You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by el...@apache.org on 2024/08/20 19:34:07 UTC
(directory-server) branch master updated: Partial fix to DIRSERVER_1728: interceptor-authn
This is an automated email from the ASF dual-hosted git repository.
elecharny pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/directory-server.git
The following commit(s) were added to refs/heads/master by this push:
new d13d4d58d4 Partial fix to DIRSERVER_1728: interceptor-authn
new 09c272459a Merge branch 'master' of https://gitbox.apache.org/repos/asf/directory-server
d13d4d58d4 is described below
commit d13d4d58d4c6e8316a1e69eaf55ecbf046bb08a5
Author: emmanuel lecharny <el...@apache.org>
AuthorDate: Tue Aug 20 21:23:17 2024 +0200
Partial fix to DIRSERVER_1728: interceptor-authn
---
.../server/core/jndi/SimpleBindJndiIT.java | 4 +--
.../org/apache/directory/server/i18n/I18n.java | 36 ++++++++++++++-----
.../apache/directory/server/i18n/errors.properties | 42 +++++++++++++++-------
.../core/kerberos/KeyDerivationInterceptor.java | 6 ++--
.../server/core/authn/AnonymousAuthenticator.java | 2 +-
.../core/authn/AuthenticationInterceptor.java | 4 +--
.../server/core/authn/DelegatingAuthenticator.java | 4 +--
.../server/core/authn/SimpleAuthenticator.java | 6 ++--
8 files changed, 70 insertions(+), 34 deletions(-)
diff --git a/core-integ/src/test/java/org/apache/directory/server/core/jndi/SimpleBindJndiIT.java b/core-integ/src/test/java/org/apache/directory/server/core/jndi/SimpleBindJndiIT.java
index 68fc279d18..c6704f2957 100644
--- a/core-integ/src/test/java/org/apache/directory/server/core/jndi/SimpleBindJndiIT.java
+++ b/core-integ/src/test/java/org/apache/directory/server/core/jndi/SimpleBindJndiIT.java
@@ -210,8 +210,8 @@ public class SimpleBindJndiIT extends AbstractLdapTestUnit
catch ( AuthenticationException ae )
{
// lae.printStackTrace();
- assertTrue( ae.getMessage().startsWith( org.apache.directory.server.i18n.I18n.ERR_229.getErrorCode() ),
- org.apache.directory.server.i18n.I18n.err( org.apache.directory.server.i18n.I18n.ERR_229 ) );
+ assertTrue( ae.getMessage().startsWith( org.apache.directory.server.i18n.I18n.ERR_14003_CANNOT_AUTHENTICATE_USER.getErrorCode() ),
+ org.apache.directory.server.i18n.I18n.err( org.apache.directory.server.i18n.I18n.ERR_14003_CANNOT_AUTHENTICATE_USER ) );
}
catch ( NamingException ne )
{
diff --git a/i18n/src/main/java/org/apache/directory/server/i18n/I18n.java b/i18n/src/main/java/org/apache/directory/server/i18n/I18n.java
index 2c5a1a0d2a..6949afec21 100644
--- a/i18n/src/main/java/org/apache/directory/server/i18n/I18n.java
+++ b/i18n/src/main/java/org/apache/directory/server/i18n/I18n.java
@@ -218,6 +218,7 @@ public enum I18n
ERR_03019_ALREADY_IN_ORDERED_SET_MODE("ERR_03019_ALREADY_IN_ORDERED_SET_MODE"),
// apacheds-core-constants errors 4000 - 4999
+ // No error
// apacheds-core-integ errors 5000 - 5999
@@ -257,6 +258,7 @@ public enum I18n
ERR_07008_CANNOT_FIND_PARTITION("ERR_07008_CANNOT_FIND_PARTITION"),
// apacheds-http-directory-bridge errors 8000 - 8999
+ // No error
// apacheds-http-integration errors 9000 - 9999
ERR_09000_FAILED_TO_CONFIGURE_JETTY_SERVER("ERR_09000_FAILED_TO_CONFIGURE_JETTY_SERVER"),
@@ -267,20 +269,44 @@ public enum I18n
// apacheds-installers-maven-plugins errors 11000 - 11999
// apacheds-interceptor-kerberos errors 12000 - 12999
+ ERR_12000_ERROR_ENCODING_ENCRYPTION_KEY("ERR_12000_ERROR_ENCODING_ENCRYPTION_KEY"),
+ ERR_12001_FAILED_TO_AUTHENTICATE_USER("ERR_12001_FAILED_TO_AUTHENTICATE_USER"),
+
// apacheds-interceptors-admin errors 13000 - 13999
+ // No error
+
// apacheds-interceptors-authn errors 14000 - 14999
+ ERR_14000_OPERATION_BY_UNAUTHENTICATED_CALLER("ERR_14000_OPERATION_BY_UNAUTHENTICATED_CALLER"),
+ ERR_14001_AUTHENTICATION_ERROR("ERR_14001_AUTHENTICATION_ERROR"),
+ ERR_14002_ANONYMOUS_BIND_FORBIDDEN("ERR_14002_ANONYMOUS_BIND_FORBIDDEN"),
+ ERR_14003_CANNOT_AUTHENTICATE_USER("ERR_14003_CANNOT_AUTHENTICATE_USER"),
+ ERR_14004_INCORRECT_PASSWORD("ERR_14004_INCORRECT_PASSWORD"),
+ ERR_14005_FAILED_TO_LOOKUP_USER("ERR_14005_FAILED_TO_LOOKUP_USER"),
+
// apacheds-interceptors-authz errors 15000 - 15999
// apacheds-interceptors-changelog errors 16000 - 16999
// apacheds-interceptors-collective errors 17000 - 17999
// apacheds-interceptors-event errors 18000 - 18999
+ // No error
+
// apacheds-interceptors-exception errors 19000 - 19999
// apacheds-interceptors-hash errors 20000 - 20999
+ // No error
+
// apacheds-interceptors-journal errors 21000 - 21999
+ // No error
+
// apacheds-interceptors-logger errors 22000 - 22999
+ // No error
+
// apacheds-interceptors-normalization errors 23000 - 23999
// apacheds-interceptors-number errors 24000 - 24999
+ // No error
+
// apacheds-interceptors-operational errors 25000 - 25999
// apacheds-interceptors-ppolicy errors 26000 - 26999
+ // No error
+
// apacheds-interceptors-referral errors 27000 - 27999
// apacheds-interceptors-schema errors 28000 - 28999
ERR_28000_OBJECT_NOT_FOUND_IN_AT_REGISTRY("ERR_28000_OBJECT_NOT_FOUND_IN_AT_REGISTRY"),
@@ -377,6 +403,8 @@ public enum I18n
ERR_38033_CANNOT_PROCESS_REQUEST_WHILE_BINDING("ERR_38033_CANNOT_PROCESS_REQUEST_WHILE_BINDING"),
// apacheds-protocol-ntp errors 39000 - 39999
+ // No error
+
// apacheds-protocol-shared errors 40000 - 40999
ERR_40000_MORE_THAN_ONE_ENTRY_KERBEROS_PRINCIPAL("ERR_40000_MORE_THAN_ONE_ENTRY_KERBEROS_PRINCIPAL"),
ERR_40001_LDIF_FILE_DOES_NOT_EXIST("ERR_40001_LDIF_FILE_DOES_NOT_EXIST"),
@@ -446,8 +474,6 @@ public enum I18n
ERR_1("ERR_1"),
- ERR_5("ERR_5"),
- ERR_6("ERR_6"),
ERR_7("ERR_7"),
ERR_8("ERR_8"),
ERR_9("ERR_9"),
@@ -514,7 +540,6 @@ public enum I18n
ERR_113_COULD_NOT_DELETE_FILE_OR_DIRECTORY("ERR_113_COULD_NOT_DELETE_FILE_OR_DIRECTORY"),
ERR_115("ERR_115"),
ERR_116("ERR_116"),
- ERR_122("ERR_122"),
ERR_128("ERR_128"),
ERR_135("ERR_135"),
ERR_136("ERR_136"),
@@ -577,10 +602,6 @@ public enum I18n
ERR_223("ERR_223"),
ERR_224("ERR_224"),
ERR_226("ERR_226"),
- ERR_228("ERR_228"),
- ERR_229("ERR_229"),
- ERR_230("ERR_230"),
- ERR_231("ERR_231"),
ERR_232("ERR_232"),
ERR_233("ERR_233"),
ERR_234("ERR_234"),
@@ -656,7 +677,6 @@ public enum I18n
ERR_509("ERR_509"),
ERR_510("ERR_510"),
ERR_511("ERR_511"),
- ERR_512("ERR_512"),
ERR_513("ERR_513"),
ERR_514("ERR_514"),
ERR_515("ERR_515"),
diff --git a/i18n/src/main/resources/org/apache/directory/server/i18n/errors.properties b/i18n/src/main/resources/org/apache/directory/server/i18n/errors.properties
index 20622aa2b6..c1b0558f9a 100644
--- a/i18n/src/main/resources/org/apache/directory/server/i18n/errors.properties
+++ b/i18n/src/main/resources/org/apache/directory/server/i18n/errors.properties
@@ -52,7 +52,6 @@ ERR_01000_SCHEMA_LOAD_FAILED=Schema load failed : {0}
ERR_01001_CANNOT_CREATE_DIRECTORY_SERVICE=Unable to create a DirectoryService instance for unknow reason
ERR_01002_UNSUPPORTED_CHANGE_TYPE=Unsupported changetype found in LDIF: {0}
-
# apacheds-core-api errors 2000 - 2999
ERR_02000_CANNOT_USE_SERIALIZATION_FOR_SERVER_ATTRIBUTE=Cannot use standard serialization for a ServerAttribute
ERR_02001_CANNOT_USE_SERIALIZATION_FOR_SERVER_ENTRY=Cannot use standard serialization for a ServerEntry
@@ -206,6 +205,7 @@ ERR_03018_CANNOT_SET_ORDERED_SET=Cannot set a orderedSet when in singleton mode:
ERR_03019_ALREADY_IN_ORDERED_SET_MODE=Already in ordered set mode.
# apacheds-core-constants errors 4000 - 4999
+# --- no error ---
# apacheds-core-integ errors 5000 - 5999
@@ -233,7 +233,6 @@ ERR_06019_ABJ_AND_ATTRS_ARGS_ARE_NULL=Both obj and attrs args are null. At least
ERR_06020_PARSE_EXCEPTION_ENCOUNTERED=Encountered parse exception while parsing the filter: ''{0}''
ERR_06021_COULD_NOT_PARSE_FILTER=could not parse filter: {0}
-
# apacheds-core-shared errors 7000 - 7999
ERR_07000_CANNOT_DESERIALIZE_ENTRY=Cannot deserialize the entry : {0}
ERR_07001_FAILED_TO_LOG_VERSION=failed to LOG version properties
@@ -245,8 +244,8 @@ ERR_07006_GROUPING_EXCEPTIONS_ON_ROOT_NEXUS=Grouping many exceptions on root nex
ERR_07007_PARTITION_HAS_NO_SUFFIX=The current partition does not have any suffix: {0}
ERR_07008_CANNOT_FIND_PARTITION=Cannot find a partition for {0}
-
# apacheds-http-directory-bridge errors 8000 - 8999
+# --- no error ---
# apacheds-http-integration errors 9000 - 9999
ERR_09000_FAILED_TO_CONFIGURE_JETTY_SERVER=Failed to configure the jetty http server
@@ -258,20 +257,45 @@ ERR_09001_FAILED_TO_CONFIGURE_WEB_APPLICATION=Failed to configure the web applic
# apacheds-installers-maven-plugins errors 11000 - 11999
# apacheds-interceptor-kerberos errors 12000 - 12999
+ERR_12000_ERROR_ENCODING_ENCRYPTION_KEY=Error encoding EncryptionKey.
+ERR_12001_FAILED_TO_AUTHENTICATE_USER=Failed to authenticate user ''{0}''.
+
+
# apacheds-interceptors-admin errors 13000 - 13999
+# --- no error ---
+
# apacheds-interceptors-authn errors 14000 - 14999
+ERR_14000_OPERATION_BY_UNAUTHENTICATED_CALLER=Attempted operation {0} by unauthenticated caller.
+ERR_14001_AUTHENTICATION_ERROR=Authentication error : {0}
+ERR_14002_ANONYMOUS_BIND_FORBIDDEN=Anonymous bind NOT permitted!
+ERR_14003_CANNOT_AUTHENTICATE_USER=Cannot authenticate user {0}
+ERR_14004_INCORRECT_PASSWORD=Password not correct for user ''{0}''
+ERR_14005_FAILED_TO_LOOKUP_USER=Failed to lookup user for authentication: {0}
+
# apacheds-interceptors-authz errors 15000 - 15999
# apacheds-interceptors-changelog errors 16000 - 16999
# apacheds-interceptors-collective errors 17000 - 17999
# apacheds-interceptors-event errors 18000 - 18999
+# --- no error ---
+
# apacheds-interceptors-exception errors 19000 - 19999
# apacheds-interceptors-hash errors 20000 - 20999
+# --- no error ---
+
# apacheds-interceptors-journal errors 21000 - 21999
+# --- no error ---
+
# apacheds-interceptors-logger errors 22000 - 22999
+# --- no error ---
+
# apacheds-interceptors-normalization errors 23000 - 23999
# apacheds-interceptors-number errors 24000 - 24999
+# --- no error ---
+
# apacheds-interceptors-operational errors 25000 - 25999
# apacheds-interceptors-ppolicy errors 26000 - 26999
+# --- no error ---
+
# apacheds-interceptors-referral errors 27000 - 27999
# apacheds-interceptors-schema errors 28000 - 28999
ERR_28000_OBJECT_NOT_FOUND_IN_AT_REGISTRY={0} not found within the attributeType registry
@@ -289,8 +313,6 @@ ERR_31007_CURSOR_REQUIRES_DUPLICATE_KEY_ENABLED=This cursor can only be used wit
ERR_31008_VALE_BASED_AVANCES_NOT_SUPPORTED=Value based advances not supported.
ERR_31009_NULL_VALUE_COMPARATOR=Value comparator must not be null for tables with duplicate keys.
-
-
# apacheds-kerberos-codec errors 32000 - 32999
# apacheds-ldif-partition errors 33000 - 33999
ERR_33000_CANNOT_INITIALIZE_PARTITION_WITH_INVALID_SUFFIX=Cannot initialize a partition without a valid suffix
@@ -370,6 +392,8 @@ ERR_38032_TIME_UNIT_NOT_SUPPORTED=TimeUnit not supported: {0}
ERR_38033_CANNOT_PROCESS_REQUEST_WHILE_BINDING=Cannot process a Request while binding
# apacheds-protocol-ntp errors 39000 - 39999
+# --- no error ---
+
# apacheds-protocol-shared errors 40000 - 40999
ERR_40000_MORE_THAN_ONE_ENTRY_KERBEROS_PRINCIPAL=More than one server entry found for kerberos principal name {0}\:
ERR_40001_LDIF_FILE_DOES_NOT_EXIST=LDIF file does not exist.
@@ -439,8 +463,6 @@ ERR_49045_SCOPE_NODE_NOT_IN_SUBTREE_SCOPE=ScopeNode is not of subtree scope.
ERR_1=Failed to identify OID for: {0}
-ERR_5=Attempted operation {0} by unauthenticated caller.
-ERR_6=Authentication error : {0}
ERR_7=Cannot create a digested password for algorithm ''{0}''
ERR_8=The rootDSE cannot be deleted, moved or renamed!
ERR_9=User ''{0}'' does not have permission to move or rename the admin account. No one not even the admin can del, move or rename {1}!
@@ -529,7 +551,6 @@ ERR_89=NameForm loading NYI
ERR_113_COULD_NOT_DELETE_FILE_OR_DIRECTORY=Could not delete file or directory {0}
ERR_115=Failed to delete the working directory.
ERR_116=Failed to delete\:
-ERR_122=Error encoding EncryptionKey.
# ERR_123=
ERR_128=Failed to identify OID for\:
# ERR_129=
@@ -595,10 +616,6 @@ ERR_222=Cannot call store method: {0}
ERR_223=[36] aliasDereferencingProblem - attempt to create alias to itself.
ERR_224=[36] aliasDereferencingProblem - attempt to create alias with cycle to relative {0} not allowed from descendent alias {1}
ERR_226=[33] aliasProblem - the alias when dereferenced would not name a known object the aliasedObjectName must be set to a valid existing entry.
-ERR_228=Anonymous bind NOT permitted!
-ERR_229=Cannot authenticate user {0}
-ERR_230=Password not correct for user ''{0}''
-ERR_231=Failed to lookup user for authentication: {0}
ERR_232=Unexpected protectedItem: {0}
ERR_233=Unexpected userClass: {0}
ERR_234=The rootDSE cannot be moved or renamed!
@@ -695,7 +712,6 @@ ERR_508=Cannot overwrite, config output directory already exists: {0}
ERR_509=Cannot copy non-existant source file {0}
ERR_510=Should not be hitting root without config/config pattern.
ERR_511=parent cannot be null
-ERR_512=Failed to authenticate user ''{0}''.
ERR_513=Error during underflow [{0}]
ERR_514=Key not found: {0}
ERR_515=BPage not ordered
diff --git a/interceptor-kerberos/src/main/java/org/apache/directory/server/core/kerberos/KeyDerivationInterceptor.java b/interceptor-kerberos/src/main/java/org/apache/directory/server/core/kerberos/KeyDerivationInterceptor.java
index eaa77db2d3..edce297254 100644
--- a/interceptor-kerberos/src/main/java/org/apache/directory/server/core/kerberos/KeyDerivationInterceptor.java
+++ b/interceptor-kerberos/src/main/java/org/apache/directory/server/core/kerberos/KeyDerivationInterceptor.java
@@ -314,7 +314,7 @@ public class KeyDerivationInterceptor extends BaseInterceptor
if ( userEntry == null )
{
- throw new LdapAuthenticationException( I18n.err( I18n.ERR_512, principalDn ) );
+ throw new LdapAuthenticationException( I18n.err( I18n.ERR_12001_FAILED_TO_AUTHENTICATE_USER, principalDn ) );
}
if ( !( ( ClonedServerEntry ) userEntry ).getOriginalEntry().contains(
@@ -442,8 +442,8 @@ public class KeyDerivationInterceptor extends BaseInterceptor
}
catch ( EncoderException ioe )
{
- LOG.error( I18n.err( I18n.ERR_122 ), ioe );
- LOG_KRB.error( I18n.err( I18n.ERR_122 ), ioe );
+ LOG.error( I18n.err( I18n.ERR_12000_ERROR_ENCODING_ENCRYPTION_KEY ), ioe );
+ LOG_KRB.error( I18n.err( I18n.ERR_12000_ERROR_ENCODING_ENCRYPTION_KEY ), ioe );
}
}
diff --git a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AnonymousAuthenticator.java b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AnonymousAuthenticator.java
index a681412fec..8335faa4b2 100644
--- a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AnonymousAuthenticator.java
+++ b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AnonymousAuthenticator.java
@@ -87,7 +87,7 @@ public class AnonymousAuthenticator extends AbstractAuthenticator
else
{
LOG.info( "Cannot authenticate as anonymous, the server does not allow it" );
- throw new LdapNoPermissionException( I18n.err( I18n.ERR_228 ) );
+ throw new LdapNoPermissionException( I18n.err( I18n.ERR_14002_ANONYMOUS_BIND_FORBIDDEN ) );
}
}
}
diff --git a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AuthenticationInterceptor.java b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AuthenticationInterceptor.java
index 0b0c6ecdc5..f413f59b4e 100644
--- a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AuthenticationInterceptor.java
+++ b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/AuthenticationInterceptor.java
@@ -727,7 +727,7 @@ public class AuthenticationInterceptor extends BaseInterceptor
}
String upDn = bindDn == null ? "" : bindDn.getName();
- throw new LdapAuthenticationException( I18n.err( I18n.ERR_229, upDn ) );
+ throw new LdapAuthenticationException( I18n.err( I18n.ERR_14003_CANNOT_AUTHENTICATE_USER, upDn ) );
}
else if ( policyConfig != null )
{
@@ -1416,7 +1416,7 @@ public class AuthenticationInterceptor extends BaseInterceptor
if ( operation.getSession().isAnonymous() && !directoryService.isAllowAnonymousAccess()
&& !operation.getDn().isEmpty() )
{
- String msg = I18n.err( I18n.ERR_5, operation.getName() );
+ String msg = I18n.err( I18n.ERR_14000_OPERATION_BY_UNAUTHENTICATED_CALLER, operation.getName() );
LOG.error( msg );
throw new LdapNoPermissionException( msg );
}
diff --git a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/DelegatingAuthenticator.java b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/DelegatingAuthenticator.java
index f9ce77b96b..856f329268 100644
--- a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/DelegatingAuthenticator.java
+++ b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/DelegatingAuthenticator.java
@@ -315,7 +315,7 @@ public class DelegatingAuthenticator extends AbstractAuthenticator
}
catch ( LdapException le )
{
- String message = I18n.err( I18n.ERR_230, bindDn.getName() );
+ String message = I18n.err( I18n.ERR_14004_INCORRECT_PASSWORD, bindDn.getName() );
LOG.info( message );
throw new LdapAuthenticationException( message );
}
@@ -350,7 +350,7 @@ public class DelegatingAuthenticator extends AbstractAuthenticator
catch ( LdapException e )
{
// Bad password ...
- String message = I18n.err( I18n.ERR_230, bindDn.getName() );
+ String message = I18n.err( I18n.ERR_14004_INCORRECT_PASSWORD, bindDn.getName() );
LOG.info( message );
throw new LdapAuthenticationException( message );
}
diff --git a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/SimpleAuthenticator.java b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/SimpleAuthenticator.java
index 007775ac11..3b00828325 100644
--- a/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/SimpleAuthenticator.java
+++ b/interceptors/authn/src/main/java/org/apache/directory/server/core/authn/SimpleAuthenticator.java
@@ -252,7 +252,7 @@ public class SimpleAuthenticator extends AbstractAuthenticator
}
// Bad password ...
- String message = I18n.err( I18n.ERR_230, bindContext.getDn().getName() );
+ String message = I18n.err( I18n.ERR_14004_INCORRECT_PASSWORD, bindContext.getDn().getName() );
LOG.info( message );
throw new LdapAuthenticationException( message );
}
@@ -297,12 +297,12 @@ public class SimpleAuthenticator extends AbstractAuthenticator
Dn dn = bindContext.getDn();
String upDn = dn == null ? "" : dn.getName();
- throw new LdapAuthenticationException( I18n.err( I18n.ERR_231, upDn ) );
+ throw new LdapAuthenticationException( I18n.err( I18n.ERR_14005_FAILED_TO_LOOKUP_USER, upDn ) );
}
}
catch ( Exception cause )
{
- LOG.error( I18n.err( I18n.ERR_6, cause.getLocalizedMessage() ) );
+ LOG.error( I18n.err( I18n.ERR_14001_AUTHENTICATION_ERROR, cause.getLocalizedMessage() ) );
LdapAuthenticationException e = new LdapAuthenticationException( cause.getLocalizedMessage() );
e.initCause( cause );
throw e;