| | |
|---|
| | | package com.gitblit;
|
|---|
| | |
|
|---|
| | | import java.io.File;
|
|---|
| | | import java.text.MessageFormat;
|
|---|
| | | import java.util.HashSet;
|
|---|
| | | import java.util.Hashtable;
|
|---|
| | | import java.util.Set;
|
|---|
| | |
|
|---|
| | | import javax.naming.Context;
|
|---|
| | | import javax.naming.NamingException;
|
|---|
| | | import javax.naming.directory.DirContext;
|
|---|
| | | import javax.naming.directory.InitialDirContext;
|
|---|
| | | import java.net.URI;
|
|---|
| | | import java.net.URISyntaxException;
|
|---|
| | | import java.security.GeneralSecurityException;
|
|---|
| | | import java.util.List;
|
|---|
| | |
|
|---|
| | | import org.slf4j.Logger;
|
|---|
| | | import org.slf4j.LoggerFactory;
|
|---|
| | |
|
|---|
| | | import com.gitblit.models.TeamModel;
|
|---|
| | | import com.gitblit.models.UserModel;
|
|---|
| | | import com.gitblit.utils.ConnectionUtils.BlindSSLSocketFactory;
|
|---|
| | | import com.gitblit.utils.StringUtils;
|
|---|
| | | import com.unboundid.ldap.sdk.Attribute;
|
|---|
| | | import com.unboundid.ldap.sdk.LDAPConnection;
|
|---|
| | | import com.unboundid.ldap.sdk.LDAPException;
|
|---|
| | | import com.unboundid.ldap.sdk.LDAPSearchException;
|
|---|
| | | import com.unboundid.ldap.sdk.SearchResult;
|
|---|
| | | import com.unboundid.ldap.sdk.SearchResultEntry;
|
|---|
| | | import com.unboundid.ldap.sdk.SearchScope;
|
|---|
| | | import com.unboundid.util.ssl.SSLUtil;
|
|---|
| | | import com.unboundid.util.ssl.TrustAllTrustManager;
|
|---|
| | |
|
|---|
| | | /**
|
|---|
| | | * Implementation of an LDAP user service.
|
|---|
| | |
|---|
| | | public class LdapUserService extends GitblitUserService {
|
|---|
| | |
|
|---|
| | | public static final Logger logger = LoggerFactory.getLogger(LdapUserService.class);
|
|---|
| | | private final String CONTEXT_FACTORY = "com.sun.jndi.ldap.LdapCtxFactory";
|
|---|
| | |
|
|---|
| | | |
|---|
| | | private IStoredSettings settings;
|
|---|
| | |
|
|---|
| | | public LdapUserService() {
|
|---|
| | |
|---|
| | | @Override
|
|---|
| | | public void setup(IStoredSettings settings) {
|
|---|
| | | this.settings = settings;
|
|---|
| | | String file = settings.getString(Keys.realm.ldap_backingUserService, "users.conf");
|
|---|
| | | String file = settings.getString(Keys.realm.ldap.backingUserService, "users.conf");
|
|---|
| | | File realmFile = GitBlit.getFileOrFolder(file);
|
|---|
| | |
|
|---|
| | | serviceImpl = createUserService(realmFile);
|
|---|
| | | logger.info("LDAP User Service backed by " + serviceImpl.toString());
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | private LDAPConnection getLdapConnection() {
|
|---|
| | | try {
|
|---|
| | | URI ldapUrl = new URI(settings.getRequiredString(Keys.realm.ldap.server));
|
|---|
| | | String bindUserName = settings.getString(Keys.realm.ldap.username, "");
|
|---|
| | | String bindPassword = settings.getString(Keys.realm.ldap.password, "");
|
|---|
| | | int ldapPort = ldapUrl.getPort();
|
|---|
| | | |
|---|
| | | if (ldapUrl.getScheme().equalsIgnoreCase("ldaps")) { // SSL
|
|---|
| | | if (ldapPort == -1) // Default Port
|
|---|
| | | ldapPort = 636;
|
|---|
| | | |
|---|
| | | SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager()); |
|---|
| | | return new LDAPConnection(sslUtil.createSSLSocketFactory(), ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
|
|---|
| | | } else {
|
|---|
| | | if (ldapPort == -1) // Default Port
|
|---|
| | | ldapPort = 389;
|
|---|
| | | |
|---|
| | | return new LDAPConnection(ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
|
|---|
| | | }
|
|---|
| | | } catch (URISyntaxException e) {
|
|---|
| | | logger.error("Bad LDAP URL, should be in the form: ldap(s)://<server>:<port>", e);
|
|---|
| | | } catch (GeneralSecurityException e) {
|
|---|
| | | logger.error("Unable to create SSL Connection", e);
|
|---|
| | | } catch (LDAPException e) {
|
|---|
| | | logger.error("Error Connecting to LDAP", e);
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | return null;
|
|---|
| | | }
|
|---|
| | |
|
|---|
| | | /**
|
|---|
| | |
|---|
| | | }
|
|---|
| | |
|
|---|
| | | /**
|
|---|
| | | * If no displayName pattern is defined then Gitblit can manage the display name.
|
|---|
| | | *
|
|---|
| | | * @return true if Gitblit can manage the user display name
|
|---|
| | | * @since 1.0.0
|
|---|
| | | */
|
|---|
| | | @Override
|
|---|
| | | public boolean supportsDisplayNameChanges() {
|
|---|
| | | return StringUtils.isEmpty(settings.getString(Keys.realm.ldap.displayName, ""));
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | /**
|
|---|
| | | * If no email pattern is defined then Gitblit can manage the email address.
|
|---|
| | | *
|
|---|
| | | * @return true if Gitblit can manage the user email address
|
|---|
| | | * @since 1.0.0
|
|---|
| | | */
|
|---|
| | | @Override
|
|---|
| | | public boolean supportsEmailAddressChanges() {
|
|---|
| | | return StringUtils.isEmpty(settings.getString(Keys.realm.ldap.email, ""));
|
|---|
| | | }
|
|---|
| | |
|
|---|
| | | |
|---|
| | | /**
|
|---|
| | | * If the LDAP server will maintain team memberships then LdapUserService
|
|---|
| | | * will not allow team membership changes. In this scenario all team
|
|---|
| | | * changes must be made on the LDAP server by the LDAP administrator.
|
|---|
| | |
|---|
| | | * @since 1.0.0
|
|---|
| | | */
|
|---|
| | | public boolean supportsTeamMembershipChanges() {
|
|---|
| | | return !settings.getBoolean(Keys.realm.ldap_maintainTeams, false);
|
|---|
| | | return !settings.getBoolean(Keys.realm.ldap.maintainTeams, false);
|
|---|
| | | }
|
|---|
| | |
|
|---|
| | | /**
|
|---|
| | |
|---|
| | |
|
|---|
| | | @Override
|
|---|
| | | public UserModel authenticate(String username, char[] password) {
|
|---|
| | | String domainUser = getDomainUsername(username); |
|---|
| | | DirContext ctx = getDirContext(domainUser, new String(password));
|
|---|
| | | // TODO do we need a bind here?
|
|---|
| | | if (ctx != null) {
|
|---|
| | | String simpleUsername = getSimpleUsername(username);
|
|---|
| | | UserModel user = getUserModel(simpleUsername);
|
|---|
| | | if (user == null) {
|
|---|
| | | // create user object for new authenticated user
|
|---|
| | | user = new UserModel(simpleUsername.toLowerCase());
|
|---|
| | | }
|
|---|
| | | user.password = new String(password);
|
|---|
| | | String simpleUsername = getSimpleUsername(username);
|
|---|
| | | |
|---|
| | | LDAPConnection ldapConnection = getLdapConnection(); |
|---|
| | | if (ldapConnection != null) {
|
|---|
| | | // Find the logging in user's DN
|
|---|
| | | String accountBase = settings.getString(Keys.realm.ldap.accountBase, "");
|
|---|
| | | String accountPattern = settings.getString(Keys.realm.ldap.accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");
|
|---|
| | | accountPattern = StringUtils.replace(accountPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));
|
|---|
| | |
|
|---|
| | | if (!supportsTeamMembershipChanges()) {
|
|---|
| | | // Teams are specified in LDAP server
|
|---|
| | | // TODO search LDAP for team memberships
|
|---|
| | | Set<String> foundTeams = new HashSet<String>();
|
|---|
| | | for (String team : foundTeams) { |
|---|
| | | TeamModel model = getTeamModel(team);
|
|---|
| | | if (model == null) {
|
|---|
| | | // create the team
|
|---|
| | | model = new TeamModel(team.toLowerCase());
|
|---|
| | | updateTeamModel(model);
|
|---|
| | | SearchResult result = doSearch(ldapConnection, accountBase, accountPattern);
|
|---|
| | | if (result != null && result.getEntryCount() == 1) {
|
|---|
| | | SearchResultEntry loggingInUser = result.getSearchEntries().get(0);
|
|---|
| | | String loggingInUserDN = loggingInUser.getDN();
|
|---|
| | | |
|---|
| | | if (isAuthenticated(ldapConnection, loggingInUserDN, new String(password))) {
|
|---|
| | | logger.debug("LDAP authenticated: " + username);
|
|---|
| | | |
|---|
| | | UserModel user = getUserModel(simpleUsername);
|
|---|
| | | if (user == null) // create user object for new authenticated user
|
|---|
| | | user = new UserModel(simpleUsername);
|
|---|
| | | |
|---|
| | | |
|---|
| | | |
|---|
| | | if (!supportsTeamMembershipChanges())
|
|---|
| | | getTeamsFromLdap(ldapConnection, simpleUsername, loggingInUser, user);
|
|---|
| | | |
|---|
| | | // Get User Attributes
|
|---|
| | | setUserAttributes(user, loggingInUser);
|
|---|
| | |
|
|---|
| | | // Push the ldap looked up values to backing file
|
|---|
| | | super.updateUserModel(user);
|
|---|
| | | if (!supportsTeamMembershipChanges()) {
|
|---|
| | | for (TeamModel userTeam : user.teams)
|
|---|
| | | updateTeamModel(userTeam);
|
|---|
| | | }
|
|---|
| | | // add team to the user
|
|---|
| | | user.teams.add(model);
|
|---|
| | | |
|---|
| | | return user;
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | try {
|
|---|
| | | ctx.close();
|
|---|
| | | } catch (NamingException e) {
|
|---|
| | | logger.error("Can not close context", e);
|
|---|
| | | }
|
|---|
| | | return user;
|
|---|
| | | } |
|---|
| | | }
|
|---|
| | | |
|---|
| | | return null;
|
|---|
| | | } |
|---|
| | | |
|---|
| | | protected DirContext getDirContext() {
|
|---|
| | | String username = settings.getString(Keys.realm.ldap_username, "");
|
|---|
| | | String password = settings.getString(Keys.realm.ldap_password, "");
|
|---|
| | | return getDirContext(username, password);
|
|---|
| | | }
|
|---|
| | |
|
|---|
| | | protected DirContext getDirContext(String username, String password) {
|
|---|
| | | try {
|
|---|
| | | String server = settings.getRequiredString(Keys.realm.ldap_server);
|
|---|
| | | Hashtable<String, String> env = new Hashtable<String, String>();
|
|---|
| | | env.put(Context.INITIAL_CONTEXT_FACTORY, CONTEXT_FACTORY);
|
|---|
| | | env.put(Context.PROVIDER_URL, server);
|
|---|
| | | if (server.startsWith("ldaps:")) {
|
|---|
| | | env.put("java.naming.ldap.factory.socket", BlindSSLSocketFactory.class.getName());
|
|---|
| | | }
|
|---|
| | | // TODO consider making this a setting
|
|---|
| | | env.put("com.sun.jndi.ldap.read.timeout", "5000");
|
|---|
| | | private void setAdminAttribute(UserModel user) {
|
|---|
| | | user.canAdmin = false;
|
|---|
| | | List<String> admins = settings.getStrings(Keys.realm.ldap.admins);
|
|---|
| | | for (String admin : admins) {
|
|---|
| | | if (admin.startsWith("@")) { // Team
|
|---|
| | | if (user.getTeam(admin.substring(1)) != null)
|
|---|
| | | user.canAdmin = true;
|
|---|
| | | } else
|
|---|
| | | if (user.getName().equalsIgnoreCase(admin))
|
|---|
| | | user.canAdmin = true;
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | private void setUserAttributes(UserModel user, SearchResultEntry userEntry) {
|
|---|
| | | // Is this user an admin?
|
|---|
| | | setAdminAttribute(user);
|
|---|
| | | |
|---|
| | | // Don't want visibility into the real password, make up a dummy
|
|---|
| | | user.password = "StoredInLDAP";
|
|---|
| | | |
|---|
| | | // Get full name Attribute
|
|---|
| | | String displayName = settings.getString(Keys.realm.ldap.displayName, ""); |
|---|
| | | if (!StringUtils.isEmpty(displayName)) {
|
|---|
| | | // Replace embedded ${} with attributes
|
|---|
| | | if (displayName.contains("${")) {
|
|---|
| | | for (Attribute userAttribute : userEntry.getAttributes())
|
|---|
| | | displayName = StringUtils.replace(displayName, "${" + userAttribute.getName() + "}", userAttribute.getValue());
|
|---|
| | |
|
|---|
| | | if (!StringUtils.isEmpty(username)) {
|
|---|
| | | // authenticated login
|
|---|
| | | env.put(Context.SECURITY_AUTHENTICATION, "simple");
|
|---|
| | | env.put(Context.SECURITY_PRINCIPAL, getDomainUsername(username));
|
|---|
| | | env.put(Context.SECURITY_CREDENTIALS, password == null ? "":password.trim());
|
|---|
| | | user.displayName = displayName;
|
|---|
| | | } else {
|
|---|
| | | user.displayName = userEntry.getAttribute(displayName).getValue();
|
|---|
| | | }
|
|---|
| | | return new InitialDirContext(env);
|
|---|
| | | } catch (NamingException e) {
|
|---|
| | | logger.warn(MessageFormat.format("Error connecting to LDAP with credentials. Please check {0}, {1}, and {2}",
|
|---|
| | | Keys.realm.ldap_server, Keys.realm.ldap_username, Keys.realm.ldap_password), e);
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | // Get email address Attribute
|
|---|
| | | String email = settings.getString(Keys.realm.ldap.email, "");
|
|---|
| | | if (!StringUtils.isEmpty(email)) {
|
|---|
| | | if (email.contains("${")) {
|
|---|
| | | for (Attribute userAttribute : userEntry.getAttributes())
|
|---|
| | | email = StringUtils.replace(email, "${" + userAttribute.getName() + "}", userAttribute.getValue());
|
|---|
| | |
|
|---|
| | | user.emailAddress = email;
|
|---|
| | | } else {
|
|---|
| | | user.emailAddress = userEntry.getAttribute(email).getValue();
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | |
|
|---|
| | | private void getTeamsFromLdap(LDAPConnection ldapConnection, String simpleUsername, SearchResultEntry loggingInUser, UserModel user) {
|
|---|
| | | String loggingInUserDN = loggingInUser.getDN();
|
|---|
| | | |
|---|
| | | user.teams.clear(); // Clear the users team memberships - we're going to get them from LDAP
|
|---|
| | | String groupBase = settings.getString(Keys.realm.ldap.groupBase, "");
|
|---|
| | | String groupMemberPattern = settings.getString(Keys.realm.ldap.groupMemberPattern, "(&(objectClass=group)(member=${dn}))");
|
|---|
| | | |
|---|
| | | groupMemberPattern = StringUtils.replace(groupMemberPattern, "${dn}", escapeLDAPSearchFilter(loggingInUserDN));
|
|---|
| | | groupMemberPattern = StringUtils.replace(groupMemberPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));
|
|---|
| | | |
|---|
| | | // Fill in attributes into groupMemberPattern
|
|---|
| | | for (Attribute userAttribute : loggingInUser.getAttributes())
|
|---|
| | | groupMemberPattern = StringUtils.replace(groupMemberPattern, "${" + userAttribute.getName() + "}", escapeLDAPSearchFilter(userAttribute.getValue()));
|
|---|
| | | |
|---|
| | | SearchResult teamMembershipResult = doSearch(ldapConnection, groupBase, groupMemberPattern);
|
|---|
| | | if (teamMembershipResult != null && teamMembershipResult.getEntryCount() > 0) {
|
|---|
| | | for (int i = 0; i < teamMembershipResult.getEntryCount(); i++) {
|
|---|
| | | SearchResultEntry teamEntry = teamMembershipResult.getSearchEntries().get(i);
|
|---|
| | | String teamName = teamEntry.getAttribute("cn").getValue();
|
|---|
| | | |
|---|
| | | TeamModel teamModel = getTeamModel(teamName);
|
|---|
| | | if (teamModel == null)
|
|---|
| | | teamModel = createTeamFromLdap(teamEntry);
|
|---|
| | | |
|---|
| | | user.teams.add(teamModel);
|
|---|
| | | teamModel.addUser(user.getName());
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | private TeamModel createTeamFromLdap(SearchResultEntry teamEntry) {
|
|---|
| | | TeamModel answer = new TeamModel(teamEntry.getAttributeValue("cn"));
|
|---|
| | | // potentially retrieve other attributes here in the future
|
|---|
| | | |
|---|
| | | return answer; |
|---|
| | | }
|
|---|
| | |
|
|---|
| | | private SearchResult doSearch(LDAPConnection ldapConnection, String base, String filter) {
|
|---|
| | | try {
|
|---|
| | | return ldapConnection.search(base, SearchScope.SUB, filter);
|
|---|
| | | } catch (LDAPSearchException e) {
|
|---|
| | | logger.error("Problem Searching LDAP", e);
|
|---|
| | | |
|---|
| | | return null;
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | private boolean isAuthenticated(LDAPConnection ldapConnection, String userDn, String password) {
|
|---|
| | | try {
|
|---|
| | | // Binding will stop any LDAP-Injection Attacks since the searched-for user needs to bind to that DN
|
|---|
| | | ldapConnection.bind(userDn, password);
|
|---|
| | | return true;
|
|---|
| | | } catch (LDAPException e) {
|
|---|
| | | logger.error("Error authenticating user", e);
|
|---|
| | | return false;
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | |
|
|---|
| | |
|
|---|
| | | /**
|
|---|
| | | * Returns a simple username without any domain prefixes.
|
|---|
| | |
|---|
| | | if (lastSlash > -1) {
|
|---|
| | | username = username.substring(lastSlash + 1);
|
|---|
| | | }
|
|---|
| | | |
|---|
| | | return username;
|
|---|
| | | }
|
|---|
| | |
|
|---|
| | | /**
|
|---|
| | | * Returns a username with a domain prefix as long as the username does not
|
|---|
| | | * already have a comain prefix.
|
|---|
| | | * |
|---|
| | | * @param username
|
|---|
| | | * @return a domain username
|
|---|
| | | */
|
|---|
| | | protected String getDomainUsername(String username) {
|
|---|
| | | String domain = settings.getString(Keys.realm.ldap_domain, null);
|
|---|
| | | String domainUsername = username;
|
|---|
| | | if (!StringUtils.isEmpty(domain) && (domainUsername.indexOf('\\') == -1)) {
|
|---|
| | | domainUsername = domain + "\\" + username;
|
|---|
| | | |
|---|
| | | // From: https://www.owasp.org/index.php/Preventing_LDAP_Injection_in_Java
|
|---|
| | | public static final String escapeLDAPSearchFilter(String filter) {
|
|---|
| | | StringBuilder sb = new StringBuilder();
|
|---|
| | | for (int i = 0; i < filter.length(); i++) {
|
|---|
| | | char curChar = filter.charAt(i);
|
|---|
| | | switch (curChar) {
|
|---|
| | | case '\\':
|
|---|
| | | sb.append("\\5c");
|
|---|
| | | break;
|
|---|
| | | case '*':
|
|---|
| | | sb.append("\\2a");
|
|---|
| | | break;
|
|---|
| | | case '(':
|
|---|
| | | sb.append("\\28");
|
|---|
| | | break;
|
|---|
| | | case ')':
|
|---|
| | | sb.append("\\29");
|
|---|
| | | break;
|
|---|
| | | case '\u0000': |
|---|
| | | sb.append("\\00"); |
|---|
| | | break;
|
|---|
| | | default:
|
|---|
| | | sb.append(curChar);
|
|---|
| | | }
|
|---|
| | | }
|
|---|
| | | return domainUsername.trim();
|
|---|
| | | return sb.toString();
|
|---|
| | | }
|
|---|
| | | }
|
|---|
