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 579 | "authentication failed"); | ||
| 580 | } | ||
| 581 | throw le; | ||
| 582 | } | ||
| 583 | } | ||
| 584 | |||
| 585 | /** | ||
| 586 | * Complete user authentication. | ||
| 587 | * | ||
| 588 | * <p> This method is called if the LoginContext's | ||
| 589 | * overall authentication succeeded | ||
| 590 | * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules | ||
| 591 | * succeeded). | ||
| 592 | * | ||
| 593 | * <p> If this LoginModule's own authentication attempt | ||
| 594 | * succeeded (checked by retrieving the private state saved by the | ||
| 595 | * <code>login</code> method), then this method associates an | ||
| 596 | * <code>LdapPrincipal</code> and one or more <code>UserPrincipal</code>s | ||
| 597 | * with the <code>Subject</code> located in the | ||
| 598 | * <code>LoginModule</code>. If this LoginModule's own | ||
| 599 | * authentication attempted failed, then this method removes | ||
| 600 | * any state that was originally saved. | ||
| 601 | * | ||
| 602 | * @exception LoginException if the commit fails | ||
| 603 | * @return true if this LoginModule's own login and commit | ||
| 604 | * attempts succeeded, or false otherwise. | ||
| 605 | */ | ||
| 606 | public boolean commit() throws LoginException { | ||
| 607 | |||
| 608 | if (succeeded == false) { | ||
| 609 | return false; | ||
| 610 | } else { | ||
| 611 | if (subject.isReadOnly()) { | ||
| 612 | cleanState(); | ||
| 613 | throw new LoginException ("Subject is read-only"); | ||
| 614 | } | ||
| 615 | // add Principals to the Subject | ||
| 616 | Set<Principal> principals = subject.getPrincipals(); | ||
| 617 | if (! principals.contains(ldapPrincipal)) { | ||
| 618 | principals.add(ldapPrincipal); | ||
| 619 | } | ||
| 620 | if (debug) { | ||
| 621 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 622 | "added LdapPrincipal \"" + | ||
| 623 | ldapPrincipal + | ||
| 624 | "\" to Subject"); | ||
| 625 | } | ||
| 626 | |||
| 627 | if (! principals.contains(userPrincipal)) { | ||
| 628 | principals.add(userPrincipal); | ||
| 629 | } | ||
| 630 | if (debug) { | ||
| 631 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 632 | "added UserPrincipal \"" + | ||
| 633 | userPrincipal + | ||
| 634 | "\" to Subject"); | ||
| 635 | } | ||
| 636 | |||
| 637 | if (authzPrincipal != null && | ||
| 638 | (! principals.contains(authzPrincipal))) { | ||
| 639 | principals.add(authzPrincipal); | ||
| 640 | |||
| 641 | if (debug) { | ||
| 642 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 643 | "added UserPrincipal \"" + | ||
| 644 | authzPrincipal + | ||
| 645 | "\" to Subject"); | ||
| 646 | } | ||
| 647 | } | ||
| 648 | } | ||
| 649 | // in any case, clean out state | ||
| 650 | cleanState(); | ||
| 651 | commitSucceeded = true; | ||
| 652 | return true; | ||
| 653 | } | ||
| 654 | |||
| 655 | /** | ||
| 656 | * Abort user authentication. | ||
| 657 | * | ||
| 658 | * <p> This method is called if the overall authentication failed. | ||
| 659 | * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules | ||
| 660 | * did not succeed). | ||
| 661 | * | ||
| 662 | * <p> If this LoginModule's own authentication attempt | ||
| 663 | * succeeded (checked by retrieving the private state saved by the | ||
| 664 | * <code>login</code> and <code>commit</code> methods), | ||
| 665 | * then this method cleans up any state that was originally saved. | ||
| 666 | * | ||
| 667 | * @exception LoginException if the abort fails. | ||
| 668 | * @return false if this LoginModule's own login and/or commit attempts | ||
| 669 | * failed, and true otherwise. | ||
| 670 | */ | ||
| 671 | public boolean abort() throws LoginException { | ||
| 672 | if (debug) | ||
| 673 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 674 | "aborted authentication"); | ||
| 675 | |||
| 676 | if (succeeded == false) { | ||
| 677 | return false; | ||
| 678 | } else if (succeeded == true && commitSucceeded == false) { | ||
| 679 | |||
| 680 | // Clean out state | ||
| 681 | succeeded = false; | ||
| 682 | cleanState(); | ||
| 683 | |||
| 684 | ldapPrincipal = null; | ||
| 685 | userPrincipal = null; | ||
| 686 | authzPrincipal = null; | ||
| 687 | } else { | ||
| 688 | // overall authentication succeeded and commit succeeded, | ||
| 689 | // but someone else's commit failed | ||
| 690 | logout(); | ||
| 691 | } | ||
| 692 | return true; | ||
| 693 | } | ||
| 694 | |||
| 695 | /** | ||
| 696 | * Logout a user. | ||
| 697 | * | ||
| 698 | * <p> This method removes the Principals | ||
| 699 | * that were added by the <code>commit</code> method. | ||
| 700 | * | ||
| 701 | * @exception LoginException if the logout fails. | ||
| 702 | * @return true in all cases since this <code>LoginModule</code> | ||
| 703 | * should not be ignored. | ||
| 704 | */ | ||
| 705 | public boolean logout() throws LoginException { | ||
| 706 | if (subject.isReadOnly()) { | ||
| 707 | cleanState(); | ||
| 708 | throw new LoginException ("Subject is read-only"); | ||
| 709 | } | ||
| 710 | Set<Principal> principals = subject.getPrincipals(); | ||
| 711 | principals.remove(ldapPrincipal); | ||
| 712 | principals.remove(userPrincipal); | ||
| 713 | if (authzIdentity != null) { | ||
| 714 | principals.remove(authzPrincipal); | ||
| 715 | } | ||
| 716 | |||
| 717 | // clean out state | ||
| 718 | cleanState(); | ||
| 719 | succeeded = false; | ||
| 720 | commitSucceeded = false; | ||
| 721 | |||
| 722 | ldapPrincipal = null; | ||
| 723 | userPrincipal = null; | ||
| 724 | authzPrincipal = null; | ||
| 725 | |||
| 726 | if (debug) { | ||
| 727 | System.out.println("\t\t[LdapLoginModule] logged out Subject"); | ||
| 728 | } | ||
| 729 | return true; | ||
| 730 | } | ||
| 731 | |||
| 732 | /** | ||
| 733 | * Attempt authentication | ||
| 734 | * | ||
| 735 | * @param getPasswdFromSharedState boolean that tells this method whether | ||
| 736 | * to retrieve the password from the sharedState. | ||
| 737 | * @exception LoginException if the authentication attempt fails. | ||
| 738 | */ | ||
| 739 | private void attemptAuthentication(boolean getPasswdFromSharedState) | ||
| 740 | throws LoginException { | ||
| 741 | |||
| 742 | // first get the username and password | ||
| 743 | getUsernamePassword(getPasswdFromSharedState); | ||
| 744 | |||
| 745 | if (password == null || password.length == 0) { | ||
| 746 | throw (LoginException) | ||
| 747 | new FailedLoginException("No password was supplied"); | ||
| 748 | } | ||
| 749 | |||
| 750 | String dn = ""; | ||
| 751 | |||
| 752 | if (authFirst || authOnly) { | ||
| 753 | |||
| 754 | String id = replaceUsernameToken(identityMatcher, authcIdentity); | ||
| 755 | |||
| 756 | // Prepare to bind using user's username and password | ||
| 757 | ldapEnvironment.put(Context.SECURITY_CREDENTIALS, password); | ||
| 758 | ldapEnvironment.put(Context.SECURITY_PRINCIPAL, id); | ||
| 759 | |||
| 760 | if (debug) { | ||
| 761 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 762 | "attempting to authenticate user: " + username); | ||
| 763 | } | ||
| 764 | |||
| 765 | try { | ||
| 766 | // Connect to the LDAP server (using simple bind) | ||
| 767 | ctx = new InitialLdapContext(ldapEnvironment, null); | ||
| 768 | |||
| 769 | } catch (NamingException e) { | ||
| 770 | throw (LoginException) | ||
| 771 | new FailedLoginException("Cannot bind to LDAP server") | ||
| 772 | .initCause(e); | ||
| 773 | } | ||
| 774 | |||
| 775 | // Authentication has succeeded | ||
| 776 | |||
| 777 | // Locate the user's distinguished name | ||
| 778 | if (userFilter != null) { | ||
| 779 | dn = findUserDN(ctx); | ||
| 780 | } else { | ||
| 781 | dn = id; | ||
| 782 | } | ||
| 783 | |||
| 784 | } else { | ||
| 785 | |||
| 786 | try { | ||
| 787 | // Connect to the LDAP server (using anonymous bind) | ||
| 788 | ctx = new InitialLdapContext(ldapEnvironment, null); | ||
| 789 | |||
| 790 | } catch (NamingException e) { | ||
| 791 | throw (LoginException) | ||
| 792 | new FailedLoginException("Cannot connect to LDAP server") | ||
| 793 | .initCause(e); | ||
| 794 | } | ||
| 795 | |||
| 796 | // Locate the user's distinguished name | ||
| 797 | dn = findUserDN(ctx); | ||
| 798 | |||
| 799 | try { | ||
| 800 | |||
| 801 | // Prepare to bind using user's distinguished name and password | ||
| 802 | ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple"); | ||
| 803 | ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, dn); | ||
| 804 | ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password); | ||
| 805 | |||
| 806 | if (debug) { | ||
| 807 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 808 | "attempting to authenticate user: " + username); | ||
| 809 | } | ||
| 810 | // Connect to the LDAP server (using simple bind) | ||
| 811 | ctx.reconnect(null); | ||
| 812 | |||
| 813 | // Authentication has succeeded | ||
| 814 | |||
| 815 | } catch (NamingException e) { | ||
| 816 | throw (LoginException) | ||
| 817 | new FailedLoginException("Cannot bind to LDAP server") | ||
| 818 | .initCause(e); | ||
| 819 | } | ||
| 820 | } | ||
| 821 | |||
| 822 | // Save input as shared state only if authentication succeeded | ||
| 823 | if (storePass && | ||
| 824 | !sharedState.containsKey(USERNAME_KEY) && | ||
| 825 | !sharedState.containsKey(PASSWORD_KEY)) { | ||
| 826 | sharedState.put(USERNAME_KEY, username); | ||
| 827 | sharedState.put(PASSWORD_KEY, password); | ||
| 828 | } | ||
| 829 | |||
| 830 | // Create the user principals | ||
| 831 | userPrincipal = new UserPrincipal(username); | ||
| 832 | if (authzIdentity != null) { | ||
| 833 | authzPrincipal = new UserPrincipal(authzIdentity); | ||
| 834 | } | ||
| 835 | |||
| 836 | try { | ||
| 837 | |||
| 838 | ldapPrincipal = new LdapPrincipal(dn); | ||
| 839 | |||
| 840 | } catch (InvalidNameException e) { | ||
| 841 | if (debug) { | ||
| 842 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 843 | "cannot create LdapPrincipal: bad DN"); | ||
| 844 | } | ||
| 845 | throw (LoginException) | ||
| 846 | new FailedLoginException("Cannot create LdapPrincipal") | ||
| 847 | .initCause(e); | ||
| 848 | } | ||
| 849 | } | ||
| 850 | |||
| 851 | /** | ||
| 852 | * Search for the user's entry. | ||
| 853 | * Determine the distinguished name of the user's entry and optionally | ||
| 854 | * an authorization identity for the user. | ||
| 855 | * | ||
| 856 | * @param ctx an LDAP context to use for the search | ||
| 857 | * @return the user's distinguished name or an empty string if none | ||
| 858 | * was found. | ||
| 859 | * @exception LoginException if the user's entry cannot be found. | ||
| 860 | */ | ||
| 861 | private String findUserDN(LdapContext ctx) throws LoginException { | ||
| 862 | |||
| 863 | String userDN = ""; | ||
| 864 | |||
| 865 | // Locate the user's LDAP entry | ||
| 866 | if (userFilter != null) { | ||
| 867 | if (debug) { | ||
| 868 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 869 | "searching for entry belonging to user: " + username); | ||
| 870 | } | ||
| 871 | } else { | ||
| 872 | if (debug) { | ||
| 873 | System.out.println("\t\t[LdapLoginModule] " + | ||
| 874 | "cannot search for entry belonging to user: " + username); | ||
| 875 | } | ||
| 876 | throw (LoginException) | ||
| 877 | new FailedLoginException("Cannot find user's LDAP entry"); | ||
| 878 | } | ||
| 879 | |||
| 880 | try { | ||
| 881 | NamingEnumeration<SearchResult> results = ctx.search("", | ||
| 882 | replaceUsernameToken(filterMatcher, userFilter), constraints); | ||
| 883 | |||
| 884 | // Extract the distinguished name of the user's entry | ||
| 885 | // (Use the first entry if more than one is returned) | ||
| 886 | if (results.hasMore()) { | ||
| 887 | SearchResult entry = results.next(); | ||
| 888 | |||
| 889 | // %%% - use the SearchResult.getNameInNamespace method | ||
| 890 | // available in JDK 1.5 and later. | ||
| 891 | // (can remove call to constraints.setReturningObjFlag) | ||
| 892 | userDN = ((Context)entry.getObject()).getNameInNamespace(); | ||
| 893 | |||
| 894 | if (debug) { | ||
| 895 | System.out.println("\t\t[LdapLoginModule] found entry: " + | ||
| 896 | userDN); | ||
| 897 | } | ||
| 898 | |||
| 899 | // Extract a value from user's authorization identity attribute | ||
| 900 | if (authzIdentityAttr != null) { | ||
| 901 | Attribute attr = | ||
| 902 | entry.getAttributes().get(authzIdentityAttr); | ||
| 903 | if (attr != null) { | ||
| 904 | Object val = attr.get(); | ||
| 905 | if (val instanceof String) { | ||
| 906 | authzIdentity = (String) val; | ||
| 907 | } | ||
| 908 | } | ||
| 909 | } | ||
| 910 | |||
| 911 | results.close(); | ||
| 912 | |||
| 913 | } else { | ||
| 914 | // Bad username | ||
| 915 | if (debug) { | ||
| 916 | System.out.println("\t\t[LdapLoginModule] user's entry " + | ||
| 917 | "not found"); | ||
| 918 | } | ||
| 919 | } | ||
| 920 | |||
| 921 | } catch (NamingException e) { | ||
| 922 | // ignore | ||
| 923 | } | ||
| 924 | |||
| 925 | if (userDN.equals("")) { | ||
| 926 | throw (LoginException) | ||
| 927 | new FailedLoginException("Cannot find user's LDAP entry"); | ||
| 928 | } else { | ||
| 929 | return userDN; | ||
| 930 | } | ||
| 931 | } | ||
| 932 | |||
| 933 | /** | ||
| 934 | * Replace the username token | ||
| 935 | * | ||
| 936 | * @param string the target string | ||
| 937 | * @return the modified string | ||
| 938 | */ | ||
| 939 | private String replaceUsernameToken(Matcher matcher, String string) { | ||
| 940 | return matcher != null ? matcher.replaceAll(username) : string; | ||
| 941 | } | ||
| 942 | |||
| 943 | /** | ||
| 944 | * Get the username and password. | ||
| 945 | * This method does not return any value. | ||
| 946 | * Instead, it sets global name and password variables. | ||
| 947 | * | ||
| 948 | * <p> Also note that this method will set the username and password | ||
| 949 | * values in the shared state in case subsequent LoginModules | ||
| 950 | * want to use them via use/tryFirstPass. | ||
| 951 | * | ||
| 952 | * @param getPasswdFromSharedState boolean that tells this method whether | ||
| 953 | * to retrieve the password from the sharedState. | ||
| 954 | * @exception LoginException if the username/password cannot be acquired. | ||
| 955 | */ | ||
| 956 | private void getUsernamePassword(boolean getPasswdFromSharedState) | ||
| 957 | throws LoginException { | ||
| 958 | |||
| 959 | if (getPasswdFromSharedState) { | ||
| 960 | // use the password saved by the first module in the stack | ||
| 961 | username = (String)sharedState.get(USERNAME_KEY); | ||
| 962 | password = (char[])sharedState.get(PASSWORD_KEY); | ||
| 963 | return; | ||
| 964 | } | ||
| 965 | |||
| 966 | // prompt for a username and password | ||
| 967 | if (callbackHandler == null) | ||
| 968 | throw new LoginException("No CallbackHandler available " + | ||
| 969 | "to acquire authentication information from the user"); | ||
| 970 | |||
| 971 | Callback[] callbacks = new Callback[2]; | ||
| 972 | callbacks[0] = new NameCallback(rb.getString("username.")); | ||
| 973 | callbacks[1] = new PasswordCallback(rb.getString("password."), false); | ||
| 974 | |||
| 975 | try { | ||
| 976 | callbackHandler.handle(callbacks); | ||
| 977 | username = ((NameCallback)callbacks[0]).getName(); | ||
| 978 | char[] tmpPassword = ((PasswordCallback)callbacks[1]).getPassword(); | ||
| 979 | password = new char[tmpPassword.length]; | ||
| 980 | System.arraycopy(tmpPassword, 0, | ||
| 981 | password, 0, tmpPassword.length); | ||
| 982 | ((PasswordCallback)callbacks[1]).clearPassword(); | ||
| 983 | |||
| 984 | } catch (java.io.IOException ioe) { | ||
| 985 | throw new LoginException(ioe.toString()); | ||
| 986 | |||
| 987 | } catch (UnsupportedCallbackException uce) { | ||
| 988 | throw new LoginException("Error: " + uce.getCallback().toString() + | ||
| 989 | " not available to acquire authentication information" + | ||
| 990 | " from the user"); | ||
| 991 | } | ||
| 992 | } | ||
| 993 | |||
| 994 | /** | ||
| 995 | * Clean out state because of a failed authentication attempt | ||
| 996 | */ | ||
| 997 | private void cleanState() { | ||
| 998 | username = null; | ||
| 999 | if (password != null) { | ||
| 1000 | Arrays.fill(password, ' '); | ||
| 1001 | password = null; | ||
| 1002 | } | ||
| 1003 | try { | ||
| 1004 | if (ctx != null) { | ||
| 1005 | ctx.close(); | ||
| 1006 | } | ||
| 1007 | } catch (NamingException e) { | ||
| 1008 | // ignore | ||
| 1009 | } | ||
| 1010 | ctx = null; | ||
| 1011 | |||
| 1012 | if (clearPass) { | ||
| 1013 | sharedState.remove(USERNAME_KEY); | ||
| 1014 | sharedState.remove(PASSWORD_KEY); | ||
| 1015 | } | ||
| 1016 | } | ||
| 1017 | } | ||