public class LdapAuthenticationHandler
extends org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandler
Authenticator component underneath.
This handler provides simple attribute resolution machinery by reading attributes from the entry
corresponding to the DN of the bound user (in the bound security context) upon successful authentication.
Principal resolution is controlled by the following properties:
| Modifier and Type | Field and Description |
|---|---|
protected java.util.Map<java.lang.String,java.lang.String> |
principalAttributeMap
Mapping of LDAP attribute name to principal attribute name.
|
principalFactory, servicesManager| Constructor and Description |
|---|
LdapAuthenticationHandler(java.lang.String name,
org.apereo.cas.services.ServicesManager servicesManager,
org.apereo.cas.authentication.principal.PrincipalFactory principalFactory,
java.lang.Integer order,
org.ldaptive.auth.Authenticator authenticator)
Creates a new authentication handler that delegates to the given authenticator.
|
| Modifier and Type | Method and Description |
|---|---|
protected org.apereo.cas.authentication.HandlerResult |
authenticateUsernamePasswordInternal(org.apereo.cas.authentication.UsernamePasswordCredential upc,
java.lang.String originalPassword) |
protected org.apereo.cas.authentication.principal.Principal |
createPrincipal(java.lang.String username,
org.ldaptive.LdapEntry ldapEntry)
Creates a CAS principal with attributes if the LDAP entry contains principal attributes.
|
protected java.lang.String |
getLdapPrincipalIdentifier(java.lang.String username,
org.ldaptive.LdapEntry ldapEntry)
Gets ldap principal identifier.
|
void |
initialize()
Initialize the handler, setup the authentication entry attributes.
|
void |
setAllowMissingPrincipalAttributeValue(boolean allowMissingPrincipalAttributeValue) |
void |
setAllowMultiplePrincipalAttributeValues(boolean allowed)
Sets a flag that determines whether multiple values are allowed for the
principalIdAttribute. |
void |
setCollectDnAttribute(boolean collectDnAttribute) |
void |
setPrincipalAttributeList(java.util.List<java.lang.String> attributeList)
Sets the mapping of additional principal attributes where the key and value is the LDAP attribute
name.
|
void |
setPrincipalAttributeMap(java.util.Map<java.lang.String,java.lang.String> attributeNameMap)
Sets the mapping of additional principal attributes where the key is the LDAP attribute
name and the value is the principal attribute name.
|
void |
setPrincipalDnAttributeName(java.lang.String principalDnAttributeName)
Sets the name of the principal's dn attribute.
|
void |
setPrincipalIdAttribute(java.lang.String attributeName)
Sets the name of the LDAP principal attribute whose value should be used for the
principal ID.
|
doAuthentication, getPasswordPolicyConfiguration, matches, setCredentialSelectionPredicate, setPasswordEncoder, setPasswordPolicyConfiguration, setPrincipalNameTransformer, supportsauthenticate, createHandlerResultgetName, getOrderclone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitprotected java.util.Map<java.lang.String,java.lang.String> principalAttributeMap
public LdapAuthenticationHandler(java.lang.String name,
org.apereo.cas.services.ServicesManager servicesManager,
org.apereo.cas.authentication.principal.PrincipalFactory principalFactory,
java.lang.Integer order,
org.ldaptive.auth.Authenticator authenticator)
name - the nameservicesManager - the services managerprincipalFactory - the principal factoryorder - the orderauthenticator - Ldaptive authenticator component.public void setPrincipalIdAttribute(java.lang.String attributeName)
attributeName - LDAP attribute name.public void setCollectDnAttribute(boolean collectDnAttribute)
public void setPrincipalDnAttributeName(java.lang.String principalDnAttributeName)
principalDnAttributeName - principal's DN attribute name.public void setAllowMultiplePrincipalAttributeValues(boolean allowed)
principalIdAttribute.
This flag only has an effect if principalIdAttribute is configured. If multiple values are detected
when the flag is false, the first value is used and a warning is logged. If multiple values are detected
when the flag is true, an exception is raised.allowed - True to allow multiple principal ID attribute values, false otherwise.public void setPrincipalAttributeMap(java.util.Map<java.lang.String,java.lang.String> attributeNameMap)
attributeNameMap - Map of LDAP attribute name to principal attribute name.public void setPrincipalAttributeList(java.util.List<java.lang.String> attributeList)
attributeList - List of LDAP attribute namesprotected org.apereo.cas.authentication.HandlerResult authenticateUsernamePasswordInternal(org.apereo.cas.authentication.UsernamePasswordCredential upc,
java.lang.String originalPassword)
throws java.security.GeneralSecurityException,
org.apereo.cas.authentication.PreventedException
authenticateUsernamePasswordInternal in class org.apereo.cas.authentication.handler.support.AbstractUsernamePasswordAuthenticationHandlerjava.security.GeneralSecurityExceptionorg.apereo.cas.authentication.PreventedExceptionprotected org.apereo.cas.authentication.principal.Principal createPrincipal(java.lang.String username,
org.ldaptive.LdapEntry ldapEntry)
throws javax.security.auth.login.LoginException
username - Username that was successfully authenticated which is used for principal ID when
setPrincipalIdAttribute(String) is not specified.ldapEntry - LDAP entry that may contain principal attributes.javax.security.auth.login.LoginException - On security policy errors related to principal creation.protected java.lang.String getLdapPrincipalIdentifier(java.lang.String username,
org.ldaptive.LdapEntry ldapEntry)
throws javax.security.auth.login.LoginException
username - the usernameldapEntry - the ldap entryjavax.security.auth.login.LoginException - in case the principal id cannot be determined.public void setAllowMissingPrincipalAttributeValue(boolean allowMissingPrincipalAttributeValue)
@PostConstruct public void initialize()