code cleanup

saheba

2013-03-25 2a8a74bedafdb56b7e7edcb42642dc1eb5e54fff

 src/com/gitblit/LdapUserService.java

@@ -20,22 +20,30 @@
import java.net.URI;

import java.net.URISyntaxException;

import java.security.GeneralSecurityException;

import java.util.HashMap;

import java.util.List;

import java.util.Map;

import java.util.concurrent.TimeUnit;

import java.util.concurrent.atomic.AtomicLong;



import org.slf4j.Logger;

import org.slf4j.LoggerFactory;



import com.gitblit.Constants.AccountType;

import com.gitblit.models.TeamModel;

import com.gitblit.models.UserModel;

import com.gitblit.utils.ArrayUtils;

import com.gitblit.utils.StringUtils;

import com.unboundid.ldap.sdk.Attribute;

import com.unboundid.ldap.sdk.ExtendedResult;

import com.unboundid.ldap.sdk.LDAPConnection;

import com.unboundid.ldap.sdk.LDAPException;

import com.unboundid.ldap.sdk.LDAPSearchException;

import com.unboundid.ldap.sdk.ResultCode;

import com.unboundid.ldap.sdk.SearchResult;

import com.unboundid.ldap.sdk.SearchResultEntry;

import com.unboundid.ldap.sdk.SearchScope;

import com.unboundid.ldap.sdk.extensions.StartTLSExtendedRequest;

import com.unboundid.util.ssl.SSLUtil;

import com.unboundid.util.ssl.TrustAllTrustManager;



@@ -47,22 +55,109 @@
public class LdapUserService extends GitblitUserService {



   public static final Logger logger = LoggerFactory.getLogger(LdapUserService.class);

	
   private IStoredSettings settings;



   private IStoredSettings settings;

    private AtomicLong lastLdapUserSync = new AtomicLong(0L);

	
   public LdapUserService() {

      super();

   }



    private long getSynchronizationPeriod() {

        final String cacheDuration = settings.getString(Keys.realm.ldap.ldapCachePeriod, "2 MINUTES");

        try {

            final String[] s = cacheDuration.split(" ", 2);

            long duration = Long.parseLong(s[0]);

            TimeUnit timeUnit = TimeUnit.valueOf(s[1]);

            return timeUnit.toMillis(duration);

        } catch (RuntimeException ex) {

            throw new IllegalArgumentException(Keys.realm.ldap.ldapCachePeriod + " must have format '<long> <TimeUnit>' where <TimeUnit> is one of 'MILLISECONDS', 'SECONDS', 'MINUTES', 'HOURS', 'DAYS'");

        }

    }

    
   @Override

   public void setup(IStoredSettings settings) {

      this.settings = settings;

      String file = settings.getString(Keys.realm.ldap.backingUserService, "users.conf");

      String file = settings.getString(Keys.realm.ldap.backingUserService, "${baseFolder}/users.conf");

      File realmFile = GitBlit.getFileOrFolder(file);



		
      serviceImpl = createUserService(realmFile);

      logger.info("LDAP User Service backed by " + serviceImpl.toString());

		
      synchronizeLdapUsers();

   }

	
   protected synchronized void synchronizeLdapUsers() {

        final boolean enabled = settings.getBoolean(Keys.realm.ldap.synchronizeUsers.enable, false);

        if (enabled) {

            if (System.currentTimeMillis() > (lastLdapUserSync.get() + getSynchronizationPeriod())) {

               logger.info("Synchronizing with LDAP @ " + settings.getRequiredString(Keys.realm.ldap.server));

                final boolean deleteRemovedLdapUsers = settings.getBoolean(Keys.realm.ldap.synchronizeUsers.removeDeleted, true);

                LDAPConnection ldapConnection = getLdapConnection();

                if (ldapConnection != null) {

                    try {

                        String accountBase = settings.getString(Keys.realm.ldap.accountBase, "");

                        String uidAttribute = settings.getString(Keys.realm.ldap.uid, "uid");

                        String accountPattern = settings.getString(Keys.realm.ldap.accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");

                        accountPattern = StringUtils.replace(accountPattern, "${username}", "*");



                        SearchResult result = doSearch(ldapConnection, accountBase, accountPattern);

                        if (result != null && result.getEntryCount() > 0) {

                            final Map<String, UserModel> ldapUsers = new HashMap<String, UserModel>();



                            for (SearchResultEntry loggingInUser : result.getSearchEntries()) {



                                final String username = loggingInUser.getAttribute(uidAttribute).getValue();

                                logger.debug("LDAP synchronizing: " + username);



                                UserModel user = getUserModel(username);

                                if (user == null) {

                                    user = new UserModel(username);

                                }



                                if (!supportsTeamMembershipChanges())

                                    getTeamsFromLdap(ldapConnection, username, loggingInUser, user);



                                // Get User Attributes

                                setUserAttributes(user, loggingInUser);



                                // store in map

                                ldapUsers.put(username.toLowerCase(), user);

                            }



                            if (deleteRemovedLdapUsers) {

                                logger.debug("detecting removed LDAP users...");



                                for (UserModel userModel : super.getAllUsers()) {

                                    if (ExternalAccount.equals(userModel.password)) {

                                        if (! ldapUsers.containsKey(userModel.username)) {

                                            logger.info("deleting removed LDAP user " + userModel.username + " from backing user service");

                                            super.deleteUser(userModel.username);

                                        }

                                    }

                                }

                            }



                            super.updateUserModels(ldapUsers.values());



                            if (!supportsTeamMembershipChanges()) {

                                final Map<String, TeamModel> userTeams = new HashMap<String, TeamModel>();

                                for (UserModel user : ldapUsers.values()) {

                                    for (TeamModel userTeam : user.teams) {

                                        userTeams.put(userTeam.name, userTeam);

                                    }

                                }

                                updateTeamModels(userTeams.values());

                            }

                        }

                        lastLdapUserSync.set(System.currentTimeMillis()); 
                    } finally {

                        ldapConnection.close();

                    }

                }

            }

        }

    }

   

   private LDAPConnection getLdapConnection() {

      try {

@@ -81,10 +176,22 @@
            if (ldapPort == -1)   // Default Port

               ldapPort = 389;

            

            return new LDAPConnection(ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);

            LDAPConnection conn = new LDAPConnection(ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);



            if (ldapUrl.getScheme().equalsIgnoreCase("ldap+tls")) {

               SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager());



               ExtendedResult extendedResult = conn.processExtendedOperation(

                  new StartTLSExtendedRequest(sslUtil.createSSLContext()));



               if (extendedResult.getResultCode() != ResultCode.SUCCESS) {

                  throw new LDAPException(extendedResult.getResultCode());

               }

            }

            return conn;

         }

      } catch (URISyntaxException e) {

         logger.error("Bad LDAP URL, should be in the form: ldap(s)://<server>:<port>", e);

         logger.error("Bad LDAP URL, should be in the form: ldap(s|+tls)://<server>:<port>", e);

      } catch (GeneralSecurityException e) {

         logger.error("Unable to create SSL Connection", e);

      } catch (LDAPException e) {

@@ -140,67 +247,96 @@
   public boolean supportsTeamMembershipChanges() {

      return !settings.getBoolean(Keys.realm.ldap.maintainTeams, false);

   }

	
   @Override

   protected AccountType getAccountType() {

       return AccountType.LDAP;

   }



   @Override

   public UserModel authenticate(String username, char[] password) {

      String simpleUsername = getSimpleUsername(username);

		
      LDAPConnection ldapConnection = getLdapConnection();		
      if (ldapConnection != null) {

         // Find the logging in user's DN

         String accountBase = settings.getString(Keys.realm.ldap.accountBase, "");

         String accountPattern = settings.getString(Keys.realm.ldap.accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");

         accountPattern = StringUtils.replace(accountPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));



         SearchResult result = doSearch(ldapConnection, accountBase, accountPattern);

         if (result != null && result.getEntryCount() == 1) {

            SearchResultEntry loggingInUser = result.getSearchEntries().get(0);

            String loggingInUserDN = loggingInUser.getDN();

				
            if (isAuthenticated(ldapConnection, loggingInUserDN, new String(password))) {

               logger.debug("LDAP authenticated: " + username);

					
               UserModel user = getUserModel(simpleUsername);

               if (user == null)   // create user object for new authenticated user

                  user = new UserModel(simpleUsername);



               // create a user cookie

               if (StringUtils.isEmpty(user.cookie) && !ArrayUtils.isEmpty(password)) {

                  user.cookie = StringUtils.getSHA1(user.username + new String(password));

               }

					
               if (!supportsTeamMembershipChanges())

                  getTeamsFromLdap(ldapConnection, simpleUsername, loggingInUser, user);

					
               // Get User Attributes

               setUserAttributes(user, loggingInUser);



               // Push the ldap looked up values to backing file

               super.updateUserModel(user);

               if (!supportsTeamMembershipChanges()) {

                  for (TeamModel userTeam : user.teams)

                     updateTeamModel(userTeam);

               }

							
               return user;

            }

         }

      if (isLocalAccount(username)) {

         // local account, bypass LDAP authentication

         return super.authenticate(username, password);

      }

      

      String simpleUsername = getSimpleUsername(username);

		
      LDAPConnection ldapConnection = getLdapConnection();

      if (ldapConnection != null) {

         try {

            // Find the logging in user's DN

            String accountBase = settings.getString(Keys.realm.ldap.accountBase, "");

            String accountPattern = settings.getString(Keys.realm.ldap.accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");

            accountPattern = StringUtils.replace(accountPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));



            SearchResult result = doSearch(ldapConnection, accountBase, accountPattern);

            if (result != null && result.getEntryCount() == 1) {

               SearchResultEntry loggingInUser = result.getSearchEntries().get(0);

               String loggingInUserDN = loggingInUser.getDN();



               if (isAuthenticated(ldapConnection, loggingInUserDN, new String(password))) {

                  logger.debug("LDAP authenticated: " + username);



                  UserModel user = null;

                  synchronized (this) {

                     user = getUserModel(simpleUsername);

                     if (user == null)   // create user object for new authenticated user

                        user = new UserModel(simpleUsername);



                     // create a user cookie

                     if (StringUtils.isEmpty(user.cookie) && !ArrayUtils.isEmpty(password)) {

                        user.cookie = StringUtils.getSHA1(user.username + new String(password));

                     }



                     if (!supportsTeamMembershipChanges())

                        getTeamsFromLdap(ldapConnection, simpleUsername, loggingInUser, user);



                     // Get User Attributes

                     setUserAttributes(user, loggingInUser);



                     // Push the ldap looked up values to backing file

                     super.updateUserModel(user);

                     if (!supportsTeamMembershipChanges()) {

                        for (TeamModel userTeam : user.teams)

                           updateTeamModel(userTeam);

                     }

                  }

						
                  return user;

               }

            }

         } finally {

            ldapConnection.close();

         }

      }

      return null;      

   }



   /**

    * Set the admin attribute from team memberships retrieved from LDAP.

    * If we are not storing teams in LDAP and/or we have not defined any

    * administrator teams, then do not change the admin flag.

    * 
    * @param user

    */

   private void setAdminAttribute(UserModel user) {

       user.canAdmin = false;

       List<String>  admins = settings.getStrings(Keys.realm.ldap.admins);

       for (String admin : admins) {

           if (admin.startsWith("@")) { // Team

               if (user.getTeam(admin.substring(1)) != null)

                   user.canAdmin = true;

           } else

               if (user.getName().equalsIgnoreCase(admin))

                   user.canAdmin = true;

       }

      if (!supportsTeamMembershipChanges()) {

         List<String> admins = settings.getStrings(Keys.realm.ldap.admins);

         // if we have defined administrative teams, then set admin flag

         // otherwise leave admin flag unchanged

         if (!ArrayUtils.isEmpty(admins)) {

            user.canAdmin = false;

            for (String admin : admins) {

               if (admin.startsWith("@")) { // Team

                  if (user.getTeam(admin.substring(1)) != null)

                     user.canAdmin = true;

               } else

                  if (user.getName().equalsIgnoreCase(admin))

                     user.canAdmin = true;

            }

         }

      }

   }

   

   private void setUserAttributes(UserModel user, SearchResultEntry userEntry) {

@@ -208,7 +344,8 @@
      setAdminAttribute(user);

      

      // Don't want visibility into the real password, make up a dummy

      user.password = "StoredInLDAP";

      user.password = ExternalAccount;

      user.accountType = getAccountType();

      

      // Get full name Attribute

      String displayName = settings.getString(Keys.realm.ldap.displayName, "");      

@@ -220,7 +357,10 @@


            user.displayName = displayName;

         } else {

            user.displayName = userEntry.getAttribute(displayName).getValue();

            Attribute attribute = userEntry.getAttribute(displayName);

            if (attribute != null && attribute.hasValue()) {

               user.displayName = attribute.getValue();

            }

         }

      }

      

@@ -233,7 +373,10 @@


            user.emailAddress = email;

         } else {

            user.emailAddress = userEntry.getAttribute(email).getValue();

            Attribute attribute = userEntry.getAttribute(email);

            if (attribute != null && attribute.hasValue()) {

               user.emailAddress = attribute.getValue();

            }

         }

      }

   }

@@ -296,6 +439,17 @@
      }

   }



    @Override

    public List<String> getAllUsernames() {

        synchronizeLdapUsers();

        return super.getAllUsernames();

    }



    @Override

    public List<UserModel> getAllUsers() {

        synchronizeLdapUsers();

        return super.getAllUsers();

    }

   

   /**

    * Returns a simple username without any domain prefixes.