You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@guacamole.apache.org by jm...@apache.org on 2018/11/09 05:29:22 UTC
[02/14] guacamole-client git commit: GUACAMOLE-220: Define generic
service for executing LDAP queries. Refactor existing services to remove
common code.
GUACAMOLE-220: Define generic service for executing LDAP queries. Refactor existing services to remove common code.
Project: http://git-wip-us.apache.org/repos/asf/guacamole-client/repo
Commit: http://git-wip-us.apache.org/repos/asf/guacamole-client/commit/7c57b448
Tree: http://git-wip-us.apache.org/repos/asf/guacamole-client/tree/7c57b448
Diff: http://git-wip-us.apache.org/repos/asf/guacamole-client/diff/7c57b448
Branch: refs/heads/master
Commit: 7c57b448bbd6a76018a3fd531950b952ac94dca0
Parents: 929c7de
Author: Michael Jumper <mj...@apache.org>
Authored: Fri Nov 2 15:03:56 2018 -0700
Committer: Michael Jumper <mj...@apache.org>
Committed: Sat Nov 3 12:41:54 2018 -0700
----------------------------------------------------------------------
.../ldap/LDAPAuthenticationProviderModule.java | 1 +
.../guacamole/auth/ldap/ObjectQueryService.java | 326 +++++++++++++++++++
.../auth/ldap/connection/ConnectionService.java | 123 +++----
.../guacamole/auth/ldap/user/UserService.java | 232 ++-----------
4 files changed, 410 insertions(+), 272 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/guacamole-client/blob/7c57b448/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPAuthenticationProviderModule.java
----------------------------------------------------------------------
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPAuthenticationProviderModule.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPAuthenticationProviderModule.java
index ead26bc..5478080 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPAuthenticationProviderModule.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/LDAPAuthenticationProviderModule.java
@@ -77,6 +77,7 @@ public class LDAPAuthenticationProviderModule extends AbstractModule {
bind(ConnectionService.class);
bind(EscapingService.class);
bind(LDAPConnectionService.class);
+ bind(ObjectQueryService.class);
bind(UserService.class);
}
http://git-wip-us.apache.org/repos/asf/guacamole-client/blob/7c57b448/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ObjectQueryService.java
----------------------------------------------------------------------
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ObjectQueryService.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ObjectQueryService.java
new file mode 100644
index 0000000..89a43c3
--- /dev/null
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/ObjectQueryService.java
@@ -0,0 +1,326 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.guacamole.auth.ldap;
+
+import com.google.inject.Inject;
+import com.novell.ldap.LDAPAttribute;
+import com.novell.ldap.LDAPConnection;
+import com.novell.ldap.LDAPEntry;
+import com.novell.ldap.LDAPException;
+import com.novell.ldap.LDAPReferralException;
+import com.novell.ldap.LDAPSearchResults;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
+import org.apache.guacamole.GuacamoleException;
+import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.net.auth.Identifiable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Service for executing queries against an LDAP directory intended to retrieve
+ * Guacamole-related objects. Referrals are automatically handled. Convenience
+ * functions are provided for generating the LDAP queries typically required
+ * for retrieving Guacamole objects, as well as for converting the results of a
+ * query into a Map of Guacamole objects.
+ */
+public class ObjectQueryService {
+
+ /**
+ * Logger for this class.
+ */
+ private final Logger logger = LoggerFactory.getLogger(ObjectQueryService.class);
+
+ /**
+ * Service for escaping parts of LDAP queries.
+ */
+ @Inject
+ private EscapingService escapingService;
+
+ /**
+ * Service for retrieving LDAP server configuration information.
+ */
+ @Inject
+ private ConfigurationService confService;
+
+ /**
+ * Returns the identifier of the object represented by the given LDAP
+ * entry. Multiple attributes may be declared as containing the identifier
+ * of the object when present on an LDAP entry. If multiple such attributes
+ * are present on the same LDAP entry, the value of the attribute with
+ * highest priority is used. If multiple copies of the same attribute are
+ * present on the same LDAPentry, the first value of that attribute is
+ * used.
+ *
+ * @param entry
+ * The entry representing the Guacamole object whose unique identifier
+ * should be determined.
+ *
+ * @param attributes
+ * A collection of all attributes which may be used to specify the
+ * unique identifier of the Guacamole object represented by an LDAP
+ * entry, in order of decreasing priority.
+ *
+ * @return
+ * The identifier of the object represented by the given LDAP entry, or
+ * null if no attributes declared as containing the identifier of the
+ * object are present on the entry.
+ */
+ public String getIdentifier(LDAPEntry entry, Collection<String> attributes) {
+
+ // Retrieve the first value of the highest priority identifier attribute
+ for (String identifierAttribute : attributes) {
+ LDAPAttribute identifier = entry.getAttribute(identifierAttribute);
+ if (identifier != null)
+ return identifier.getStringValue();
+ }
+
+ // No identifier attribute is present on the entry
+ return null;
+
+ }
+
+ /**
+ * Generates a properly-escaped LDAP query which finds all objects which
+ * match the given LDAP filter and which have at least one of the given
+ * attributes set to the specified value.
+ *
+ * @param filter
+ * The LDAP filter to apply to reduce the results of the query in
+ * addition to testing the values of the given attributes.
+ *
+ * @param attributes
+ * A collection of all attributes to test for equivalence to the given
+ * value, in order of decreasing priority.
+ *
+ * @param attributeValue
+ * The value that the resulting LDAP query should search for within the
+ * attributes of objects within the LDAP directory. If null, the
+ * resulting LDAP query will search for the presence of at least one of
+ * the given attributes on each object, regardless of the value of
+ * those attributes.
+ *
+ * @return
+ * An LDAP query which will search for arbitrary LDAP objects having at
+ * least one of the given attributes set to the specified value.
+ */
+ public String generateQuery(String filter,
+ Collection<String> attributes, String attributeValue) {
+
+ // Build LDAP query for objects having at least one attribute and with
+ // the given search filter
+ StringBuilder ldapQuery = new StringBuilder();
+ ldapQuery.append("(&");
+ ldapQuery.append(filter);
+
+ // Include all attributes within OR clause if there are more than one
+ if (attributes.size() > 1)
+ ldapQuery.append("(|");
+
+ // Add equality comparison for each possible attribute
+ for (String attribute : attributes) {
+ ldapQuery.append("(");
+ ldapQuery.append(escapingService.escapeLDAPSearchFilter(attribute));
+
+ if (attributeValue != null) {
+ ldapQuery.append("=");
+ ldapQuery.append(escapingService.escapeLDAPSearchFilter(attributeValue));
+ ldapQuery.append(")");
+ }
+ else
+ ldapQuery.append("=*)");
+
+ }
+
+ // Close OR clause, if any
+ if (attributes.size() > 1)
+ ldapQuery.append(")");
+
+ // Close overall query (AND clause)
+ ldapQuery.append(")");
+
+ return ldapQuery.toString();
+
+ }
+
+ /**
+ * Executes an arbitrary LDAP query using the given connection, returning a
+ * list of all results. Only objects beneath the given base DN are
+ * included in the search.
+ *
+ * @param ldapConnection
+ * The current connection to the LDAP server, associated with the
+ * current user.
+ *
+ * @param baseDN
+ * The base DN to search using the given LDAP query.
+ *
+ * @param query
+ * The LDAP query to execute.
+ *
+ * @return
+ * A list of all results accessible to the user currently bound under
+ * the given LDAP connection.
+ *
+ * @throws GuacamoleException
+ * If an error occurs executing the query, or if configuration
+ * information required to execute the query cannot be read from
+ * guacamole.properties.
+ */
+ public List<LDAPEntry> search(LDAPConnection ldapConnection,
+ String baseDN, String query) throws GuacamoleException {
+
+ logger.debug("Searching \"{}\" for objects matching \"{}\".", baseDN, query);
+
+ try {
+
+ // Search within subtree of given base DN
+ LDAPSearchResults results = ldapConnection.search(baseDN,
+ LDAPConnection.SCOPE_SUB, query, null, false,
+ confService.getLDAPSearchConstraints());
+
+ // Produce list of all entries in the search result, automatically
+ // following referrals if configured to do so
+ List<LDAPEntry> entries = new ArrayList<>(results.getCount());
+ while (results.hasMore()) {
+
+ try {
+ entries.add(results.next());
+ }
+
+ // Warn if referrals cannot be followed
+ catch (LDAPReferralException e) {
+ if (confService.getFollowReferrals()) {
+ logger.error("Could not follow referral: {}", e.getFailedReferral());
+ logger.debug("Error encountered trying to follow referral.", e);
+ throw new GuacamoleServerException("Could not follow LDAP referral.", e);
+ }
+ else {
+ logger.warn("Given a referral, but referrals are disabled. Error was: {}", e.getMessage());
+ logger.debug("Got a referral, but configured to not follow them.", e);
+ }
+ }
+
+ }
+
+ return entries;
+
+ }
+ catch (LDAPException | GuacamoleException e) {
+ throw new GuacamoleServerException("Unable to query list of "
+ + "objects from LDAP directory.", e);
+ }
+
+ }
+
+ /**
+ * Executes the query which would be returned by generateQuery() using the
+ * given connection, returning a list of all results. Only objects beneath
+ * the given base DN are included in the search.
+ *
+ * @param ldapConnection
+ * The current connection to the LDAP server, associated with the
+ * current user.
+ *
+ * @param baseDN
+ * The base DN to search using the given LDAP query.
+ *
+ * @param filter
+ * The LDAP filter to apply to reduce the results of the query in
+ * addition to testing the values of the given attributes.
+ *
+ * @param attributes
+ * A collection of all attributes to test for equivalence to the given
+ * value, in order of decreasing priority.
+ *
+ * @param attributeValue
+ * The value that should be searched search for within the attributes
+ * of objects within the LDAP directory. If null, the search will test
+ * only for the presence of at least one of the given attributes on
+ * each object, regardless of the value of those attributes.
+ *
+ * @return
+ * A list of all results accessible to the user currently bound under
+ * the given LDAP connection.
+ *
+ * @throws GuacamoleException
+ * If an error occurs executing the query, or if configuration
+ * information required to execute the query cannot be read from
+ * guacamole.properties.
+ */
+ public List<LDAPEntry> search(LDAPConnection ldapConnection, String baseDN,
+ String filter, Collection<String> attributes, String attributeValue)
+ throws GuacamoleException {
+ String query = generateQuery(filter, attributes, attributeValue);
+ return search(ldapConnection, baseDN, query);
+ }
+
+ /**
+ * Converts a given list of LDAP entries to a map of Guacamole objects
+ * stored by their identifiers.
+ *
+ * @param <ObjectType>
+ * The type of object to store within the map.
+ *
+ * @param entries
+ * A list of LDAP entries to convert to Guacamole objects.
+ *
+ * @param mapper
+ * A mapping function which converts a given LDAP entry to its
+ * corresponding Guacamole object. If the LDAP entry cannot be
+ * converted, null should be returned.
+ *
+ * @return
+ * A new map containing Guacamole object versions of each of the given
+ * LDAP entries, where each object is stored within the map under its
+ * corresponding identifier.
+ */
+ public <ObjectType extends Identifiable> Map<String, ObjectType>
+ asMap(List<LDAPEntry> entries, Function<LDAPEntry, ObjectType> mapper) {
+
+ // Convert each entry to the corresponding Guacamole API object
+ Map<String, ObjectType> objects = new HashMap<>(entries.size());
+ for (LDAPEntry entry : entries) {
+
+ ObjectType object = mapper.apply(entry);
+ if (object == null) {
+ logger.debug("Ignoring object \"{}\".", entry.getDN());
+ continue;
+ }
+
+ // Attempt to add object to map, warning if the object appears
+ // to be a duplicate
+ String identifier = object.getIdentifier();
+ if (objects.putIfAbsent(identifier, object) != null)
+ logger.warn("Multiple objects ambiguously map to the "
+ + "same identifier (\"{}\"). Ignoring \"{}\" as "
+ + "a duplicate.", identifier, entry.getDN());
+
+ }
+
+ return objects;
+
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/guacamole-client/blob/7c57b448/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java
----------------------------------------------------------------------
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java
index 3ce00e3..78100a0 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/connection/ConnectionService.java
@@ -28,13 +28,14 @@ import com.novell.ldap.LDAPReferralException;
import com.novell.ldap.LDAPSearchResults;
import java.util.Collections;
import java.util.Enumeration;
-import java.util.HashMap;
+import java.util.List;
import java.util.Map;
import org.apache.guacamole.auth.ldap.LDAPAuthenticationProvider;
import org.apache.guacamole.auth.ldap.ConfigurationService;
import org.apache.guacamole.auth.ldap.EscapingService;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleServerException;
+import org.apache.guacamole.auth.ldap.ObjectQueryService;
import org.apache.guacamole.net.auth.AuthenticatedUser;
import org.apache.guacamole.net.auth.Connection;
import org.apache.guacamole.net.auth.simple.SimpleConnection;
@@ -68,6 +69,12 @@ public class ConnectionService {
private ConfigurationService confService;
/**
+ * Service for executing LDAP queries.
+ */
+ @Inject
+ private ObjectQueryService queryService;
+
+ /**
* Returns all Guacamole connections accessible to the user currently bound
* under the given LDAP connection.
*
@@ -113,101 +120,71 @@ public class ConnectionService {
// looking for direct membership in the guacConfigGroup
// and possibly any groups the user is a member of that are
// referred to in the seeAlso attribute of the guacConfigGroup.
- LDAPSearchResults results = ldapConnection.search(
- configurationBaseDN,
- LDAPConnection.SCOPE_SUB,
- connectionSearchFilter,
- null,
- false,
- confService.getLDAPSearchConstraints()
- );
+ List<LDAPEntry> results = queryService.search(ldapConnection, configurationBaseDN, connectionSearchFilter);
// Build token filter containing credential tokens
TokenFilter tokenFilter = new TokenFilter();
StandardTokens.addStandardTokens(tokenFilter, user);
- // Produce connections for each readable configuration
- Map<String, Connection> connections = new HashMap<String, Connection>();
- while (results.hasMore()) {
-
- try {
-
- LDAPEntry entry = results.next();
+ // Return a map of all readable connections
+ return queryService.asMap(results, (entry) -> {
- // Get common name (CN)
- LDAPAttribute cn = entry.getAttribute("cn");
- if (cn == null) {
- logger.warn("guacConfigGroup is missing a cn.");
- continue;
- }
-
- // Get associated protocol
- LDAPAttribute protocol = entry.getAttribute("guacConfigProtocol");
- if (protocol == null) {
- logger.warn("guacConfigGroup \"{}\" is missing the "
- + "required \"guacConfigProtocol\" attribute.",
- cn.getStringValue());
- continue;
- }
+ // Get common name (CN)
+ LDAPAttribute cn = entry.getAttribute("cn");
+ if (cn == null) {
+ logger.warn("guacConfigGroup is missing a cn.");
+ return null;
+ }
- // Set protocol
- GuacamoleConfiguration config = new GuacamoleConfiguration();
- config.setProtocol(protocol.getStringValue());
+ // Get associated protocol
+ LDAPAttribute protocol = entry.getAttribute("guacConfigProtocol");
+ if (protocol == null) {
+ logger.warn("guacConfigGroup \"{}\" is missing the "
+ + "required \"guacConfigProtocol\" attribute.",
+ cn.getStringValue());
+ return null;
+ }
- // Get parameters, if any
- LDAPAttribute parameterAttribute = entry.getAttribute("guacConfigParameter");
- if (parameterAttribute != null) {
+ // Set protocol
+ GuacamoleConfiguration config = new GuacamoleConfiguration();
+ config.setProtocol(protocol.getStringValue());
- // For each parameter
- Enumeration<?> parameters = parameterAttribute.getStringValues();
- while (parameters.hasMoreElements()) {
+ // Get parameters, if any
+ LDAPAttribute parameterAttribute = entry.getAttribute("guacConfigParameter");
+ if (parameterAttribute != null) {
- String parameter = (String) parameters.nextElement();
+ // For each parameter
+ Enumeration<?> parameters = parameterAttribute.getStringValues();
+ while (parameters.hasMoreElements()) {
- // Parse parameter
- int equals = parameter.indexOf('=');
- if (equals != -1) {
+ String parameter = (String) parameters.nextElement();
- // Parse name
- String name = parameter.substring(0, equals);
- String value = parameter.substring(equals+1);
+ // Parse parameter
+ int equals = parameter.indexOf('=');
+ if (equals != -1) {
- config.setParameter(name, value);
+ // Parse name
+ String name = parameter.substring(0, equals);
+ String value = parameter.substring(equals+1);
- }
+ config.setParameter(name, value);
}
}
- // Filter the configuration, substituting all defined tokens
- tokenFilter.filterValues(config.getParameters());
-
- // Store connection using cn for both identifier and name
- String name = cn.getStringValue();
- Connection connection = new SimpleConnection(name, name, config);
- connection.setParentIdentifier(LDAPAuthenticationProvider.ROOT_CONNECTION_GROUP);
- connections.put(name, connection);
-
}
- // Deal with issues following LDAP referrals
- catch (LDAPReferralException e) {
- if (confService.getFollowReferrals()) {
- logger.error("Could not follow referral: {}", e.getFailedReferral());
- logger.debug("Error encountered trying to follow referral.", e);
- throw new GuacamoleServerException("Could not follow LDAP referral.", e);
- }
- else {
- logger.warn("Given a referral, but referrals are disabled. Error was: {}", e.getMessage());
- logger.debug("Got a referral, but configured to not follow them.", e);
- }
- }
+ // Filter the configuration, substituting all defined tokens
+ tokenFilter.filterValues(config.getParameters());
- }
+ // Store connection using cn for both identifier and name
+ String name = cn.getStringValue();
+ Connection connection = new SimpleConnection(name, name, config);
+ connection.setParentIdentifier(LDAPAuthenticationProvider.ROOT_CONNECTION_GROUP);
+ return connection;
- // Return map of all connections
- return connections;
+ });
}
catch (LDAPException e) {
http://git-wip-us.apache.org/repos/asf/guacamole-client/blob/7c57b448/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/user/UserService.java
----------------------------------------------------------------------
diff --git a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/user/UserService.java b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/user/UserService.java
index 9d27f1e..3f12ae8 100644
--- a/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/user/UserService.java
+++ b/extensions/guacamole-auth-ldap/src/main/java/org/apache/guacamole/auth/ldap/user/UserService.java
@@ -20,21 +20,17 @@
package org.apache.guacamole.auth.ldap.user;
import com.google.inject.Inject;
-import com.novell.ldap.LDAPAttribute;
import com.novell.ldap.LDAPConnection;
import com.novell.ldap.LDAPEntry;
-import com.novell.ldap.LDAPException;
-import com.novell.ldap.LDAPReferralException;
-import com.novell.ldap.LDAPSearchResults;
import java.util.ArrayList;
-import java.util.HashMap;
+import java.util.Collection;
import java.util.List;
import java.util.Map;
import org.apache.guacamole.auth.ldap.ConfigurationService;
import org.apache.guacamole.auth.ldap.EscapingService;
import org.apache.guacamole.GuacamoleException;
-import org.apache.guacamole.GuacamoleServerException;
import org.apache.guacamole.auth.ldap.LDAPGuacamoleProperties;
+import org.apache.guacamole.auth.ldap.ObjectQueryService;
import org.apache.guacamole.net.auth.User;
import org.apache.guacamole.net.auth.simple.SimpleUser;
import org.slf4j.Logger;
@@ -64,89 +60,10 @@ public class UserService {
private ConfigurationService confService;
/**
- * Adds all Guacamole users accessible to the user currently bound under
- * the given LDAP connection to the provided map. Only users with the
- * specified attribute are added. If the same username is encountered
- * multiple times, warnings about possible ambiguity will be logged.
- *
- * @param ldapConnection
- * The current connection to the LDAP server, associated with the
- * current user.
- *
- * @return
- * All users accessible to the user currently bound under the given
- * LDAP connection, as a map of connection identifier to corresponding
- * user object.
- *
- * @throws GuacamoleException
- * If an error occurs preventing retrieval of users.
+ * Service for executing LDAP queries.
*/
- private void putAllUsers(Map<String, User> users, LDAPConnection ldapConnection,
- String usernameAttribute) throws GuacamoleException {
-
- try {
-
- // Build a filter using the configured or default user search filter
- // to find all user objects in the LDAP tree
- StringBuilder userSearchFilter = new StringBuilder();
- userSearchFilter.append("(&");
- userSearchFilter.append(confService.getUserSearchFilter());
- userSearchFilter.append("(");
- userSearchFilter.append(escapingService.escapeLDAPSearchFilter(usernameAttribute));
- userSearchFilter.append("=*))");
-
- // Find all Guacamole users underneath base DN
- LDAPSearchResults results = ldapConnection.search(
- confService.getUserBaseDN(),
- LDAPConnection.SCOPE_SUB,
- userSearchFilter.toString(),
- null,
- false,
- confService.getLDAPSearchConstraints()
- );
-
- // Read all visible users
- while (results.hasMore()) {
-
- try {
-
- LDAPEntry entry = results.next();
-
- // Get username from record
- LDAPAttribute username = entry.getAttribute(usernameAttribute);
- if (username == null) {
- logger.warn("Queried user is missing the username attribute \"{}\".", usernameAttribute);
- continue;
- }
-
- // Store user using their username as the identifier
- String identifier = username.getStringValue();
- if (users.put(identifier, new SimpleUser(identifier)) != null)
- logger.warn("Possibly ambiguous user account: \"{}\".", identifier);
-
- }
-
- // Deal with errors trying to follow referrals
- catch (LDAPReferralException e) {
- if (confService.getFollowReferrals()) {
- logger.error("Could not follow referral: {}", e.getFailedReferral());
- logger.debug("Error encountered trying to follow referral.", e);
- throw new GuacamoleServerException("Could not follow LDAP referral.", e);
- }
- else {
- logger.warn("Given a referral, but referrals are disabled. Error was: {}", e.getMessage());
- logger.debug("Got a referral, but configured to not follow them.", e);
- }
- }
-
- }
-
- }
- catch (LDAPException e) {
- throw new GuacamoleServerException("Error while querying users.", e);
- }
-
- }
+ @Inject
+ private ObjectQueryService queryService;
/**
* Returns all Guacamole users accessible to the user currently bound under
@@ -167,80 +84,28 @@ public class UserService {
public Map<String, User> getUsers(LDAPConnection ldapConnection)
throws GuacamoleException {
- // Build map of users by querying each username attribute separately
- Map<String, User> users = new HashMap<String, User>();
- for (String usernameAttribute : confService.getUsernameAttributes()) {
-
- // Attempt to pull all users with given attribute
- try {
- putAllUsers(users, ldapConnection, usernameAttribute);
- }
-
- // Log any errors non-fatally
- catch (GuacamoleException e) {
- logger.warn("Could not query list of all users for attribute \"{}\": {}",
- usernameAttribute, e.getMessage());
- logger.debug("Error querying list of all users.", e);
+ // Retrieve all visible user objects
+ Collection<String> attributes = confService.getUsernameAttributes();
+ List<LDAPEntry> results = queryService.search(ldapConnection,
+ confService.getUserBaseDN(),
+ confService.getUserSearchFilter(),
+ attributes,
+ null);
+
+ // Convert retrieved users to map of identifier to Guacamole user object
+ return queryService.asMap(results, entry -> {
+
+ // Get username from record
+ String username = queryService.getIdentifier(entry, attributes);
+ if (username == null) {
+ logger.warn("User \"{}\" is missing a username attribute "
+ + "and will be ignored.", entry.getDN());
+ return null;
}
- }
+ return new SimpleUser(username);
- // Return map of all users
- return users;
-
- }
-
- /**
- * Generates a properly-escaped LDAP query which finds all objects having
- * at least one username attribute set to the specified username, where
- * the possible username attributes are defined within
- * guacamole.properties.
- *
- * @param username
- * The username that the resulting LDAP query should search for within
- * objects within the LDAP directory.
- *
- * @return
- * An LDAP query which will search for arbitrary LDAP objects
- * containing at least one username attribute set to the specified
- * username.
- *
- * @throws GuacamoleException
- * If the LDAP query cannot be generated because the list of username
- * attributes cannot be parsed from guacamole.properties.
- */
- private String generateLDAPQuery(String username)
- throws GuacamoleException {
-
- List<String> usernameAttributes = confService.getUsernameAttributes();
-
- // Build LDAP query for users having at least one username attribute
- // and with the configured or default search filter
- StringBuilder ldapQuery = new StringBuilder();
- ldapQuery.append("(&");
- ldapQuery.append(confService.getUserSearchFilter());
-
- // Include all attributes within OR clause if there are more than one
- if (usernameAttributes.size() > 1)
- ldapQuery.append("(|");
-
- // Add equality comparison for each possible username attribute
- for (String usernameAttribute : usernameAttributes) {
- ldapQuery.append("(");
- ldapQuery.append(escapingService.escapeLDAPSearchFilter(usernameAttribute));
- ldapQuery.append("=");
- ldapQuery.append(escapingService.escapeLDAPSearchFilter(username));
- ldapQuery.append(")");
- }
-
- // Close OR clause, if any
- if (usernameAttributes.size() > 1)
- ldapQuery.append(")");
-
- // Close overall query (AND clause)
- ldapQuery.append(")");
-
- return ldapQuery.toString();
+ });
}
@@ -268,49 +133,18 @@ public class UserService {
public List<String> getUserDNs(LDAPConnection ldapConnection,
String username) throws GuacamoleException {
- try {
-
- List<String> userDNs = new ArrayList<String>();
-
- // Find all Guacamole users underneath base DN and matching the
- // specified username
- LDAPSearchResults results = ldapConnection.search(
+ // Retrieve user objects having a matching username
+ List<LDAPEntry> results = queryService.search(ldapConnection,
confService.getUserBaseDN(),
- LDAPConnection.SCOPE_SUB,
- generateLDAPQuery(username),
- null,
- false,
- confService.getLDAPSearchConstraints()
- );
+ confService.getUserSearchFilter(),
+ confService.getUsernameAttributes(),
+ username);
- // Add all DNs for found users
- while (results.hasMore()) {
- try {
- LDAPEntry entry = results.next();
- userDNs.add(entry.getDN());
- }
-
- // Deal with errors following referrals
- catch (LDAPReferralException e) {
- if (confService.getFollowReferrals()) {
- logger.error("Error trying to follow a referral: {}", e.getFailedReferral());
- logger.debug("Encountered an error trying to follow a referral.", e);
- throw new GuacamoleServerException("Failed while trying to follow referrals.", e);
- }
- else {
- logger.warn("Given a referral, not following it. Error was: {}", e.getMessage());
- logger.debug("Given a referral, but configured to not follow them.", e);
- }
- }
- }
+ // Build list of all DNs for retrieved users
+ List<String> userDNs = new ArrayList<>(results.size());
+ results.forEach(entry -> userDNs.add(entry.getDN()));
- // Return all discovered DNs (if any)
- return userDNs;
-
- }
- catch (LDAPException e) {
- throw new GuacamoleServerException("Error while query user DNs.", e);
- }
+ return userDNs;
}