import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
/**
 * New ldap authenticator.
 *
 * @param l the ldap settings.
 * @return the authenticator
 */
public static Authenticator newLdaptiveAuthenticator(final AbstractLdapAuthenticationProperties l) {
    switch (l.getType()) {
        case AD:
            LOGGER.debug("Creating active directory authenticator for [{}]", l.getLdapUrl());
            return getActiveDirectoryAuthenticator(l);
        case DIRECT:
            LOGGER.debug("Creating direct-bind authenticator for [{}]", l.getLdapUrl());
            return getDirectBindAuthenticator(l);
        case AUTHENTICATED:
            LOGGER.debug("Creating authenticated authenticator for [{}]", l.getLdapUrl());
            return getAuthenticatedOrAnonSearchAuthenticator(l);
        default:
            LOGGER.debug("Creating anonymous authenticator for [{}]", l.getLdapUrl());
            return getAuthenticatedOrAnonSearchAuthenticator(l);
    }
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Override
protected void configure() {

  Multibinder<AuthenticationHandler> handlerBinder =
      Multibinder.newSetBinder(
          binder(), com.codenvy.api.dao.authentication.AuthenticationHandler.class);
  handlerBinder.addBinding().to(LdapAuthenticationHandler.class);

  bind(Authenticator.class).toProvider(AuthenticatorProvider.class);
  bind(ConnectionFactory.class).toProvider(LdapConnectionFactoryProvider.class);
  bind(PooledConnectionFactory.class).toProvider(LdapConnectionFactoryProvider.class);

  bind(EntryResolver.class).toProvider(EntryResolverProvider.class);

  bind(DBUserLinker.class).toProvider(DBUserLinkerProvider.class);
  bind(LdapEntrySelector.class).toProvider(LdapEntrySelectorProvider.class);
  bind(LdapSynchronizer.class).asEagerSingleton();
  bind(LdapSynchronizerService.class);
  bind(LdapSynchronizerPermissionsFilter.class);
  bind(DisablePasswordOperationsFilter.class);
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
private static Authenticator getDirectBindAuthenticator(final AbstractLdapAuthenticationProperties l) {
    if (StringUtils.isBlank(l.getDnFormat())) {
        throw new IllegalArgumentException("Dn format cannot be empty/blank for direct bind authentication");
    }
    final FormatDnResolver resolver = new FormatDnResolver(l.getDnFormat());
    final Authenticator authenticator = new Authenticator(resolver, getPooledBindAuthenticationHandler(l, Beans.newLdaptivePooledConnectionFactory(l)));

    if (l.isEnhanceWithEntryResolver()) {
        authenticator.setEntryResolver(Beans.newLdaptiveSearchEntryResolver(l, Beans.newLdaptivePooledConnectionFactory(l)));
    }
    return authenticator;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
private static Authenticator getActiveDirectoryAuthenticator(final AbstractLdapAuthenticationProperties l) {
    if (StringUtils.isBlank(l.getDnFormat())) {
        throw new IllegalArgumentException("Dn format cannot be empty/blank for active directory authentication");
    }
    final FormatDnResolver resolver = new FormatDnResolver(l.getDnFormat());
    final Authenticator authn = new Authenticator(resolver, getPooledBindAuthenticationHandler(l, Beans.newLdaptivePooledConnectionFactory(l)));

    if (l.isEnhanceWithEntryResolver()) {
        authn.setEntryResolver(Beans.newLdaptiveSearchEntryResolver(l, Beans.newLdaptivePooledConnectionFactory(l)));
    }
    return authn;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
private Authenticator getAuthenticator(
    PooledConnectionFactory connFactory, EntryResolver entryResolver) {
  switch (type) {
    case AD:
      return getActiveDirectoryAuthenticator(connFactory, entryResolver);
    case DIRECT:
      return getDirectBindAuthenticator(connFactory);
    case SASL:
      return getSaslAuthenticator(connFactory);
    case ANONYMOUS:
    case AUTHENTICATED:
    default:
      return getAuthenticatedOrAnonSearchAuthenticator(connFactory, entryResolver);
  }
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
private Authenticator getSaslAuthenticator(PooledConnectionFactory connFactory) {
  checkRequiredProperty(
      Pair.of(USER_FILTER_PROPERTY_NAME, userFilter),
      Pair.of(BASE_DN_PROPERTY_NAME, baseDn),
      Pair.of(USER_FILTER_PROPERTY_NAME, userFilter));
  final PooledSearchDnResolver resolver = new PooledSearchDnResolver();
  resolver.setBaseDn(baseDn);
  resolver.setSubtreeSearch(subtreeSearch);
  resolver.setAllowMultipleDns(allowMultipleDns);
  resolver.setConnectionFactory(connFactory);
  resolver.setUserFilter(userFilter);
  return new Authenticator(resolver, getPooledBindAuthenticationHandler(connFactory));
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
private Authenticator getActiveDirectoryAuthenticator(
    PooledConnectionFactory connFactory, EntryResolver entryResolver) {
  checkRequiredProperty(DN_FORMAT_PROPERTY_NAME, dnFormat);
  final FormatDnResolver resolver = new FormatDnResolver(dnFormat);
  final Authenticator authn =
      new Authenticator(resolver, getPooledBindAuthenticationHandler(connFactory));
  authn.setEntryResolver(entryResolver);
  return authn;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Inject
public LdapAuthenticationHandler(
    Authenticator ldapAuthenticator, LdapUserIdNormalizer idNormalizer) {
  this.ldapAuthenticator = ldapAuthenticator;
  this.idNormalizer = idNormalizer;
  this.returnAttributes = new String[] {idNormalizer.getIdAttributeName()};
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Test
public void directAuth() throws Exception {
  PooledConnectionFactory connFactory = server.getConnectionFactory();
  EntryResolver entryResolver =
      new EntryResolverProvider(
              connFactory,
              "ou=developers,dc=codenvy,dc=com", // <- base dn
              null, // <- user filter
              null)
          .get(); // <- subtree search
  Authenticator authenticator =
      new AuthenticatorProvider(
              connFactory,
              entryResolver,
              "ou=developers,dc=codenvy,dc=com", // <- base dn
              "DIRECT", // <- auth type
              "cn=%s,ou=developers,dc=codenvy,dc=com", // <- dn format
              null, // <- user password attribute
              null, // <- user filter
              null, // <- allow multiple dns
              null)
          .get(); // <- subtree search

  LdapAuthenticationHandler handler = new LdapAuthenticationHandler(authenticator, cnNormalizer);

  mustAuthenticate(handler, "mike", "mike");
  mustAuthenticate(handler, "john", "john");
  mustNotAuthenticate(handler, "brad", "brad");
  mustNotAuthenticate(handler, "ivan", "ivan");
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Test
public void authenticatedAuthUsingRootBaseDN() {
  PooledConnectionFactory connFactory = server.getConnectionFactory();
  EntryResolver entryResolver =
      new EntryResolverProvider(
              connFactory,
              "dc=codenvy,dc=com", // <- base dn
              "cn={user}", // <- user filter
              "true")
          .get(); // <- subtree search
  Authenticator authenticator =
      new AuthenticatorProvider(
              connFactory,
              entryResolver,
              "dc=codenvy,dc=com", // <- base dn
              "AUTHENTICATED", // <- auth type
              null, // <- dn format
              null, // <- user password attribute
              "cn={user}", // <- user filter
              null, // <- allow multiple dns
              "true")
          .get(); // <- subtree search

  LdapAuthenticationHandler handler = new LdapAuthenticationHandler(authenticator, cnNormalizer);

  mustAuthenticate(handler, "mike", "mike");
  mustAuthenticate(handler, "john", "john");
  mustAuthenticate(handler, "ivan", "ivan");
  mustAuthenticate(handler, "brad", "brad");
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Test
public void authenticatedAuthUsingCertainBaseDn() {
  PooledConnectionFactory connFactory = server.getConnectionFactory();
  EntryResolver entryResolver =
      new EntryResolverProvider(
              connFactory,
              "ou=managers,dc=codenvy,dc=com", // <- base dn
              "(&(objectClass=inetOrgPerson)(cn={user}))", // <- user filter
              "true")
          .get(); // <- subtree search
  Authenticator authenticator =
      new AuthenticatorProvider(
              connFactory,
              entryResolver,
              "ou=managers,dc=codenvy,dc=com", // <- base dn
              "AUTHENTICATED", // <- auth type
              null, // <- dn format
              null, // <- user password attribute
              "(&(objectClass=inetOrgPerson)(cn={user}))", // <- user filter
              null, // <- allow multiple dns
              "true")
          .get(); // <- subtree search

  LdapAuthenticationHandler handler = new LdapAuthenticationHandler(authenticator, cnNormalizer);

  mustAuthenticate(handler, "ivan", "ivan");
  mustAuthenticate(handler, "brad", "brad");
  mustNotAuthenticate(handler, "mike", "mike");
  mustNotAuthenticate(handler, "john", "john");
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Override
public Authentication authenticate(final Authentication authentication) throws AuthenticationException {
    try {
        final String username = authentication.getPrincipal().toString();
        final Object credentials = authentication.getCredentials();
        final String password = credentials == null ? null : credentials.toString();

        LOGGER.debug("Preparing LDAP authentication request for user [{}]", username);

        final AuthenticationRequest request = new AuthenticationRequest(username, new org.ldaptive.Credential(password), ReturnAttributes.ALL.value());
        final Authenticator authenticator = Beans.newLdaptiveAuthenticator(adminPagesSecurityProperties.getLdap());
        LOGGER.debug("Executing LDAP authentication request for user [{}]", username);
        
        final AuthenticationResponse response = authenticator.authenticate(request);
        LOGGER.debug("LDAP response: [{}]", response);
        
        if (response.getResult()) {
            final LdapEntry entry = response.getLdapEntry();

            final CommonProfile profile = new CommonProfile();
            profile.setId(username);
            entry.getAttributes().forEach(a -> profile.addAttribute(a.getName(), a.getStringValues()));

            LOGGER.debug("Collected user profile [{}]", profile);

            this.authorizationGenerator.generate(WebUtils.getPac4jJ2EContext(), profile);
            LOGGER.debug("Assembled user profile with roles after generating authorization claims [{}]", profile);

            final Collection<GrantedAuthority> authorities = new ArrayList<>();
            authorities.addAll(profile.getRoles().stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList()));
            LOGGER.debug("List of authorities remapped from profile roles are [{}]", authorities);

            final RequireAnyRoleAuthorizer authorizer = new RequireAnyRoleAuthorizer(adminPagesSecurityProperties.getAdminRoles());
            LOGGER.debug("Executing authorization for expected admin roles [{}]", authorizer.getElements());

            final J2EContext context = WebUtils.getPac4jJ2EContext();

            if (authorizer.isAllAuthorized(context, Arrays.asList(profile))) {
                return new UsernamePasswordAuthenticationToken(username, password, authorities);
            }
            LOGGER.warn("User [{}] is not authorized to access the requested resource allowed to roles [{}]",
                    username, authorizer.getElements());
        } else {
            LOGGER.warn("LDAP authentication response produced no results for [{}]", username);
        }

    } catch (final Exception e) {
        LOGGER.error(e.getMessage(), e);
        throw new InsufficientAuthenticationException("Unexpected LDAP error", e);
    }
    throw new BadCredentialsException("Could not authenticate provided credentials");
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Bean
public Collection<AuthenticationHandler> ldapAuthenticationHandlers() {
    final Collection<AuthenticationHandler> handlers = new HashSet<>();

    casProperties.getAuthn().getLdap()
            .stream()
            .filter(ldapInstanceConfigurationPredicate())
            .forEach(l -> {
                final Map<String, String> attributes = Beans.transformPrincipalAttributesListIntoMap(l.getPrincipalAttributeList());
                LOGGER.debug("Created and mapped principal attributes [{}] for [{}]...", attributes, l.getLdapUrl());

                LOGGER.debug("Creating ldap authenticator for [{}] and baseDn [{}]", l.getLdapUrl(), l.getBaseDn());
                final Authenticator authenticator = Beans.newLdaptiveAuthenticator(l);
                LOGGER.debug("Ldap authenticator configured with return attributes [{}] for [{}] and baseDn [{}]",
                        attributes.keySet(), l.getLdapUrl(), l.getBaseDn());

                LOGGER.debug("Creating ldap authentication handler for [{}]", l.getLdapUrl());
                final LdapAuthenticationHandler handler = new LdapAuthenticationHandler(l.getName(),
                        servicesManager, ldapPrincipalFactory(),
                        l.getOrder(), authenticator);

                final List<String> additionalAttributes = l.getAdditionalAttributes();
                if (StringUtils.isNotBlank(l.getPrincipalAttributeId())) {
                    additionalAttributes.add(l.getPrincipalAttributeId());
                }
                handler.setAllowMultiplePrincipalAttributeValues(l.isAllowMultiplePrincipalAttributeValues());
                handler.setAllowMissingPrincipalAttributeValue(l.isAllowMissingPrincipalAttributeValue());
                handler.setPasswordEncoder(Beans.newPasswordEncoder(l.getPasswordEncoder()));
                handler.setPrincipalNameTransformer(Beans.newPrincipalNameTransformer(l.getPrincipalTransformation()));

                if (StringUtils.isNotBlank(l.getCredentialCriteria())) {
                    LOGGER.debug("Ldap authentication for [{}] is filtering credentials by [{}]",
                            l.getLdapUrl(), l.getCredentialCriteria());
                    handler.setCredentialSelectionPredicate(Beans.newCredentialSelectionPredicate(l.getCredentialCriteria()));
                }

                if (StringUtils.isBlank(l.getPrincipalAttributeId())) {
                    LOGGER.debug("No principal id attribute is found for ldap authentication via [{}]", l.getLdapUrl());
                } else {
                    handler.setPrincipalIdAttribute(l.getPrincipalAttributeId());
                    LOGGER.debug("Using principal id attribute [{}] for ldap authentication via [{}]", l.getPrincipalAttributeId(),
                            l.getLdapUrl());
                }

                if (l.getPasswordPolicy().isEnabled()) {
                    LOGGER.debug("Password policy is enabled for [{}]. Constructing password policy configuration", l.getLdapUrl());
                    handler.setPasswordPolicyConfiguration(createLdapPasswordPolicyConfiguration(l, authenticator, attributes));
                }

                handler.setPrincipalAttributeMap(attributes);

                LOGGER.debug("Initializing ldap authentication handler for [{}]", l.getLdapUrl());
                handler.initialize();
                handlers.add(handler);
            });
    return handlers;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
public LdapAuthenticator(final Authenticator ldapAuthenticator) {
    this.ldapAuthenticator = ldapAuthenticator;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
public Authenticator getLdapAuthenticator() {
    return ldapAuthenticator;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
public void setLdapAuthenticator(Authenticator ldapAuthenticator) {
    this.ldapAuthenticator = ldapAuthenticator;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
public static Authenticator create() {
    final FormatDnResolver dnResolver = new FormatDnResolver();
    dnResolver.setFormat(LdapServer.CN + "=%s," + LdapServer.BASE_PEOPLE_DN);

    final ConnectionConfig connectionConfig = new ConnectionConfig();
    connectionConfig.setConnectTimeout(500);
    connectionConfig.setResponseTimeout(1000);
    connectionConfig.setLdapUrl("ldap://localhost:" + LdapServer.PORT);

    final DefaultConnectionFactory connectionFactory = new DefaultConnectionFactory();
    connectionFactory.setConnectionConfig(connectionConfig);

    final PoolConfig poolConfig = new PoolConfig();
    poolConfig.setMinPoolSize(1);
    poolConfig.setMaxPoolSize(2);
    poolConfig.setValidateOnCheckOut(true);
    poolConfig.setValidateOnCheckIn(true);
    poolConfig.setValidatePeriodically(false);

    final SearchValidator searchValidator = new SearchValidator();

    final IdlePruneStrategy pruneStrategy = new IdlePruneStrategy();

    final BlockingConnectionPool connectionPool = new BlockingConnectionPool();
    connectionPool.setPoolConfig(poolConfig);
    connectionPool.setBlockWaitTime(1000);
    connectionPool.setValidator(searchValidator);
    connectionPool.setPruneStrategy(pruneStrategy);
    connectionPool.setConnectionFactory(connectionFactory);
    connectionPool.initialize();

    final PooledConnectionFactory pooledConnectionFactory = new PooledConnectionFactory();
    pooledConnectionFactory.setConnectionPool(connectionPool);

    final PooledBindAuthenticationHandler handler = new PooledBindAuthenticationHandler();
    handler.setConnectionFactory(pooledConnectionFactory);

    final Authenticator authenticator = new Authenticator();
    authenticator.setDnResolver(dnResolver);
    authenticator.setAuthenticationHandler(handler);
    return authenticator;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
@Override
public Authenticator get() {
  return authenticator;
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
private Authenticator getDirectBindAuthenticator(PooledConnectionFactory connFactory) {
  checkRequiredProperty(DN_FORMAT_PROPERTY_NAME, dnFormat);
  final FormatDnResolver resolver = new FormatDnResolver(dnFormat);
  return new Authenticator(resolver, getPooledBindAuthenticationHandler(connFactory));
}
 

import org.ldaptive.auth.Authenticator; //导入依赖的package包/类
/**
 * Perform authentication with given username and password.
 * Receive the result from Ldap server
 * @param username Username that user entered to login
 * @param password Password that user entered to login
 * @return LdapEntry which contains all user attributes
 */
private LdapEntry authenticate(String username,Object password)
{
  try {
    SearchDnResolver dnResolver = new SearchDnResolver(new DefaultConnectionFactory(connConfig));

    dnResolver.setBaseDn(_userBaseDn);
    dnResolver.setSubtreeSearch(true);
    String userFilter = buildFilter(_userFilter, _userObjectClass, _userIdAttribute);
    LOG.debug("Searching a user with filter {} where user is {}", userFilter, username);
    dnResolver.setUserFilter(userFilter);

    // Set Authenticator with username and password. It will return the user if username/password matches.
    BindAuthenticationHandler authHandler = new BindAuthenticationHandler(new DefaultConnectionFactory(connConfig));
    Authenticator auth = new Authenticator(dnResolver, authHandler);
    AuthenticationRequest authRequest = new AuthenticationRequest();
    authRequest.setUser(username);
    if (password instanceof char[]) {
      authRequest.setCredential(new org.ldaptive.Credential(new String((char[]) password)));
    } else if (password instanceof String){
      authRequest.setCredential(new org.ldaptive.Credential((String)password));
    } else {
      LOG.error("Unexpected type for password '{}'", (password != null) ? password.getClass() : "NULL");
      return null;
    }
    String[] userRoleAttribute = ReturnAttributes.ALL.value();
    authRequest.setReturnAttributes(userRoleAttribute);

    LOG.debug("Retrieved authenticator from factory: {}", auth);
    LOG.debug("Retrieved authentication request from factory: {}", authRequest);

    AuthenticationResponse response = auth.authenticate(authRequest);
    LOG.info("Found user?: {}", response.getResult());
    if (response.getResult()) {
      LdapEntry entry = response.getLdapEntry();
      return entry;
    } else {
      // User not found. Most likely username/password didn't match. Log the reason.
      LOG.error("Result code: {} - {}", response.getResultCode(), response.getMessage());
    }
  } catch (LdapException e) {
    LOG.warn(e.getMessage());
  }
  return null;
}