From 73c76b8f7ecaa43c7b5d60ade1c2273af525e8f1 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Thu, 20 Jun 2013 17:31:41 -0400
Subject: [PATCH] Added WindowsUserService using Waffle
---
NOTICE | 27 ++++
src/site/design.mkd | 3
.classpath | 7
src/main/java/com/gitblit/WindowsUserService.java | 194 ++++++++++++++++++++++++++++++++
src/main/java/com/gitblit/Constants.java | 2
releases.moxie | 11 +
build.xml | 2
src/main/distrib/data/gitblit.properties | 28 ++++
src/site/features.mkd | 1
build.moxie | 1
gitblit.iml | 77 +++++++-----
11 files changed, 313 insertions(+), 40 deletions(-)
diff --git a/.classpath b/.classpath
index 8cd68de..36fed74 100644
--- a/.classpath
+++ b/.classpath
@@ -41,6 +41,10 @@
<classpathentry kind="lib" path="ext/force-wsc-24.0.0.jar" sourcepath="ext/src/force-wsc-24.0.0.jar" />
<classpathentry kind="lib" path="ext/js-1.7R2.jar" sourcepath="ext/src/js-1.7R2.jar" />
<classpathentry kind="lib" path="ext/freemarker-2.3.19.jar" sourcepath="ext/src/freemarker-2.3.19.jar" />
+ <classpathentry kind="lib" path="ext/waffle-jna-1.5.jar" sourcepath="ext/src/waffle-jna-1.5.jar" />
+ <classpathentry kind="lib" path="ext/platform-3.5.0.jar" sourcepath="ext/src/platform-3.5.0.jar" />
+ <classpathentry kind="lib" path="ext/jna-3.5.0.jar" sourcepath="ext/src/jna-3.5.0.jar" />
+ <classpathentry kind="lib" path="ext/guava-13.0.1.jar" sourcepath="ext/src/guava-13.0.1.jar" />
<classpathentry kind="lib" path="ext/junit-4.11.jar" sourcepath="ext/src/junit-4.11.jar" />
<classpathentry kind="lib" path="ext/hamcrest-core-1.3.jar" sourcepath="ext/src/hamcrest-core-1.3.jar" />
<classpathentry kind="lib" path="ext/selenium-java-2.28.0.jar" sourcepath="ext/src/selenium-java-2.28.0.jar" />
@@ -50,14 +54,11 @@
<classpathentry kind="lib" path="ext/cglib-nodep-2.1_3.jar" sourcepath="ext/src/cglib-nodep-2.1_3.jar" />
<classpathentry kind="lib" path="ext/json-20080701.jar" sourcepath="ext/src/json-20080701.jar" />
<classpathentry kind="lib" path="ext/selenium-api-2.28.0.jar" sourcepath="ext/src/selenium-api-2.28.0.jar" />
- <classpathentry kind="lib" path="ext/guava-13.0.1.jar" sourcepath="ext/src/guava-13.0.1.jar" />
<classpathentry kind="lib" path="ext/httpclient-4.2.1.jar" sourcepath="ext/src/httpclient-4.2.1.jar" />
<classpathentry kind="lib" path="ext/httpcore-4.2.1.jar" sourcepath="ext/src/httpcore-4.2.1.jar" />
<classpathentry kind="lib" path="ext/commons-logging-1.1.1.jar" sourcepath="ext/src/commons-logging-1.1.1.jar" />
<classpathentry kind="lib" path="ext/commons-codec-1.6.jar" sourcepath="ext/src/commons-codec-1.6.jar" />
<classpathentry kind="lib" path="ext/commons-exec-1.1.jar" sourcepath="ext/src/commons-exec-1.1.jar" />
- <classpathentry kind="lib" path="ext/jna-3.4.0.jar" sourcepath="ext/src/jna-3.4.0.jar" />
- <classpathentry kind="lib" path="ext/platform-3.4.0.jar" sourcepath="ext/src/platform-3.4.0.jar" />
<classpathentry kind="lib" path="ext/commons-io-2.2.jar" sourcepath="ext/src/commons-io-2.2.jar" />
<classpathentry kind="output" path="bin/classes" />
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER" />
diff --git a/NOTICE b/NOTICE
index ab0a086..9bd356a 100644
--- a/NOTICE
+++ b/NOTICE
@@ -277,4 +277,29 @@
FreeMarker, release under a
modified BSD License. (http://www.freemarker.org/docs/app_license.html)
- http://www.freemarker.org/
\ No newline at end of file
+ http://www.freemarker.org/
+
+---------------------------------------------------------------------------
+Waffle
+---------------------------------------------------------------------------
+ Waffle, release under the
+ Eclipse Public License, version 1.0
+
+ http://dblock.github.io/waffle
+
+---------------------------------------------------------------------------
+JNA
+---------------------------------------------------------------------------
+ JNA, release under the
+ Lesser GNU Public License, version 2.1
+
+ https://github.com/twall/jna
+
+---------------------------------------------------------------------------
+Guava
+---------------------------------------------------------------------------
+ Guava, release under the
+ Apache License 2.0.
+
+ https://code.google.com/p/guava-libraries
+
\ No newline at end of file
diff --git a/build.moxie b/build.moxie
index 9fc08dc..16e06b2 100644
--- a/build.moxie
+++ b/build.moxie
@@ -149,6 +149,7 @@
- compile 'org.apache.commons:commons-compress:1.4.1' :war
- compile 'com.force.api:force-partner-api:24.0.0' :war
- compile 'org.freemarker:freemarker:2.3.19' :war
+- compile 'com.github.dblock.waffle:waffle-jna:1.5' :war
- test 'junit'
# Dependencies for Selenium web page testing
- test 'org.seleniumhq.selenium:selenium-java:${selenium.version}' @jar
diff --git a/build.xml b/build.xml
index 894e51a..308ec43 100644
--- a/build.xml
+++ b/build.xml
@@ -299,6 +299,7 @@
<class name="com.gitblit.LdapUserService" />
<class name="com.gitblit.RedmineUserService" />
<class name="com.gitblit.SalesforceUserService" />
+ <class name="com.gitblit.WindowsUserService" />
</mx:genjar>
<!-- Build the WAR file -->
@@ -414,6 +415,7 @@
<class name="com.gitblit.LdapUserService" />
<class name="com.gitblit.RedmineUserService" />
<class name="com.gitblit.SalesforceUserService" />
+ <class name="com.gitblit.WindowsUserService" />
</mx:genjar>
<!-- Build Express Zip file -->
diff --git a/gitblit.iml b/gitblit.iml
index 38a014a..2ee6242 100644
--- a/gitblit.iml
+++ b/gitblit.iml
@@ -424,6 +424,50 @@
</SOURCES>
</library>
</orderEntry>
+ <orderEntry type="module-library">
+ <library name="waffle-jna-1.5.jar">
+ <CLASSES>
+ <root url="jar://$MODULE_DIR$/ext/waffle-jna-1.5.jar!/" />
+ </CLASSES>
+ <JAVADOC />
+ <SOURCES>
+ <root url="jar://$MODULE_DIR$/ext/src/waffle-jna-1.5.jar!/" />
+ </SOURCES>
+ </library>
+ </orderEntry>
+ <orderEntry type="module-library">
+ <library name="platform-3.5.0.jar">
+ <CLASSES>
+ <root url="jar://$MODULE_DIR$/ext/platform-3.5.0.jar!/" />
+ </CLASSES>
+ <JAVADOC />
+ <SOURCES>
+ <root url="jar://$MODULE_DIR$/ext/src/platform-3.5.0.jar!/" />
+ </SOURCES>
+ </library>
+ </orderEntry>
+ <orderEntry type="module-library">
+ <library name="jna-3.5.0.jar">
+ <CLASSES>
+ <root url="jar://$MODULE_DIR$/ext/jna-3.5.0.jar!/" />
+ </CLASSES>
+ <JAVADOC />
+ <SOURCES>
+ <root url="jar://$MODULE_DIR$/ext/src/jna-3.5.0.jar!/" />
+ </SOURCES>
+ </library>
+ </orderEntry>
+ <orderEntry type="module-library">
+ <library name="guava-13.0.1.jar">
+ <CLASSES>
+ <root url="jar://$MODULE_DIR$/ext/guava-13.0.1.jar!/" />
+ </CLASSES>
+ <JAVADOC />
+ <SOURCES>
+ <root url="jar://$MODULE_DIR$/ext/src/guava-13.0.1.jar!/" />
+ </SOURCES>
+ </library>
+ </orderEntry>
<orderEntry type="module-library" scope="TEST">
<library name="junit-4.11.jar">
<CLASSES>
@@ -524,17 +568,6 @@
</library>
</orderEntry>
<orderEntry type="module-library" scope="TEST">
- <library name="guava-13.0.1.jar">
- <CLASSES>
- <root url="jar://$MODULE_DIR$/ext/guava-13.0.1.jar!/" />
- </CLASSES>
- <JAVADOC />
- <SOURCES>
- <root url="jar://$MODULE_DIR$/ext/src/guava-13.0.1.jar!/" />
- </SOURCES>
- </library>
- </orderEntry>
- <orderEntry type="module-library" scope="TEST">
<library name="httpclient-4.2.1.jar">
<CLASSES>
<root url="jar://$MODULE_DIR$/ext/httpclient-4.2.1.jar!/" />
@@ -586,28 +619,6 @@
<JAVADOC />
<SOURCES>
<root url="jar://$MODULE_DIR$/ext/src/commons-exec-1.1.jar!/" />
- </SOURCES>
- </library>
- </orderEntry>
- <orderEntry type="module-library" scope="TEST">
- <library name="jna-3.4.0.jar">
- <CLASSES>
- <root url="jar://$MODULE_DIR$/ext/jna-3.4.0.jar!/" />
- </CLASSES>
- <JAVADOC />
- <SOURCES>
- <root url="jar://$MODULE_DIR$/ext/src/jna-3.4.0.jar!/" />
- </SOURCES>
- </library>
- </orderEntry>
- <orderEntry type="module-library" scope="TEST">
- <library name="platform-3.4.0.jar">
- <CLASSES>
- <root url="jar://$MODULE_DIR$/ext/platform-3.4.0.jar!/" />
- </CLASSES>
- <JAVADOC />
- <SOURCES>
- <root url="jar://$MODULE_DIR$/ext/src/platform-3.4.0.jar!/" />
</SOURCES>
</library>
</orderEntry>
diff --git a/releases.moxie b/releases.moxie
index 74e7d14..1b8b2b0 100644
--- a/releases.moxie
+++ b/releases.moxie
@@ -46,7 +46,8 @@
- Updated Polish translation
- Updated Japanese translation
- additions:
+ additions:
+ - Added WindowsUserService to authenticate users against Windows accounts (issue-250)
- Global and per-repository setting to exclude authors from metrics (issue-251)
- Added SalesForce.com user service
- Added simple star/unstar function to flag or bookmark interesting repositories
@@ -74,6 +75,7 @@
- Bandarupalli Satyanarayana
- Chad Horohoe
- Christian Aistleitner
+ - Colin Bowern
- David Ostrovsky
- Egbert Teeselink
- Hige Maniya
@@ -108,15 +110,20 @@
- Iconic font
- AngularJS 1.0.7
- FreeMarker 2.3.19
+ - Waffle 1.5
+ - JNA 3.5.0
+ - Guava 13.0.1
settings:
- { name: 'git.daemonBindInterface', defaultValue: 'localhost' }
- { name: 'git.daemonPort', defaultValue: 0 }
- - { name: 'git.defaultIncrementalPushTagPrefix', defaultValue: 'r' }
+ - { name: 'git.defaultIncrementalPushTagPrefix', defaultValue: 'r' }
- { name: 'mail.smtps', defaultValue: 'false' }
- { name: 'realm.container.autoCreateAccounts', defaultValue: 'false' }
- { name: 'realm.salesforce.backingUserService', defaultValue: 'users.conf' }
- { name: 'realm.salesforce.orgId', defaultValue: 0 }
+ - { name: 'realm.windows.defaultDomain', defaultValue: ' ' }
+ - { name: 'realm.windows.backingUserService', defaultValue: 'users.conf' }
- { name: 'web.activityDurationChoices', defaultValue: '7 14 28 60 90 180' }
- { name: 'web.allowAppCloneLinks', defaultValue: 'true' }
- { name: 'web.forceDefaultLocale', defaultValue: ' ' }
diff --git a/src/main/distrib/data/gitblit.properties b/src/main/distrib/data/gitblit.properties
index 7936bc2..f38afef 100644
--- a/src/main/distrib/data/gitblit.properties
+++ b/src/main/distrib/data/gitblit.properties
@@ -500,6 +500,7 @@
# com.gitblit.LdapUserService
# com.gitblit.RedmineUserService
# com.gitblit.SalesforceUserService
+# com.gitblit.WindowsUserService
#
# Any custom user service implementation must have a public default constructor.
#
@@ -1117,12 +1118,39 @@
# SINCE 1.3.0
realm.container.autoCreateAccounts = false
+# The WindowsUserService must be backed by another user service for standard user
+# and team management.
+# default: users.conf
+#
+# RESTART REQUIRED
+# BASEFOLDER
+# SINCE 1.3.0
+realm.windows.backingUserService = ${baseFolder}/users.conf
+
+# Allow or prohibit Windows guest account logins
+#
+# SINCE 1.3.0
+realm.windows.allowGuests = false
+
+# The default domain for authentication.
+#
+# If specified, this domain will be used for authentication UNLESS the supplied
+# login name manually specifies a domain (.e.g. mydomain\james or james@mydomain)
+#
+# If unspecified, the username must be specified in UPN format (name@domain).
+#
+# if "." (dot) is specified, ONLY the local account database will be used.
+#
+# SINCE 1.3.0
+realm.windows.defaultDomain =
+
# The SalesforceUserService must be backed by another user service for standard user
# and team management.
# default: users.conf
#
# RESTART REQUIRED
# BASEFOLDER
+# SINCE 1.3.0
realm.salesforce.backingUserService = ${baseFolder}/users.conf
# Restrict the Salesforce user to members of this org.
diff --git a/src/main/java/com/gitblit/Constants.java b/src/main/java/com/gitblit/Constants.java
index 2c64570..f3ad5fa 100644
--- a/src/main/java/com/gitblit/Constants.java
+++ b/src/main/java/com/gitblit/Constants.java
@@ -480,7 +480,7 @@
}
public static enum AccountType {
- LOCAL, LDAP, REDMINE, SALESFORCE;
+ LOCAL, LDAP, REDMINE, SALESFORCE, WINDOWS;
public boolean isLocal() {
return this == LOCAL;
diff --git a/src/main/java/com/gitblit/WindowsUserService.java b/src/main/java/com/gitblit/WindowsUserService.java
new file mode 100644
index 0000000..4830297
--- /dev/null
+++ b/src/main/java/com/gitblit/WindowsUserService.java
@@ -0,0 +1,194 @@
+/*
+ * Copyright 2013 gitblit.com.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.gitblit;
+
+import java.io.File;
+import java.util.Set;
+import java.util.TreeSet;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import waffle.windows.auth.IWindowsAccount;
+import waffle.windows.auth.IWindowsAuthProvider;
+import waffle.windows.auth.IWindowsComputer;
+import waffle.windows.auth.IWindowsIdentity;
+import waffle.windows.auth.impl.WindowsAuthProviderImpl;
+
+import com.gitblit.Constants.AccountType;
+import com.gitblit.models.UserModel;
+import com.gitblit.utils.ArrayUtils;
+import com.gitblit.utils.StringUtils;
+import com.sun.jna.platform.win32.Win32Exception;
+
+/**
+ * Implementation of a Windows user service.
+ *
+ * @author James Moger
+ */
+public class WindowsUserService extends GitblitUserService {
+
+ private final Logger logger = LoggerFactory.getLogger(WindowsUserService.class);
+
+ private IStoredSettings settings;
+
+ private IWindowsAuthProvider waffle;
+
+ public WindowsUserService() {
+ super();
+ }
+
+ @Override
+ public void setup(IStoredSettings settings) {
+ this.settings = settings;
+
+ String file = settings.getString(Keys.realm.windows.backingUserService, "${baseFolder}/users.conf");
+ File realmFile = GitBlit.getFileOrFolder(file);
+
+ serviceImpl = createUserService(realmFile);
+ logger.info("Windows User Service backed by " + serviceImpl.toString());
+
+ waffle = new WindowsAuthProviderImpl();
+ IWindowsComputer computer = waffle.getCurrentComputer();
+ logger.info(" name = " + computer.getComputerName());
+ logger.info(" status = " + describeJoinStatus(computer.getJoinStatus()));
+ logger.info(" memberOf = " + computer.getMemberOf());
+ //logger.info(" groups = " + Arrays.asList(computer.getGroups()));
+ }
+
+ protected String describeJoinStatus(String value) {
+ if ("NetSetupUnknownStatus".equals(value)) {
+ return "unknown";
+ } else if ("NetSetupUnjoined".equals(value)) {
+ return "not joined";
+ } else if ("NetSetupWorkgroupName".equals(value)) {
+ return "joined to a workgroup";
+ } else if ("NetSetupDomainName".equals(value)) {
+ return "joined to a domain";
+ }
+ return value;
+ }
+
+ @Override
+ public boolean supportsCredentialChanges() {
+ return false;
+ }
+
+ @Override
+ public boolean supportsDisplayNameChanges() {
+ return false;
+ }
+
+ @Override
+ public boolean supportsEmailAddressChanges() {
+ return true;
+ }
+
+ @Override
+ public boolean supportsTeamMembershipChanges() {
+ return true;
+ }
+
+ @Override
+ protected AccountType getAccountType() {
+ return AccountType.WINDOWS;
+ }
+
+ @Override
+ public UserModel authenticate(String username, char[] password) {
+ if (isLocalAccount(username)) {
+ // local account, bypass Windows authentication
+ return super.authenticate(username, password);
+ }
+
+ String defaultDomain = settings.getString(Keys.realm.windows.defaultDomain, null);
+ if (StringUtils.isEmpty(defaultDomain)) {
+ // ensure that default domain is null
+ defaultDomain = null;
+ }
+
+ if (defaultDomain != null) {
+ // sanitize username
+ if (username.startsWith(defaultDomain + "\\")) {
+ // strip default domain from domain\ username
+ username = username.substring(defaultDomain.length() + 1);
+ } else if (username.endsWith("@" + defaultDomain)) {
+ // strip default domain from username@domain
+ username = username.substring(0, username.lastIndexOf('@'));
+ }
+ }
+
+ IWindowsIdentity identity = null;
+ try {
+ if (username.indexOf('@') > -1 || username.indexOf('\\') > -1) {
+ // manually specified domain
+ identity = waffle.logonUser(username, new String(password));
+ } else {
+ // no domain specified, use default domain
+ identity = waffle.logonDomainUser(username, defaultDomain, new String(password));
+ }
+ } catch (Win32Exception e) {
+ logger.error(e.getMessage());
+ return null;
+ }
+
+ if (identity.isGuest() && !settings.getBoolean(Keys.realm.windows.allowGuests, false)) {
+ logger.warn("Guest account access is disabled");
+ identity.dispose();
+ return null;
+ }
+
+ UserModel user = getUserModel(username);
+ if (user == null) // create user object for new authenticated user
+ user = new UserModel(username.toLowerCase());
+
+ // create a user cookie
+ if (StringUtils.isEmpty(user.cookie) && !ArrayUtils.isEmpty(password)) {
+ user.cookie = StringUtils.getSHA1(user.username + new String(password));
+ }
+
+ // update user attributes from Windows identity
+ user.accountType = getAccountType();
+ String fqn = identity.getFqn();
+ if (fqn.indexOf('\\') > -1) {
+ user.displayName = fqn.substring(fqn.lastIndexOf('\\') + 1);
+ } else {
+ user.displayName = fqn;
+ }
+ user.password = Constants.EXTERNAL_ACCOUNT;
+
+ Set<String> groupNames = new TreeSet<String>();
+ for (IWindowsAccount group : identity.getGroups()) {
+ groupNames.add(group.getFqn());
+ }
+
+ if (groupNames.contains("BUILTIN\\Administrators")) {
+ // local administrator
+ user.canAdmin = true;
+ }
+
+ // TODO consider mapping Windows groups to teams
+
+ // push the changes to the backing user service
+ super.updateUserModel(user);
+
+
+ // cleanup resources
+ identity.dispose();
+
+ return user;
+ }
+}
diff --git a/src/site/design.mkd b/src/site/design.mkd
index 7171197..85c3fe2 100644
--- a/src/site/design.mkd
+++ b/src/site/design.mkd
@@ -48,6 +48,9 @@
- [Commons-Compress](http://commons.apache.org/compress) (Apache 2.0)
- [XZ for Java](http://tukaani.org/xz/java.html) (Public Domain)
- [FreeMarker](http://www.freemarker.org) (modified BSD)
+- [Waffle](http://dblock.github.io/waffle) (EPL 1.0)
+- [JNA](https://github.com/twall/jna) (LGPL 2.1)
+- [Guava](https://code.google.com/p/guava-libraries) (Apache 2.0)
### Other Build Dependencies
- [Fancybox image viewer](http://fancybox.net) (MIT and GPL dual-licensed)
diff --git a/src/site/features.mkd b/src/site/features.mkd
index fd89ad8..b9b44a5 100644
--- a/src/site/features.mkd
+++ b/src/site/features.mkd
@@ -36,6 +36,7 @@
- LDAP authentication and optional LDAP-controlled Team memberships
- Redmine authentication
- Salesforce.com authentication
+- Windows authentication
- Gravatar integration
- Git-notes display support
- Submodule support
--
Gitblit v1.9.1