From 2a8a74bedafdb56b7e7edcb42642dc1eb5e54fff Mon Sep 17 00:00:00 2001
From: saheba <mail@saheba.net>
Date: Mon, 25 Mar 2013 16:34:45 -0400
Subject: [PATCH] code cleanup
---
src/com/gitblit/LdapUserService.java | 247 +++++++++++++++++++++++++-----------------------
1 files changed, 128 insertions(+), 119 deletions(-)
diff --git a/src/com/gitblit/LdapUserService.java b/src/com/gitblit/LdapUserService.java
index f153304..2867b88 100644
--- a/src/com/gitblit/LdapUserService.java
+++ b/src/com/gitblit/LdapUserService.java
@@ -24,10 +24,12 @@
import java.util.List;
import java.util.Map;
import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import com.gitblit.Constants.AccountType;
import com.gitblit.models.TeamModel;
import com.gitblit.models.UserModel;
import com.gitblit.utils.ArrayUtils;
@@ -47,54 +49,49 @@
/**
* Implementation of an LDAP user service.
- *
+ *
* @author John Crygier
*/
public class LdapUserService extends GitblitUserService {
public static final Logger logger = LoggerFactory.getLogger(LdapUserService.class);
- public static final String LDAP_PASSWORD_KEY = "StoredInLDAP";
- private IStoredSettings settings;
- private long lastLdapUserSyncTs = 0L;
- private long ldapSyncCachePeriod;
-
+ private IStoredSettings settings;
+ private AtomicLong lastLdapUserSync = new AtomicLong(0L);
+
public LdapUserService() {
super();
}
- private void initializeLdapCaches() {
+ private long getSynchronizationPeriod() {
final String cacheDuration = settings.getString(Keys.realm.ldap.ldapCachePeriod, "2 MINUTES");
- final long duration;
- final TimeUnit timeUnit;
try {
final String[] s = cacheDuration.split(" ", 2);
- duration = Long.parseLong(s[0]);
- timeUnit = TimeUnit.valueOf(s[1]);
- ldapSyncCachePeriod = timeUnit.toMillis(duration);
+ long duration = Long.parseLong(s[0]);
+ TimeUnit timeUnit = TimeUnit.valueOf(s[1]);
+ return timeUnit.toMillis(duration);
} catch (RuntimeException ex) {
throw new IllegalArgumentException(Keys.realm.ldap.ldapCachePeriod + " must have format '<long> <TimeUnit>' where <TimeUnit> is one of 'MILLISECONDS', 'SECONDS', 'MINUTES', 'HOURS', 'DAYS'");
}
}
-
+
@Override
public void setup(IStoredSettings settings) {
this.settings = settings;
- String file = settings.getString(Keys.realm.ldap.backingUserService, "users.conf");
+ String file = settings.getString(Keys.realm.ldap.backingUserService, "${baseFolder}/users.conf");
File realmFile = GitBlit.getFileOrFolder(file);
-
- initializeLdapCaches();
-
+
serviceImpl = createUserService(realmFile);
logger.info("LDAP User Service backed by " + serviceImpl.toString());
-
- synchronizeLdapUsers();
- }
-
- protected synchronized void synchronizeLdapUsers() {
+
+ synchronizeLdapUsers();
+ }
+
+ protected synchronized void synchronizeLdapUsers() {
final boolean enabled = settings.getBoolean(Keys.realm.ldap.synchronizeUsers.enable, false);
if (enabled) {
- if (lastLdapUserSyncTs + ldapSyncCachePeriod < System.currentTimeMillis()) {
+ if (System.currentTimeMillis() > (lastLdapUserSync.get() + getSynchronizationPeriod())) {
+ logger.info("Synchronizing with LDAP @ " + settings.getRequiredString(Keys.realm.ldap.server));
final boolean deleteRemovedLdapUsers = settings.getBoolean(Keys.realm.ldap.synchronizeUsers.removeDeleted, true);
LDAPConnection ldapConnection = getLdapConnection();
if (ldapConnection != null) {
@@ -125,14 +122,14 @@
setUserAttributes(user, loggingInUser);
// store in map
- ldapUsers.put(username, user);
+ ldapUsers.put(username.toLowerCase(), user);
}
if (deleteRemovedLdapUsers) {
logger.debug("detecting removed LDAP users...");
for (UserModel userModel : super.getAllUsers()) {
- if (LDAP_PASSWORD_KEY.equals(userModel.password)) {
+ if (ExternalAccount.equals(userModel.password)) {
if (! ldapUsers.containsKey(userModel.username)) {
logger.info("deleting removed LDAP user " + userModel.username + " from backing user service");
super.deleteUser(userModel.username);
@@ -153,7 +150,7 @@
updateTeamModels(userTeams.values());
}
}
- lastLdapUserSyncTs = System.currentTimeMillis();
+ lastLdapUserSync.set(System.currentTimeMillis());
} finally {
ldapConnection.close();
}
@@ -161,25 +158,25 @@
}
}
}
-
- private LDAPConnection getLdapConnection() {
- try {
+
+ private LDAPConnection getLdapConnection() {
+ try {
URI ldapUrl = new URI(settings.getRequiredString(Keys.realm.ldap.server));
String bindUserName = settings.getString(Keys.realm.ldap.username, "");
String bindPassword = settings.getString(Keys.realm.ldap.password, "");
int ldapPort = ldapUrl.getPort();
-
- if (ldapUrl.getScheme().equalsIgnoreCase("ldaps")) { // SSL
+
+ if (ldapUrl.getScheme().equalsIgnoreCase("ldaps")) { // SSL
if (ldapPort == -1) // Default Port
ldapPort = 636;
-
- SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager());
- return new LDAPConnection(sslUtil.createSSLSocketFactory(), ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
+
+ SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager());
+ return new LDAPConnection(sslUtil.createSSLSocketFactory(), ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
} else {
if (ldapPort == -1) // Default Port
ldapPort = 389;
-
- LDAPConnection conn = new LDAPConnection(ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
+
+ LDAPConnection conn = new LDAPConnection(ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
if (ldapUrl.getScheme().equalsIgnoreCase("ldap+tls")) {
SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager());
@@ -200,11 +197,11 @@
} catch (LDAPException e) {
logger.error("Error Connecting to LDAP", e);
}
-
- return null;
+
+ return null;
}
-
- /**
+
+ /**
* Credentials are defined in the LDAP server and can not be manipulated
* from Gitblit.
*
@@ -215,8 +212,8 @@
public boolean supportsCredentialChanges() {
return false;
}
-
- /**
+
+ /**
* If no displayName pattern is defined then Gitblit can manage the display name.
*
* @return true if Gitblit can manage the user display name
@@ -226,8 +223,8 @@
public boolean supportsDisplayNameChanges() {
return StringUtils.isEmpty(settings.getString(Keys.realm.ldap.displayName, ""));
}
-
- /**
+
+ /**
* If no email pattern is defined then Gitblit can manage the email address.
*
* @return true if Gitblit can manage the user email address
@@ -238,24 +235,34 @@
return StringUtils.isEmpty(settings.getString(Keys.realm.ldap.email, ""));
}
-
- /**
+
+ /**
* If the LDAP server will maintain team memberships then LdapUserService
* will not allow team membership changes. In this scenario all team
* changes must be made on the LDAP server by the LDAP administrator.
- *
- * @return true or false
+ *
+ * @return true or false
* @since 1.0.0
- */
- public boolean supportsTeamMembershipChanges() {
+ */
+ public boolean supportsTeamMembershipChanges() {
return !settings.getBoolean(Keys.realm.ldap.maintainTeams, false);
+ }
+
+ @Override
+ protected AccountType getAccountType() {
+ return AccountType.LDAP;
}
@Override
public UserModel authenticate(String username, char[] password) {
+ if (isLocalAccount(username)) {
+ // local account, bypass LDAP authentication
+ return super.authenticate(username, password);
+ }
+
String simpleUsername = getSimpleUsername(username);
-
- LDAPConnection ldapConnection = getLdapConnection();
+
+ LDAPConnection ldapConnection = getLdapConnection();
if (ldapConnection != null) {
try {
// Find the logging in user's DN
@@ -271,28 +278,31 @@
if (isAuthenticated(ldapConnection, loggingInUserDN, new String(password))) {
logger.debug("LDAP authenticated: " + username);
- UserModel user = getUserModel(simpleUsername);
- if (user == null) // create user object for new authenticated user
- user = new UserModel(simpleUsername);
+ UserModel user = null;
+ synchronized (this) {
+ user = getUserModel(simpleUsername);
+ if (user == null) // create user object for new authenticated user
+ user = new UserModel(simpleUsername);
- // create a user cookie
- if (StringUtils.isEmpty(user.cookie) && !ArrayUtils.isEmpty(password)) {
- user.cookie = StringUtils.getSHA1(user.username + new String(password));
+ // create a user cookie
+ if (StringUtils.isEmpty(user.cookie) && !ArrayUtils.isEmpty(password)) {
+ user.cookie = StringUtils.getSHA1(user.username + new String(password));
+ }
+
+ if (!supportsTeamMembershipChanges())
+ getTeamsFromLdap(ldapConnection, simpleUsername, loggingInUser, user);
+
+ // Get User Attributes
+ setUserAttributes(user, loggingInUser);
+
+ // Push the ldap looked up values to backing file
+ super.updateUserModel(user);
+ if (!supportsTeamMembershipChanges()) {
+ for (TeamModel userTeam : user.teams)
+ updateTeamModel(userTeam);
+ }
}
-
- if (!supportsTeamMembershipChanges())
- getTeamsFromLdap(ldapConnection, simpleUsername, loggingInUser, user);
-
- // Get User Attributes
- setUserAttributes(user, loggingInUser);
-
- // Push the ldap looked up values to backing file
- super.updateUserModel(user);
- if (!supportsTeamMembershipChanges()) {
- for (TeamModel userTeam : user.teams)
- updateTeamModel(userTeam);
- }
-
+
return user;
}
}
@@ -300,14 +310,14 @@
ldapConnection.close();
}
}
- return null;
+ return null;
}
/**
* Set the admin attribute from team memberships retrieved from LDAP.
* If we are not storing teams in LDAP and/or we have not defined any
* administrator teams, then do not change the admin flag.
- *
+ *
* @param user
*/
private void setAdminAttribute(UserModel user) {
@@ -321,7 +331,6 @@
if (admin.startsWith("@")) { // Team
if (user.getTeam(admin.substring(1)) != null)
user.canAdmin = true;
- logger.debug("user "+ user.username+" has administrative rights");
} else
if (user.getName().equalsIgnoreCase(admin))
user.canAdmin = true;
@@ -329,17 +338,18 @@
}
}
}
-
- private void setUserAttributes(UserModel user, SearchResultEntry userEntry) {
+
+ private void setUserAttributes(UserModel user, SearchResultEntry userEntry) {
// Is this user an admin?
setAdminAttribute(user);
-
- // Don't want visibility into the real password, make up a dummy
- user.password = LDAP_PASSWORD_KEY;
-
- // Get full name Attribute
- String displayName = settings.getString(Keys.realm.ldap.displayName, "");
- if (!StringUtils.isEmpty(displayName)) {
+
+ // Don't want visibility into the real password, make up a dummy
+ user.password = ExternalAccount;
+ user.accountType = getAccountType();
+
+ // Get full name Attribute
+ String displayName = settings.getString(Keys.realm.ldap.displayName, "");
+ if (!StringUtils.isEmpty(displayName)) {
// Replace embedded ${} with attributes
if (displayName.contains("${")) {
for (Attribute userAttribute : userEntry.getAttributes())
@@ -353,8 +363,8 @@
}
}
}
-
- // Get email address Attribute
+
+ // Get email address Attribute
String email = settings.getString(Keys.realm.ldap.email, "");
if (!StringUtils.isEmpty(email)) {
if (email.contains("${")) {
@@ -373,52 +383,52 @@
private void getTeamsFromLdap(LDAPConnection ldapConnection, String simpleUsername, SearchResultEntry loggingInUser, UserModel user) {
String loggingInUserDN = loggingInUser.getDN();
-
- user.teams.clear(); // Clear the users team memberships - we're going to get them from LDAP
+
+ user.teams.clear(); // Clear the users team memberships - we're going to get them from LDAP
String groupBase = settings.getString(Keys.realm.ldap.groupBase, "");
String groupMemberPattern = settings.getString(Keys.realm.ldap.groupMemberPattern, "(&(objectClass=group)(member=${dn}))");
-
- groupMemberPattern = StringUtils.replace(groupMemberPattern, "${dn}", escapeLDAPSearchFilter(loggingInUserDN));
+
+ groupMemberPattern = StringUtils.replace(groupMemberPattern, "${dn}", escapeLDAPSearchFilter(loggingInUserDN));
groupMemberPattern = StringUtils.replace(groupMemberPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));
-
- // Fill in attributes into groupMemberPattern
+
+ // Fill in attributes into groupMemberPattern
for (Attribute userAttribute : loggingInUser.getAttributes())
groupMemberPattern = StringUtils.replace(groupMemberPattern, "${" + userAttribute.getName() + "}", escapeLDAPSearchFilter(userAttribute.getValue()));
-
- SearchResult teamMembershipResult = doSearch(ldapConnection, groupBase, groupMemberPattern);
+
+ SearchResult teamMembershipResult = doSearch(ldapConnection, groupBase, groupMemberPattern);
if (teamMembershipResult != null && teamMembershipResult.getEntryCount() > 0) {
for (int i = 0; i < teamMembershipResult.getEntryCount(); i++) {
SearchResultEntry teamEntry = teamMembershipResult.getSearchEntries().get(i);
String teamName = teamEntry.getAttribute("cn").getValue();
-
- TeamModel teamModel = getTeamModel(teamName);
+
+ TeamModel teamModel = getTeamModel(teamName);
if (teamModel == null)
teamModel = createTeamFromLdap(teamEntry);
-
- user.teams.add(teamModel);
+
+ user.teams.add(teamModel);
teamModel.addUser(user.getName());
}
}
}
-
- private TeamModel createTeamFromLdap(SearchResultEntry teamEntry) {
+
+ private TeamModel createTeamFromLdap(SearchResultEntry teamEntry) {
TeamModel answer = new TeamModel(teamEntry.getAttributeValue("cn"));
// potentially retrieve other attributes here in the future
-
- return answer;
- }
+
+ return answer;
+ }
private SearchResult doSearch(LDAPConnection ldapConnection, String base, String filter) {
try {
return ldapConnection.search(base, SearchScope.SUB, filter);
} catch (LDAPSearchException e) {
logger.error("Problem Searching LDAP", e);
-
- return null;
+
+ return null;
}
}
-
- private boolean isAuthenticated(LDAPConnection ldapConnection, String userDn, String password) {
+
+ private boolean isAuthenticated(LDAPConnection ldapConnection, String userDn, String password) {
try {
// Binding will stop any LDAP-Injection Attacks since the searched-for user needs to bind to that DN
ldapConnection.bind(userDn, password);
@@ -428,7 +438,6 @@
return false;
}
}
-
@Override
public List<String> getAllUsernames() {
@@ -441,11 +450,11 @@
synchronizeLdapUsers();
return super.getAllUsers();
}
-
- /**
+
+ /**
* Returns a simple username without any domain prefixes.
- *
- * @param username
+ *
+ * @param username
* @return a simple username
*/
protected String getSimpleUsername(String username) {
@@ -453,11 +462,11 @@
if (lastSlash > -1) {
username = username.substring(lastSlash + 1);
}
-
- return username;
+
+ return username;
}
-
- // From: https://www.owasp.org/index.php/Preventing_LDAP_Injection_in_Java
+
+ // From: https://www.owasp.org/index.php/Preventing_LDAP_Injection_in_Java
public static final String escapeLDAPSearchFilter(String filter) {
StringBuilder sb = new StringBuilder();
for (int i = 0; i < filter.length(); i++) {
@@ -475,9 +484,9 @@
case ')':
sb.append("\\29");
break;
- case '\u0000':
- sb.append("\\00");
- break;
+ case '\u0000':
+ sb.append("\\00");
+ break;
default:
sb.append(curChar);
}
--
Gitblit v1.9.1