You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@causeway.apache.org by da...@apache.org on 2023/07/03 06:18:46 UTC
[causeway] 01/01: CAUSEWAY-3513: removes shiro-realm-ldap
This is an automated email from the ASF dual-hosted git repository.
danhaywood pushed a commit to branch CAUSEWAY-3513
in repository https://gitbox.apache.org/repos/asf/causeway.git
commit 828c227330ca125cafaff184f8141116eac4bfa3
Author: danhaywood <da...@haywood-associates.co.uk>
AuthorDate: Mon Jul 3 07:18:29 2023 +0100
CAUSEWAY-3513: removes shiro-realm-ldap
---
.../realm/impl/CausewayLdapContextFactory.adoc | 18 -
.../realm/impl/CausewayLdapRealm.adoc | 114 -----
.../impl/CausewayModuleExtShiroRealmLdapImpl.adoc | 12 -
.../ROOT/pages/2023/2.0.0-RC2/mignotes.adoc | 23 +-
bom/pom.xml | 16 -
causeway-tooling.yml | 1 -
core/adoc/modules/_overview/pages/about.adoc | 95 ++---
extensions/pom.xml | 1 -
.../security/shiro-realm-ldap/adoc/antora.yml | 19 -
.../modules/shiro-realm-ldap/examples/shiro.ini | 61 ---
.../images/010-create-first-page-of-wizard.png | Bin 51432 -> 0 bytes
.../images/020-create-inetOrgPerson.png | Bin 101837 -> 0 bytes
.../images/030-create-inetOrgPerson.png | Bin 56701 -> 0 bytes
.../images/040-create-inetOrgPerson.png | Bin 79004 -> 0 bytes
.../images/050-create-inetOrgPerson.png | Bin 49191 -> 0 bytes
.../images/060-create-inetOrgPerson.png | Bin 50242 -> 0 bytes
.../shiro-realm-ldap/images/070-test-sasl.png | Bin 88415 -> 0 bytes
.../shiro-realm-ldap/images/080-test-sasl.org | Bin 83340 -> 0 bytes
.../shiro-realm-ldap/images/090-test-sasl.org | Bin 33876 -> 0 bytes
.../images/110-groupOfUniqueNames.png | Bin 99009 -> 0 bytes
.../images/120-groupOfUniqueNames.png | Bin 57118 -> 0 bytes
.../images/130-groupOfUniqueNames.png | Bin 77716 -> 0 bytes
.../images/ldap-server-sasl-configuration.png | Bin 150071 -> 0 bytes
.../images/old/activeds-ldap-groups.png | Bin 128224 -> 0 bytes
.../images/old/activeds-ldap-mojo-partition.png | Bin 123256 -> 0 bytes
.../images/old/activeds-ldap-mojo-root-dse.png | Bin 113723 -> 0 bytes
.../old/activeds-ldap-sasl-authentication.png | Bin 119544 -> 0 bytes
.../images/old/activeds-ldap-users.png | Bin 123030 -> 0 bytes
.../configure-shiro-to-use-causeway-ldap-realm.png | Bin 32310 -> 0 bytes
.../shiro-realm-ldap/images/open-configuration.png | Bin 25317 -> 0 bytes
.../adoc/modules/shiro-realm-ldap/nav.adoc | 4 -
.../adoc/modules/shiro-realm-ldap/pages/about.adoc | 196 ---------
.../modules/shiro-realm-ldap/pages/ldap-realm.adoc | 145 -------
.../shiro-realm-ldap/partials/module-nav.adoc | 4 -
extensions/security/shiro-realm-ldap/impl/pom.xml | 52 ---
.../realm/impl/CausewayLdapContextFactory.java | 60 ---
.../realm/impl/CausewayLdapRealm.java | 467 ---------------------
.../impl/CausewayModuleExtShiroRealmLdapImpl.java | 38 --
extensions/security/shiro-realm-ldap/pom.xml | 42 --
regressiontests/incubating/pom.xml | 8 +-
.../causeway/testdomain/shiro/ShiroLdapTest.java | 152 -------
.../incubating/src/test/resources/shiro-ldap.ini | 61 ---
regressiontests/pom.xml | 6 -
.../tooling-cli/examples/causeway-tooling.yml | 1 -
.../causeway/tooling/cli/test/causeway-tooling.yml | 1 -
45 files changed, 49 insertions(+), 1548 deletions(-)
diff --git a/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayLdapContextFactory.adoc b/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayLdapContextFactory.adoc
deleted file mode 100644
index 296304449f..0000000000
--- a/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayLdapContextFactory.adoc
+++ /dev/null
@@ -1,18 +0,0 @@
-= CausewayLdapContextFactory
-:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
-
-An extension of _JndiLdapContextFactory_ that allows a different authentication mechanism for system-level authentications (as used by authorization lookups, for example) compared to regular authentication.
-
-See xref:refguide:extensions:index/shirorealmldap/realm/impl/CausewayLdapRealm.adoc[CausewayLdapRealm] for typical configuration within `shiro.ini` .
-
-== API
-
-[source,java]
-.CausewayLdapContextFactory.java
-----
-class CausewayLdapContextFactory {
- String getSystemAuthenticationMechanism()
- void setSystemAuthenticationMechanism(String systemAuthenticationMechanism)
-}
-----
-
diff --git a/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayLdapRealm.adoc b/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayLdapRealm.adoc
deleted file mode 100644
index 064beabec5..0000000000
--- a/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayLdapRealm.adoc
+++ /dev/null
@@ -1,114 +0,0 @@
-= CausewayLdapRealm
-:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
-
-Implementation of _org.apache.shiro.realm.ldap.JndiLdapRealm_ that also returns each user's groups.
-
-Sample config for `shiro.ini` :
-
-----
-
-contextFactory = org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapContextFactory
-contextFactory.url = ldap://localhost:10389
-contextFactory.authenticationMechanism = CRAM-MD5
-contextFactory.systemAuthenticationMechanism = simple
-contextFactory.systemUsername = uid=admin,ou=system
-contextFactory.systemPassword = secret
-
-ldapRealm = org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapRealm
-ldapRealm.contextFactory = $contextFactory
-
-ldapRealm.searchBase = ou=groups,o=mojo
-ldapRealm.groupObjectClass = groupOfUniqueNames
-ldapRealm.uniqueMemberAttribute = uniqueMember
-ldapRealm.uniqueMemberAttributeValueTemplate = uid={0}
-
-ldapRealm.searchUserBase = ou=users,o=mojo
-ldapRealm.userObjectClass=inetOrgPerson
-ldapRealm.groupExtractedAttribute=street,country
-ldapRealm.userExtractedAttribute=street,country
-ldapRealm.permissionByGroupAttribute=attribute:Folder.{street}:Read,attribute:Portfolio.{country}
-ldapRealm.permissionByUserAttribute=attribute:Folder.{street}:Read,attribute:Portfolio.{country}
-
-# optional mapping from physical groups to logical application roles
-ldapRealm.rolesByGroup = \
- LDN_USERS: user_role,\
- NYK_USERS: user_role,\
- HKG_USERS: user_role,\
- GLOBAL_ADMIN: admin_role,\
- DEMOS: self-install_role
-
-securityManager.realms = $ldapRealm
-----
-
-The permissions for each role can be specified using the _#setResourcePath(String)_ to an 'ini' file with a [roles] section, eg:
-
-----
-
-ldapRealm.resourcePath=classpath:webapp/myroles.ini
-----
-
-where `myroles.ini` is in `src/main/resources/webapp` , and takes the form:
-
-----
-
-[roles]
-user_role = *:ToDoItemsJdo:*:*,\
- *:ToDoItem:*:*
-self-install_role = *:ToDoItemsFixturesService:install:*
-admin_role = *
-----
-
-This 'ini' file can then be referenced by other realms (if multiple realm are configured with the Shiro security manager).
-
-Alternatively, permissions can be extracted from the base itself with the parameter searchUserBase, the attribute list as userExtractedAttribute and the permission url as permissionByUserAttribute. The idea is to extract attribute from the user or the group of the user and map directly to permission rule in replacing the string {attribute} by the extracted attribute (can me multiple). See the sample for group and user attribute and mapping.
-
-== API
-
-[source,java]
-.CausewayLdapRealm.java
-----
-class CausewayLdapRealm {
- CausewayLdapRealm()
- void setSearchBase(String searchBase)
- void setGroupObjectClass(String groupObjectClassAttribute)
- void setUniqueMemberAttribute(String uniqueMemberAttribute)
- void setUniqueMemberAttributeValueTemplate(String template)
- void setRolesByGroup(Map<String, String> rolesByGroup)
- void setResourcePath(String resourcePath) // <.>
- void setPermissionByUserAttribute(String permissionByUserAttr)
- void setPermissionByGroupAttribute(String permissionByGroupAttribute)
- void setUserExtractedAttribute(String userExtractedAttribute)
- void setGroupExtractedAttribute(String groupExtractedAttribute)
- void setSearchUserBase(String searchUserBase)
- void setUserObjectClass(String userObjectClass)
- void setCnAttribute(String cnAttribute)
-}
-----
-
-<.> xref:#setResourcePath_String[setResourcePath(String)]
-+
---
-
---
-
-== Members
-
-[#setResourcePath_String]
-=== setResourcePath(String)
-
-----
-
-ldapRealm.resourcePath=classpath:webapp/myroles.ini
-----
-
-where `myroles.ini` is in `src/main/resources/webapp` , and takes the form:This 'ini' file can then be referenced by other realms (if multiple realm are configured with the Shiro security manager).
-
-----
-
-[roles]
-user_role = *:ToDoItemsJdo:*:*,\
- *:ToDoItem:*:*
-self-install_role = *:ToDoItemsFixturesService:install:*
-admin_role = *
-----
-
diff --git a/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayModuleExtShiroRealmLdapImpl.adoc b/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayModuleExtShiroRealmLdapImpl.adoc
deleted file mode 100644
index 7ed6b9cd53..0000000000
--- a/antora/components/refguide-index/modules/extensions/pages/index/shirorealmldap/realm/impl/CausewayModuleExtShiroRealmLdapImpl.adoc
+++ /dev/null
@@ -1,12 +0,0 @@
-= CausewayModuleExtShiroRealmLdapImpl
-:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
-
-== API
-
-[source,java]
-.CausewayModuleExtShiroRealmLdapImpl.java
-----
-class CausewayModuleExtShiroRealmLdapImpl {
-}
-----
-
diff --git a/antora/components/relnotes/modules/ROOT/pages/2023/2.0.0-RC2/mignotes.adoc b/antora/components/relnotes/modules/ROOT/pages/2023/2.0.0-RC2/mignotes.adoc
index 177a54d53f..de64af237b 100644
--- a/antora/components/relnotes/modules/ROOT/pages/2023/2.0.0-RC2/mignotes.adoc
+++ b/antora/components/relnotes/modules/ROOT/pages/2023/2.0.0-RC2/mignotes.adoc
@@ -9,24 +9,31 @@ This page will be added to as development progresses.
=== Removed
* `ActionLayout#bookmarking` ... had conflicting semantics with `DomainObjectLayout#bookmarking`,
-that is, if the latter was present on an Action's return type, hence removed
+that is, if the latter was present on an Action's return type, hence removed.
++
+(Also, originally the intent was for action prompts to be bookmarked, but this was never implemented).
+
+* The `causeway-extensions-shiro-realm-ldap` extension has been removed.
++
+This extension extended Shiro's own `DefaultLdapRealm` realm to provide support for authorisation (statically defined in the `shiro.ini` file).
+Instead, use Shiro's own `DefaultLdapRealm` but configure with some other authorisation mechanism, eg Secman.
=== Marked Deprecated for Removal
* `Action#hidden` ... use `ActionLayout#hidden` instead
* `Collection#hidden` ... use `CollectionLayout#hidden` instead
* `Property#hidden` ... use `PropertyLayout#hidden` instead
-Parameter support method `validateNXxx(...)` is now supported to only have a single argument,
-namely the parameter, that is subject to validation.
+Parameter support method `validateNXxx(...)` is now supported to only have a single argument,
+namely the parameter, that is subject to validation.
[WARNING]
====
This may potentially change behavior
-for cases when the action's first and the n-th parameter
-are the same type and
-given a single argument parameter support method with same type also,
-then previously it interpreted the support to be associated with
-the first parameter, while now it will interpret the support to be
+for cases when the action's first and the n-th parameter
+are the same type and
+given a single argument parameter support method with same type also,
+then previously it interpreted the support to be associated with
+the first parameter, while now it will interpret the support to be
associated with the n-th parameter. (using _n_ as 1-based here)
====
diff --git a/bom/pom.xml b/bom/pom.xml
index c6271890ee..317f60b97e 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -1075,22 +1075,6 @@ It is therefore a copy of org.apache:apache, with customisations clearly identif
<scope>compile</scope>
</dependency>
- <!-- org.apache.causeway.extensions (shiro) -->
- <dependency>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions-shiro-realm-ldap</artifactId>
- <version>2.0.0-SNAPSHOT</version>
- <type>pom</type>
- <scope>compile</scope>
- </dependency>
- <dependency>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions-shiro-realm-ldap-impl</artifactId>
- <version>2.0.0-SNAPSHOT</version>
- <type>jar</type>
- <scope>compile</scope>
- </dependency>
-
<!-- org.apache.causeway.extensions (spring security) -->
<dependency>
<groupId>org.apache.causeway.extensions</groupId>
diff --git a/causeway-tooling.yml b/causeway-tooling.yml
index 07a43727c4..2e39503a00 100644
--- a/causeway-tooling.yml
+++ b/causeway-tooling.yml
@@ -64,7 +64,6 @@ commands:
"Security: Audit Trail": "org.apache.causeway.security:causeway-extensions-audittrail.*"
"Security: Secman": "org.apache.causeway.security:causeway-extensions-secman.*"
"Security: Session Log": "org.apache.causeway.security:causeway-extensions-sessionlog.*"
- "Security: Shiro LDAP Realm": "org.apache.causeway.security:causeway-extensions-shiro-realm-ldap.*"
"Security: Spring Oauth2": "org.apache.causeway.security:causeway-extensions-spring-security-oauth2.*"
"RO Viewer: CORS": "org.apache.causeway.security:causeway-extensions-cors.*"
"Wicket Viewer: Excel Download": "org.apache.causeway.security:causeway-extensions-exceldownload.*"
diff --git a/core/adoc/modules/_overview/pages/about.adoc b/core/adoc/modules/_overview/pages/about.adoc
index 826b8b333e..ef8748a2d3 100644
--- a/core/adoc/modules/_overview/pages/about.adoc
+++ b/core/adoc/modules/_overview/pages/about.adoc
@@ -43,7 +43,7 @@ rectangle "App\n<size:10>[Software System]</size>" <<App>> {
.Projects/Modules (App)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Starter Parent
[source,yaml]
@@ -105,7 +105,7 @@ Mavendeps.ApacheCausewayMavenDeps .[#707070,thickness=2].> Mavendeps.ApacheCause
.Projects/Modules (Mavendeps)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Maven Deps
[source,yaml]
@@ -326,7 +326,7 @@ Testing.ApacheCausewayTstUnitTestSupportparent .[#707070,thickness=2].> Testing.
.Projects/Modules (Testing)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Testing
[source,yaml]
@@ -728,7 +728,7 @@ Root.ApacheCausewayAggregator .[#707070,thickness=2].> Root.ApacheCauseway : "<c
.Projects/Modules (Root)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway (Aggregator)
[source,yaml]
@@ -818,7 +818,7 @@ rectangle "Commons\n<size:10>[Software System]</size>" <<Commons>> {
.Projects/Modules (Commons)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Commons
[source,yaml]
@@ -1001,7 +1001,7 @@ Core.ApacheCausewayCore .[#707070,thickness=2].> Core.ApacheCausewayApiSchemas :
.Projects/Modules (Core)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Core
[source,yaml]
@@ -1513,7 +1513,7 @@ rectangle "Persistence\n<size:10>[Software System]</size>" <<Persistence>> {
.Projects/Modules (Persistence)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Persistence - Commons
[source,yaml]
@@ -1633,7 +1633,7 @@ JDO.ApacheCausewayPersistenceJDO .[#707070,thickness=2].> JDO.ApacheCausewayPers
.Projects/Modules (JDO)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Persistence - JDO
[source,yaml]
@@ -1887,7 +1887,7 @@ JPA.ApacheCausewayPersistenceJPA .[#707070,thickness=2].> JPA.ApacheCausewayPers
.Projects/Modules (JPA)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Persistence - JPA
[source,yaml]
@@ -2040,7 +2040,7 @@ rectangle "Bypass\n<size:10>[Software System]</size>" <<Bypass>> {
.Projects/Modules (Bypass)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Security - Bypass
[source,yaml]
@@ -2107,7 +2107,7 @@ rectangle "Keycloak\n<size:10>[Software System]</size>" <<Keycloak>> {
.Projects/Modules (Keycloak)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Security - Keycloak
[source,yaml]
@@ -2183,7 +2183,7 @@ rectangle "Shiro\n<size:10>[Software System]</size>" <<Shiro>> {
.Projects/Modules (Shiro)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Security - Shiro
[source,yaml]
@@ -2258,7 +2258,7 @@ rectangle "Spring\n<size:10>[Software System]</size>" <<Spring>> {
.Projects/Modules (Spring)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Security - Spring
[source,yaml]
@@ -2367,7 +2367,7 @@ Common.ApacheCausewayViewerCommons .[#707070,thickness=2].> Common.ApacheCausewa
.Projects/Modules (Common)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Viewer - Commons
[source,yaml]
@@ -2541,7 +2541,7 @@ RestfulObjects.ApacheCausewayViewerRO .[#707070,thickness=2].> RestfulObjects.Ap
.Projects/Modules (Restful Objects)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Viewer - RO
[source,yaml]
@@ -2797,7 +2797,7 @@ Wicket.ApacheCausewayViewerWicket .[#707070,thickness=2].> Wicket.ApacheCauseway
.Projects/Modules (Wicket)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Viewer - Wicket
[source,yaml]
@@ -3017,7 +3017,7 @@ Valuetypes.ApacheCausewayValJodaTimeparent .[#707070,thickness=2].> Valuetypes.A
.Projects/Modules (Valuetypes)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Value types
[source,yaml]
@@ -3182,7 +3182,7 @@ Asciidoc.ApacheCausewayValAsciidoctorparent .[#707070,thickness=2].> Asciidoc.Ap
.Projects/Modules (Asciidoc)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Val - Asciidoctor (parent)
[source,yaml]
@@ -3414,7 +3414,7 @@ Markdown.ApacheCausewayValMarkdownparent .[#707070,thickness=2].> Markdown.Apach
.Projects/Modules (Markdown)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Val - Markdown (parent)
[source,yaml]
@@ -3639,7 +3639,7 @@ Vega.ApacheCausewayValVegaparent .[#707070,thickness=2].> Vega.ApacheCausewayVal
.Projects/Modules (Vega)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Val - Vega (parent)
[source,yaml]
@@ -4109,7 +4109,7 @@ Extensions.ApacheCausewayExtServerSentEventsparent .[#707070,thickness=2].> Exte
.Projects/Modules (Extensions)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Extensions
[source,yaml]
@@ -4762,35 +4762,6 @@ org.apache.causeway.testing:causeway-testing-fixtures-applib:jar:<managed> +
org.apache.causeway.testing:causeway-testing-integtestsupport-applib:jar:<managed> +
****
-|Apache Causeway Ext - Security - Shiro LDAP Realm (parent)
-[source,yaml]
-----
-Group: org.apache.causeway.extensions
-Artifact: causeway-extensions-shiro-realm-ldap
-Type: pom
-Directory: /extensions/security/shiro-realm-ldap
-----
-|Implementation of Shiro Realm using LDAP.
-
-|Apache Causeway Ext - Security - Shiro LDAP Realm (impl)
-[source,yaml]
-----
-Group: org.apache.causeway.extensions
-Artifact: causeway-extensions-shiro-realm-ldap-impl
-Type: jar
-Directory: /extensions/security/shiro-realm-ldap/impl
-----
-|.Dependencies
-****
-org.apache.causeway.core:causeway-core-internaltestsupport:jar:<managed> +
-org.apache.causeway.security:causeway-security-shiro:jar:<managed> +
-****
-
-.Document Index Entries
-****
-xref:refguide:extensions:index/shirorealmldap/realm/impl/CausewayLdapContextFactory.adoc[CausewayLdapContextFactory], xref:refguide:extensions:index/shirorealmldap/realm/impl/CausewayLdapRealm.adoc[CausewayLdapRealm], xref:refguide:extensions:index/shirorealmldap/realm/impl/CausewayModuleExtShiroRealmLdapImpl.adoc[CausewayModuleExtShiroRealmLdapImpl]
-****
-
|Apache Causeway Ext - Security - Spring Oauth2
[source,yaml]
----
@@ -4982,7 +4953,7 @@ ApplibExcel.ApacheCausewayExtExcelparent .[#707070,thickness=2].> ApplibExcel.Ap
.Projects/Modules (Applib: Excel)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Excel (parent)
[source,yaml]
@@ -5180,7 +5151,7 @@ CoreCommandLog.ApacheCausewayExtCommandLog .[#707070,thickness=2].> CoreCommandL
.Projects/Modules (Core: Command Log)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Command Log
[source,yaml]
@@ -5322,7 +5293,7 @@ rectangle "Core: DocGen\n<size:10>[Software System]</size>" <<CoreDocGen>> {
.Projects/Modules (Core: DocGen)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Docgen
[source,yaml]
@@ -5418,7 +5389,7 @@ CoreExecutionLog.ApacheCausewayExtExecutionLog .[#707070,thickness=2].> CoreExec
.Projects/Modules (Core: Execution Log)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Execution Log
[source,yaml]
@@ -5588,7 +5559,7 @@ CoreExecutionOutbox.ApacheCausewayExtExecutionOutbox .[#707070,thickness=2].> Co
.Projects/Modules (Core: Execution Outbox)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Execution Outbox
[source,yaml]
@@ -5763,7 +5734,7 @@ CoreExecutionRepublisher.ApacheCausewayExtExecutionRepublisher .[#707070,thickne
.Projects/Modules (Core: Execution Republisher)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Execution Republisher
[source,yaml]
@@ -5846,7 +5817,7 @@ CoreFlyway.ApacheCausewayExtFlyway .[#707070,thickness=2].> CoreFlyway.ApacheCau
.Projects/Modules (Core: Flyway)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Flyway
[source,yaml]
@@ -5992,7 +5963,7 @@ Tooling.ApacheCausewayTooling .[#707070,thickness=2].> Tooling.ApacheCausewayToo
.Projects/Modules (Tooling)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway - Tooling
[source,yaml]
@@ -6366,7 +6337,7 @@ RegressionTests.ApacheCausewayRegressionTestsstableCmdExecAuditSession .[#707070
.Projects/Modules (Regression Tests)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway - Regression Tests
[source,yaml]
@@ -6803,7 +6774,7 @@ rectangle "Incubator\n<size:10>[Software System]</size>" <<Incubator>> {
.Projects/Modules (Incubator)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Incubator
[source,yaml]
@@ -6890,7 +6861,7 @@ GraphQLViewer.ApacheCausewayIncViewerGraphQL .[#707070,thickness=2].> GraphQLVie
.Projects/Modules (GraphQL Viewer)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Inc - Viewer GraphQL
[source,yaml]
@@ -7025,7 +6996,7 @@ Other.ApacheCausewayExtCommandReplay .[#707070,thickness=2].> Other.ApacheCausew
.Projects/Modules (Other)
[cols="3a,5a", options="header"]
|===
-|Coordinates |Description
+|Coordinates |Description
|Apache Causeway Ext - Command Replay
[source,yaml]
diff --git a/extensions/pom.xml b/extensions/pom.xml
index 75b665b63c..f1698233be 100644
--- a/extensions/pom.xml
+++ b/extensions/pom.xml
@@ -101,7 +101,6 @@
<module>security/audittrail</module>
<module>security/secman</module>
- <module>security/shiro-realm-ldap</module>
<module>security/spring-oauth2</module>
<module>security/sessionlog</module>
diff --git a/extensions/security/shiro-realm-ldap/adoc/antora.yml b/extensions/security/shiro-realm-ldap/adoc/antora.yml
deleted file mode 100644
index 2be11515fd..0000000000
--- a/extensions/security/shiro-realm-ldap/adoc/antora.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-name: security
-version: latest
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/examples/shiro.ini b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/examples/shiro.ini
deleted file mode 100644
index 745a6b41bb..0000000000
--- a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/examples/shiro.ini
+++ /dev/null
@@ -1,61 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-#tag::example[]
-[main]
-contextFactory = \
- org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapContextFactory # <.>
-contextFactory.systemAuthenticationMechanism = simple # <.>
-contextFactory.url = ldap://localhost:10389 # <.>
-contextFactory.systemUsername = uid=admin,ou=system # <3>
-contextFactory.systemPassword = secret # <3>
-contextFactory.authenticationMechanism = CRAM-MD5 # <.>
-
-ldapRealm = \
- org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapRealm # <.>
-
-ldapRealm.contextFactory = $contextFactory # <.>
-
-#end::example[]
-
-#tag::groups[]
-ldapRealm.groupObjectClass = groupOfUniqueNames # <.>
-ldapRealm.uniqueMemberAttribute = uniqueMember # <2>
-ldapRealm.uniqueMemberAttributeValueTemplate = uid={0} # <2>
-ldapRealm.searchBase = ou=users,ou=system # <.>
-
-# (optional) mapping from physical groups to logical application roles
-ldapRealm.rolesByGroup = \ # <.>
- LDN_USERS: user_role,\
- NYK_USERS: user_role,\
- HKG_USERS: user_role,\
- GLOBAL_ADMIN: admin_role,\
- DEMOS: self-install_role
-
-ldapRealm.permissionsByRole=\ # <.>
- user_role = *:SimpleObjectMenu:*:*,\
- *:SimpleObject:*:*; \
- self-install_role = *:FixtureScriptsDefault:*:* ; \
- admin_role = *
-#end::groups[]
-
-#tag::example[]
-securityManager.realms = $ldapRealm # <.>
-
-[users]
-[roles]
-#end::example[]
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/010-create-first-page-of-wizard.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/010-create-first-page-of-wizard.png
deleted file mode 100644
index 41778a77ae..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/010-create-first-page-of-wizard.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/020-create-inetOrgPerson.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/020-create-inetOrgPerson.png
deleted file mode 100644
index 291725a856..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/020-create-inetOrgPerson.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/030-create-inetOrgPerson.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/030-create-inetOrgPerson.png
deleted file mode 100644
index 4e9ef59585..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/030-create-inetOrgPerson.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/040-create-inetOrgPerson.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/040-create-inetOrgPerson.png
deleted file mode 100644
index 3ec249e2a6..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/040-create-inetOrgPerson.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/050-create-inetOrgPerson.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/050-create-inetOrgPerson.png
deleted file mode 100644
index 8972648325..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/050-create-inetOrgPerson.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/060-create-inetOrgPerson.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/060-create-inetOrgPerson.png
deleted file mode 100644
index 27b8fcbd28..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/060-create-inetOrgPerson.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/070-test-sasl.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/070-test-sasl.png
deleted file mode 100644
index a195a23e89..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/070-test-sasl.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/080-test-sasl.org b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/080-test-sasl.org
deleted file mode 100644
index e2c72e59b3..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/080-test-sasl.org and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/090-test-sasl.org b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/090-test-sasl.org
deleted file mode 100644
index 3fee0bb144..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/090-test-sasl.org and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/110-groupOfUniqueNames.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/110-groupOfUniqueNames.png
deleted file mode 100644
index 564a8a9418..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/110-groupOfUniqueNames.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/120-groupOfUniqueNames.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/120-groupOfUniqueNames.png
deleted file mode 100644
index 794bbb613f..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/120-groupOfUniqueNames.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/130-groupOfUniqueNames.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/130-groupOfUniqueNames.png
deleted file mode 100644
index 7843f6bffb..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/130-groupOfUniqueNames.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/ldap-server-sasl-configuration.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/ldap-server-sasl-configuration.png
deleted file mode 100644
index d964f33a3a..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/ldap-server-sasl-configuration.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-groups.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-groups.png
deleted file mode 100644
index 0496a8416b..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-groups.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-mojo-partition.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-mojo-partition.png
deleted file mode 100644
index 42d748093e..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-mojo-partition.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-mojo-root-dse.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-mojo-root-dse.png
deleted file mode 100644
index 9c4c480031..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-mojo-root-dse.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-sasl-authentication.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-sasl-authentication.png
deleted file mode 100644
index 91d1a61c13..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-sasl-authentication.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-users.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-users.png
deleted file mode 100644
index 7ff133c8e2..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/activeds-ldap-users.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/configure-shiro-to-use-causeway-ldap-realm.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/configure-shiro-to-use-causeway-ldap-realm.png
deleted file mode 100644
index 2a52910b76..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/old/configure-shiro-to-use-causeway-ldap-realm.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/open-configuration.png b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/open-configuration.png
deleted file mode 100644
index 3b87938ccb..0000000000
Binary files a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/images/open-configuration.png and /dev/null differ
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/nav.adoc b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/nav.adoc
deleted file mode 100644
index ae4837e12f..0000000000
--- a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/nav.adoc
+++ /dev/null
@@ -1,4 +0,0 @@
-
-:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
-
-include::security:ROOT:partial$component-nav.adoc[]
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/pages/about.adoc b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/pages/about.adoc
deleted file mode 100644
index f23109f39d..0000000000
--- a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/pages/about.adoc
+++ /dev/null
@@ -1,196 +0,0 @@
-= LDAP Realm for Shiro
-
-:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
-
-
-
-The Shiro framework ships with an implementation of an LDAP-based realm which is typically be used for authentication (users/password).
-
-Apache Causeway extends Shiro's implementation this `CausewayLdapRealm`, which provides more flexibility for both group/role and role/permissions management.
-
-
-== Setup
-
-=== Dependency Management
-
-In your application's top level `pom.xml`, add a dependency for this module's own bill of materials (BOM):
-
-[source,xml,subs="attributes+"]
-.pom.xml
-----
-<dependencyManagement>
- <dependencies>
- <dependency>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions-shiro-realm-ldap</artifactId>
- <scope>import</scope>
- <type>pom</type>
- <version>{page-causewayrel}</version>
- </dependency>
- </dependencies>
-</dependencyManagement>
-----
-
-
-=== Dependencies / Imports
-
-In your application's xref:userguide::modules.adoc#appmanifest[App Manifest], import the implementation module of this extension:
-
-* add this dependency to your webapp's `pom.xml`:
-+
-[source,xml,subs="attributes+"]
-.pom.xml
-----
-<dependencies>
- ...
- <dependency>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions-shiro-realm-ldap-impl</artifactId>
- </dependency>
- ...
-</dependencies>
-----
-
-* and `@Import` this module to your app manifest:
-+
-[source,java]
-.MyAppManifest.java
-----
-@Configuration
-@Import({
- CausewayModuleExtShiroRealmLdapImpl.class,
- // ...
-})
-public class MyAppManifest { ... }
-----
-
-
-== Configuration
-
-[source,properties]
-----
-include::security:shiro-realm-ldap:example$shiro.ini[tags=example]
-----
-<.> declares the framework-provided subclass of Shiro's `org.apache.shiro.realm.ldap.JndiLdapContextFactory`.
-<.> Specifies the the "java.naming.security.authentication" context programmatically.
-<.> the URL and credentials for querying the LDAP store
-<.> indicates to use xref:https://docs.oracle.com/javase/jndi/tutorial/ldap/security/crammd5.html[CRAM-MD5]; this will depend on the capability of the LDAP server being provided.
-<.> declares the framework-provided subclass of Shiro's `org.apache.shiro.realm.ldap.DefaultLdapRealm`.
-<.> Injects the `contextFactory` object into the `ldapRealm` object ...
-<.> \... and injects the `ldapRealm` into Shiro's in-built security manager.
-
-
-== Testing with ApacheDS and Apache Directory Studio
-
-WARNING: TODO: v2 - work in progress
-
-prereqs:
-
-* download Java 8 32-bit
-* download ApacheDS
-+
-NOTE: This works with v1.5.7; we had problems getting SASL authentication to work with version 2.0.0-AM26
-* install, pointing to 32-bit version of Java 8
-* download Apache Directory Studio
-* install, ensure points to 64-bit version of Java :-)
-
-start ApacheDS:
-
-* navigate to its config directory
-+
-on Windows, this is `C:\Program Files (x86)\ApacheDS\instances\default\conf`)
-
-
-* start the service
-
-using _Apache Directory Studio_
-
-* define a connection to `localhost:10389`
-** login: `uid=admin,ou=system`
-** password: `secret`
-
-
-//image::open-configuration.png[width=300px]
-
-//image::ldap-server-sasl-configuration.png[width=800px]
-
-* update the "Search Base Dn"
-+
-this is where the search for valid users is performed from.
-
-
-=== Creating a user
-
-To create a user:
-
-* using the wizard, create an entry from scratch:
-+
-image::010-create-first-page-of-wizard.png[width=600]
-
-* select the `inetOrgPerson` structural class
-+
-image::020-create-inetOrgPerson.png[width=600]
-
-* provide the `cn` (common name)
-+
-image::030-create-inetOrgPerson.png[width=600]
-
-* in addition, define a `uid` attribute:
-+
-image::040-create-inetOrgPerson.png[width=600]
-
-* also enter a `userPassword`:
-+
-image::060-create-inetOrgPerson.png[width=600]
-+
-The value is entered through a separate dialog
-+
-image::050-create-inetOrgPerson.png[width=600]
-
-
-==== Test
-
-image::070-test-sasl.png[width=600]
-
-image::080-test-sasl.org[width=600]
-
-image::090-test-sasl.org[width=400px]
-
-
-=== Creating a group
-
-To create a group:
-
-* using the wizard, create an entry from scratch:
-+
-image::010-create-first-page-of-wizard.png[width=600]
-
-* select `groupOfUniqueNames`
-+
-image::110-groupOfUniqueNames.png[width=600]
-
-* provide a `cn` (common name) for the goup
-+
-image::120-groupOfUniqueNames.png[width=600]
-
-* add a `uniqueMember` for each member of the group (there may be multiple)
-+
-image::130-groupOfUniqueNames.png[width=600]
-
-
-// == Setting up Users/Groups in Apache Directory Studio
-
-
-
-
-== Using Shiro for Authorization
-
-[source,properties]
-----
-include::security:shiro-realm-ldap:example$shiro.ini[tags=groups]
-----
-<.> Configures the realm so it can additionally can retrieve the user's groups, by querying `objectClass=<groupObjectClass>` and inspecting the attributes of each group to see if it references the user.
-<.> Defines the location within the LDAP directory that acts as the 'base' of queries
-
-// TODO: v2 - work in progress - also describe how this can optionally map LDAP groups to roles, and can map roles to perms; neither are relevant if secman is used for permissioning.
-
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/pages/ldap-realm.adoc b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/pages/ldap-realm.adoc
deleted file mode 100644
index 14c807e9f2..0000000000
--- a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/pages/ldap-realm.adoc
+++ /dev/null
@@ -1,145 +0,0 @@
-= Ldap Realm
-
-:Notice: Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at. http://www.apache.org/licenses/LICENSE-2.0 . Unless required by applicable law or ag [...]
-:page-partial:
-
-
-Apache Causeway ships with an implementation of http://shiro.apache.org[Apache Shiro]'s `Realm` class that allows user authentication and authorization to be performed against an LDAP server.
-
-image::security:shiro-realm-ldap:old/configure-shiro-to-use-causeway-ldap-realm.png[width="600px"]
-
-The LDAP database stores the user/passwords and user groups, while the `shiro.ini` file is used to map the LDAP groups to roles, and to map the roles to permissions.
-
-== Shiro Configuration
-
-To use LDAP involves telling Shiro how to instantiate the realm. This bootstrapping info lives in the `shiro.ini`:
-
-[source,ini]
-----
-contextFactory = org.apache.causeway.security.shiro.CausewayLdapContextFactory
-contextFactory.url = ldap://localhost:10389
-contextFactory.systemUsername = uid=admin,ou=system # <.>
-contextFactory.systemPassword = secret
-contextFactory.authenticationMechanism = CRAM-MD5 # <.>
-contextFactory.systemAuthenticationMechanism = simple
-
-ldapRealm = org.apache.causeway.security.shiro.CausewayLdapRealm # <.>
-ldapRealm.contextFactory = $contextFactory
-
-ldapRealm.searchBase = ou=groups,o=mojo # <.>
-ldapRealm.groupObjectClass = groupOfUniqueNames # <.>
-ldapRealm.uniqueMemberAttribute = uniqueMember # <.>
-ldapRealm.uniqueMemberAttributeValueTemplate = uid={0}
-
-# optional mapping from physical groups to logical application roles
-ldapRealm.rolesByGroup = \ # <.>
- LDN_USERS: user_role,\
- NYK_USERS: user_role,\
- HKG_USERS: user_role,\
- GLOBAL_ADMIN: admin_role,\
- DEMOS: self-install_role
-
-ldapRealm.permissionsByRole=\ # <.>
- user_role = *:ToDoItemsJdo:*:*,\
- *:ToDoItem:*:*; \
- self-install_role = *:ToDoItemsFixturesService:install:* ; \
- admin_role = *
-
-securityManager.realms = $ldapRealm
-----
-<.> user accounts are searched using a dedicated service account
-<.> SASL (CRAM-MD5) authentication is used for this authentication
-<.> Apache Causeway' implementation of the LDAP realm.
-<.> groups are searched under `ou=groups,o=mojo` (where `mojo` is the company name)
-<.> each group has an LDAP objectClass of `groupOfUniqueNames`
-<.> each group has a vector attribute of `uniqueMember`
-<.> groups looked up from LDAP can optionally be mapped to logical roles; otherwise groups are used as role names directly
-<.> roles are mapped in turn to permissions
-
-The value of `uniqueMember` is in the form `uid=xxx`, with `xxx` being the uid of the user
-* users searched under `ou=system`
-* users have, at minimum, a `uid` attribute and a password
-* the users credentials are used to verify their user/password
-
-The above configuration has been tested against http://directory.apache.org/apacheds/[ApacheDS], v1.5.7. This can be administered using http://directory.apache.org/studio/[Apache Directory Studio], v1.5.3.
-
-
-[TIP]
-.Shiro Realm Mappings
-====
-When configuring role based permission mapping, there can only be one of these entries per realm:
-
-[source,ini]
-----
-realm.groupToRolesMappings = ...
-----
-
-and
-
-[source,ini]
-----
-realm.roleToPermissionsMappings = ...
-----
-
-This forces you to put everything on one line for each of the above. This is, unfortunately, a Shiro "feature". And if you repeat the entries above then it's "last one wins".)
-
-To make the configuration maintainable, use "\" to separate the mappings onto separate lines in the file. Use this technique for both group to roles mapping and role to permission mapping. If you use the '' after the "," that separates the key:value pairs it is more readable.
-====
-
-
-
-
-
-
-== Externalizing role perms
-
-As an alternative to injecting the `permissionsByRole` property, the role/permission mapping can alternatively be specified by injecting a resource path:
-
-[source,ini]
-----
-ldapRealm.resourcePath=classpath:webapp/myroles.ini
-----
-
-where `myroles.ini` is in `src/main/resources/webapp`, and takes the form:
-
-[source,ini]
-----
-[roles]
-user_role = *:ToDoItemsJdo:*:*,\
- *:ToDoItem:*:*
-self-install_role = *:ToDoItemsFixturesService:install:*
-admin_role = *
-----
-
-This separation of the role/mapping can be useful if Shiro is configured to support multiple realms (eg an LdapRealm based one and also an TextRealm)
-
-
-
-
-== Active DS LDAP tutorial
-
-The screenshots below show how to setup LDAP accounts in ApacheDS using the Apache Directory Studio.
-
-The setup here was initially based on http://krams915.blogspot.co.uk/2011/01/ldap-apache-directory-studio-basic.html[this tutorial], however we have moved the user accounts so that they are defined in a separate LDAP node.
-
-To start, create a partition in order to hold the mojo node (holding the groups):
-
-image::security:shiro-realm-ldap:old/activeds-ldap-mojo-partition.png[]
-
-Create the `ou=groups,o=mojo` hierarchy:
-
-image::security:shiro-realm-ldap:old/activeds-ldap-mojo-root-dse.png[]
-
-Configure SASL authentication. This means that the checking of user/password is done implicitly by virtue of Apache Causeway connecting to LDAP using these credentials:
-
-image::security:shiro-realm-ldap:old/activeds-ldap-sasl-authentication.png[]
-
-In order for SASL to work, it seems to be necessary to put users under `o=system`. (This is why the setup is slightly different than the tutorial mentioned above):
-
-image::security:shiro-realm-ldap:old/activeds-ldap-users.png[]
-
-Configure the users into the groups:
-
-image::security:shiro-realm-ldap:old/activeds-ldap-groups.png[]
-
-
diff --git a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/partials/module-nav.adoc b/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/partials/module-nav.adoc
deleted file mode 100644
index 5afe011462..0000000000
--- a/extensions/security/shiro-realm-ldap/adoc/modules/shiro-realm-ldap/partials/module-nav.adoc
+++ /dev/null
@@ -1,4 +0,0 @@
-
-
-
-** xref:security:shiro-realm-ldap:about.adoc[LDAP Realm for Shiro]
diff --git a/extensions/security/shiro-realm-ldap/impl/pom.xml b/extensions/security/shiro-realm-ldap/impl/pom.xml
deleted file mode 100644
index 6bf5bb3c65..0000000000
--- a/extensions/security/shiro-realm-ldap/impl/pom.xml
+++ /dev/null
@@ -1,52 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
--->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
- <modelVersion>4.0.0</modelVersion>
-
- <parent>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions-shiro-realm-ldap</artifactId>
- <version>2.0.0-SNAPSHOT</version>
- </parent>
-
- <artifactId>causeway-extensions-shiro-realm-ldap-impl</artifactId>
- <name>Apache Causeway Ext - Security - Shiro LDAP Realm (impl)</name>
-
- <properties>
- <jar-plugin.automaticModuleName>org.apache.causeway.extensions.shirorealmldap.impl</jar-plugin.automaticModuleName>
- <git-plugin.propertiesDir>org/apache/causeway/extensions/shiro-realm-ldap/impl</git-plugin.propertiesDir>
- </properties>
-
- <dependencies>
-
- <dependency>
- <groupId>org.apache.causeway.security</groupId>
- <artifactId>causeway-security-shiro</artifactId>
- </dependency>
-
- <dependency>
- <groupId>org.apache.causeway.core</groupId>
- <artifactId>causeway-core-internaltestsupport</artifactId>
- <scope>test</scope>
- </dependency>
-
- </dependencies>
-
-</project>
diff --git a/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayLdapContextFactory.java b/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayLdapContextFactory.java
deleted file mode 100644
index 9fcb9f1d10..0000000000
--- a/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayLdapContextFactory.java
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.causeway.extensions.shirorealmldap.realm.impl;
-
-import java.util.Hashtable;
-
-import javax.naming.Context;
-import javax.naming.NamingException;
-import javax.naming.ldap.LdapContext;
-
-import org.apache.shiro.realm.ldap.JndiLdapContextFactory;
-
-/**
- * An extension of {@link JndiLdapContextFactory} that allows a different authentication mechanism
- * for system-level authentications (as used by authorization lookups, for example)
- * compared to regular authentication.
- *
- * <p>
- * See {@link CausewayLdapRealm} for typical configuration within <tt>shiro.ini</tt>.
- *
- * @since 1.x {@index}
- */
-public class CausewayLdapContextFactory extends JndiLdapContextFactory {
-
- private String systemAuthenticationMechanism;
-
- @SuppressWarnings({ "unchecked"})
- @Override
- protected LdapContext createLdapContext(Hashtable env) throws NamingException {
- if(getSystemUsername() != null && getSystemUsername().equals(env.get(Context.SECURITY_PRINCIPAL))) {
- env.put(Context.SECURITY_AUTHENTICATION, getSystemAuthenticationMechanism());
- }
- return super.createLdapContext(env);
- }
-
- public String getSystemAuthenticationMechanism() {
- return systemAuthenticationMechanism != null? systemAuthenticationMechanism: getAuthenticationMechanism();
- }
- public void setSystemAuthenticationMechanism(String systemAuthenticationMechanism) {
- this.systemAuthenticationMechanism = systemAuthenticationMechanism;
- }
-
-
-}
diff --git a/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayLdapRealm.java b/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayLdapRealm.java
deleted file mode 100644
index 8721403fbc..0000000000
--- a/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayLdapRealm.java
+++ /dev/null
@@ -1,467 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.causeway.extensions.shirorealmldap.realm.impl;
-
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Set;
-
-import javax.naming.AuthenticationException;
-import javax.naming.NamingEnumeration;
-import javax.naming.NamingException;
-import javax.naming.directory.Attribute;
-import javax.naming.directory.SearchControls;
-import javax.naming.directory.SearchResult;
-import javax.naming.ldap.LdapContext;
-
-import org.apache.shiro.authz.AuthorizationInfo;
-import org.apache.shiro.authz.SimpleAuthorizationInfo;
-import org.apache.shiro.config.Ini;
-import org.apache.shiro.realm.ldap.DefaultLdapRealm;
-import org.apache.shiro.realm.ldap.LdapContextFactory;
-import org.apache.shiro.realm.ldap.LdapUtils;
-import org.apache.shiro.subject.PrincipalCollection;
-import org.apache.shiro.util.StringUtils;
-
-import org.apache.causeway.commons.internal.collections._Maps;
-import org.apache.causeway.commons.internal.collections._Sets;
-import org.apache.causeway.security.shiro.permrolemapper.PermissionToRoleMapper;
-import org.apache.causeway.security.shiro.permrolemapper.PermissionToRoleMapperFromIni;
-
-import static org.apache.causeway.commons.internal.base._NullSafe.stream;
-
-/**
- * Implementation of {@link DefaultLdapRealm} that also
- * returns each user's groups.
- * <p/>
- * <p>
- * Sample config for <tt>shiro.ini</tt>:
- * <p/>
- * <pre>
- * contextFactory = org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapContextFactory
- * contextFactory.url = ldap://localhost:10389
- * contextFactory.authenticationMechanism = CRAM-MD5
- * contextFactory.systemAuthenticationMechanism = simple
- * contextFactory.systemUsername = uid=admin,ou=system
- * contextFactory.systemPassword = secret
- *
- * ldapRealm = org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapRealm
- * ldapRealm.contextFactory = $contextFactory
- *
- * ldapRealm.searchBase = ou=groups,o=mojo
- * ldapRealm.groupObjectClass = groupOfUniqueNames
- * ldapRealm.uniqueMemberAttribute = uniqueMember
- * ldapRealm.uniqueMemberAttributeValueTemplate = uid={0}
- *
- * ldapRealm.searchUserBase = ou=users,o=mojo
- * ldapRealm.userObjectClass=inetOrgPerson
- * ldapRealm.groupExtractedAttribute=street,country
- * ldapRealm.userExtractedAttribute=street,country
- * ldapRealm.permissionByGroupAttribute=attribute:Folder.{street}:Read,attribute:Portfolio.{country}
- * ldapRealm.permissionByUserAttribute=attribute:Folder.{street}:Read,attribute:Portfolio.{country}
- *
- * # optional mapping from physical groups to logical application roles
- * ldapRealm.rolesByGroup = \
- * LDN_USERS: user_role,\
- * NYK_USERS: user_role,\
- * HKG_USERS: user_role,\
- * GLOBAL_ADMIN: admin_role,\
- * DEMOS: self-install_role
- *
- * securityManager.realms = $ldapRealm
- * </pre>
- * <p/>
- * <p>
- * The permissions for each role can be specified using the
- * {@link #setResourcePath(String)} to an 'ini' file with a [roles] section, eg:
- * <p/>
- * <pre>
- * ldapRealm.resourcePath=classpath:webapp/myroles.ini
- * </pre>
- * <p/>
- * <p>
- * where <tt>myroles.ini</tt> is in <tt>src/main/resources/webapp</tt>, and takes the form:
- * <p/>
- * <pre>
- * [roles]
- * user_role = *:ToDoItemsJdo:*:*,\
- * *:ToDoItem:*:*
- * self-install_role = *:ToDoItemsFixturesService:install:*
- * admin_role = *
- * </pre>
- * <p/>
- * <p>
- * This 'ini' file can then be referenced by other realms (if multiple realm are configured
- * with the Shiro security manager).
- * <p/>
- * <p>
- * Alternatively, permissions can be extracted from the base itself with the parameter searchUserBase,
- * the attribute list as userExtractedAttribute and the permission url as permissionByUserAttribute.
- * The idea is to extract attribute from the user or the group of the user and map directly to permission rule in
- * replacing the string {attribute} by the extracted attribute (can me multiple).
- * See the sample for group and user attribute and mapping.
- * <p/>
- * </p>
- *
- * @since 1.x {@index}
- */
-public class CausewayLdapRealm extends DefaultLdapRealm {
-
- private static final String UNIQUEMEMBER_SUBSTITUTION_TOKEN = "{0}";
- private static final SearchControls SUBTREE_SCOPE = new SearchControls();
-
- static {
- SUBTREE_SCOPE.setSearchScope(SearchControls.SUBTREE_SCOPE);
- }
-
- private String searchBase;
- private String groupObjectClass;
- private String uniqueMemberAttribute = "uniqueMember";
- private String uniqueMemberAttributeValuePrefix;
- private String uniqueMemberAttributeValueSuffix;
-
- /**
- * For Group Extracted attribute name with mapping name in parenthesis. Ex: street,country
- */
- protected Set<String> groupExtractedAttribute = _Sets.newConcurrentHashSet();
-
- /**
- * For User Extracted attribute name with mapping name in parenthesis. Ex: street,country
- */
- protected Set<String> userExtractedAttribute = _Sets.newConcurrentHashSet();
-
- /**
- * For Group Mapping of attributes. Ex:
- * attribute:Folder.{street}:Read,attribute:Portfolio.{country}:*
- */
- protected Set<String> permissionByGroupAttribute = _Sets.newConcurrentHashSet();
-
- /**
- * For User Mapping of attributes. Ex:
- * attribute:Folder.{street}:Read,attribute:Portfolio.{country}:*
- */
- protected Set<String> permissionByUserAttribute = _Sets.newConcurrentHashSet();
-
- /**
- * For search ldap on user
- */
- private String searchUserBase = "";
-
- /**
- * The object className as person
- */
- private String userObjectClass;
-
- private final Map<String, String> rolesByGroup = _Maps.newLinkedHashMap();
-
- private PermissionToRoleMapper permissionToRoleMapper;
-
- /**
- * cn attribute
- */
- private String cnAttribute = "cn";
-
- public CausewayLdapRealm() {
- setGroupObjectClass("groupOfUniqueNames");
- setUniqueMemberAttribute("uniqueMember");
- setUniqueMemberAttributeValueTemplate("uid={0}");
- }
-
- /**
- * Get groups from LDAP.
- *
- * @param principals the principals of the Subject whose AuthenticationInfo should
- * be queried from the LDAP server.
- * @param ldapContextFactory factory used to retrieve LDAP connections.
- * @return an {@link AuthorizationInfo} instance containing information
- * retrieved from the LDAP server.
- * @throws NamingException if any LDAP errors occur during the search.
- */
- @Override
- protected AuthorizationInfo queryForAuthorizationInfo(final PrincipalCollection principals, final LdapContextFactory ldapContextFactory) throws NamingException {
- final Set<String> roleNames = getRoles(principals, ldapContextFactory);
- SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo(roleNames);
- Set<String> stringPermissions = permsFor(roleNames);
- final String username = (String) getAvailablePrincipal(principals);
- final LdapContext finalLdapContext = ldapContextFactory.getSystemLdapContext();
- stringPermissions.addAll(getPermissionForUser(username, finalLdapContext));
- stringPermissions.addAll(getPermissionForRole(username, finalLdapContext));
- simpleAuthorizationInfo.setStringPermissions(stringPermissions);
-
- return simpleAuthorizationInfo;
- }
-
- private Set<String>
- getPermissionForRole(final String username, final LdapContext ldapContext)
- throws NamingException {
- final Set<String> permissions = _Sets.newLinkedHashSet();
-
- Set<String> groups = groupFor(username, ldapContext);
- final NamingEnumeration<SearchResult> searchResultEnum = ldapContext.search(searchBase,
- "objectClass=" + groupObjectClass, SUBTREE_SCOPE);
- while (searchResultEnum.hasMore()) {
- final SearchResult group = searchResultEnum.next();
- if (memberOf(group, groups)) {
- addPermIfFound(group, permissions, groupExtractedAttribute, permissionByGroupAttribute);
- }
- }
- return permissions;
- }
-
- protected Set<String> groupFor(final String userName, final LdapContext ldapCtx)
- throws NamingException {
- final Set<String> roleNames = _Sets.newLinkedHashSet();
- final NamingEnumeration<SearchResult> searchResultEnum = ldapCtx.search(searchBase,
- "objectClass=" + groupObjectClass, SUBTREE_SCOPE);
- while (searchResultEnum.hasMore()) {
- final SearchResult group = searchResultEnum.next();
- addRoleIfMember(userName, group, roleNames);
- }
- return roleNames;
- }
-
- protected boolean memberOf(final SearchResult group, final Set<String> groups) throws NamingException {
- Attribute attribute = group.getAttributes().get(cnAttribute);
- String groupName = attribute.get().toString();
- return groups.contains(groupName);
- }
-
- private Collection<String> getPermissionForUser(
- final String username,
- final LdapContext ldapContextFactory) throws NamingException {
-
- try {
- return permUser(username, ldapContextFactory);
- } catch (org.apache.shiro.authc.AuthenticationException ex) {
- return Collections.emptySet();
- }
- }
-
- private Collection<String> permUser(final String username, final LdapContext systemLdapCtx)
- throws NamingException {
- final Set<String> permissions = _Sets.newLinkedHashSet();
- final NamingEnumeration<SearchResult> searchResultEnum = systemLdapCtx.search(
- searchUserBase, "objectClass=" + userObjectClass, SUBTREE_SCOPE);
- while (searchResultEnum.hasMore()) {
- final SearchResult group = searchResultEnum.next();
- addPermIfFound(group, permissions, userExtractedAttribute, permissionByUserAttribute);
- }
- return permissions;
- }
-
- private void addPermIfFound(
- final SearchResult group, final Set<String> permissions,
- final Set<String> extractedAttributeP, final Set<String> permissionByAttributeP)
- throws NamingException {
- final NamingEnumeration<? extends Attribute> attributeEnum = group.getAttributes().getAll();
- Map<String, Set<String>> keyValues = _Maps.newHashMap();
- while (attributeEnum.hasMore()) {
- final Attribute attr = attributeEnum.next();
- if (extractedAttributeP.contains(attr.getID())) {
- final NamingEnumeration<?> e = attr.getAll();
- keyValues.put(attr.getID(), new HashSet<String>());
- while (e.hasMore()) {
- String attrValue = e.next().toString();
- keyValues.get(attr.getID()).add(attrValue);
- }
- }
- }
- for (String permTempl : permissionByAttributeP) {
- for (String key : keyValues.keySet()) {
- if (permTempl.contains("{" + key + "}")) {
- for (String value : keyValues.get(key)) {
- permissions.add(permTempl.replaceAll("\\{" + key + "\\}", value));
- }
- }
- }
- }
- }
-
- private Set<String> getRoles(final PrincipalCollection principals, final LdapContextFactory ldapContextFactory) throws NamingException {
- final String username = (String) getAvailablePrincipal(principals);
-
- LdapContext systemLdapCtx = null;
- try {
- systemLdapCtx = ldapContextFactory.getSystemLdapContext();
- return rolesFor(username, systemLdapCtx);
- } catch (AuthenticationException ex) {
- // principal was not authenticated on LDAP
- return Collections.emptySet();
- } finally {
- LdapUtils.closeContext(systemLdapCtx);
- }
- }
-
- private Set<String> rolesFor(final String userName, final LdapContext ldapCtx) throws NamingException {
- final Set<String> roleNames = _Sets.newLinkedHashSet();
- final NamingEnumeration<SearchResult> searchResultEnum = ldapCtx.search(searchBase, "objectClass=" + groupObjectClass, SUBTREE_SCOPE);
- while (searchResultEnum.hasMore()) {
- final SearchResult group = searchResultEnum.next();
- addRoleIfMember(userName, group, roleNames);
- }
- return roleNames;
- }
-
- private void addRoleIfMember(final String userName, final SearchResult group, final Set<String> roleNames) throws NamingException {
- final NamingEnumeration<? extends Attribute> attributeEnum = group.getAttributes().getAll();
- while (attributeEnum.hasMore()) {
- final Attribute attr = attributeEnum.next();
- if (!uniqueMemberAttribute.equalsIgnoreCase(attr.getID())) {
- continue;
- }
- final NamingEnumeration<?> e = attr.getAll();
- while (e.hasMore()) {
- String attrValue = e.next().toString();
- if ((uniqueMemberAttributeValuePrefix + userName + uniqueMemberAttributeValueSuffix).equals(attrValue)) {
- Attribute attribute = group.getAttributes().get("cn");
- String groupName = attribute.get().toString();
- String roleName = roleNameFor(groupName);
- if (roleName != null) {
- roleNames.add(roleName);
- }
- break;
- }
- }
- }
- }
-
- private String roleNameFor(final String groupName) {
- return !rolesByGroup.isEmpty() ? rolesByGroup.get(groupName) : groupName;
- }
-
- private Set<String> permsFor(final Set<String> roleNames) {
- Set<String> perms = _Sets.newLinkedHashSet(); // preserve order
- for (String role : roleNames) {
- Set<String> permsForRole = getPermissionsByRole().get(role);
- if (permsForRole != null) {
- perms.addAll(permsForRole);
- }
- }
- return perms;
- }
-
- public void setSearchBase(final String searchBase) {
- this.searchBase = searchBase;
- }
-
- public void setGroupObjectClass(final String groupObjectClassAttribute) {
- this.groupObjectClass = groupObjectClassAttribute;
- }
-
- public void setUniqueMemberAttribute(final String uniqueMemberAttribute) {
- this.uniqueMemberAttribute = uniqueMemberAttribute;
- }
-
- public void setUniqueMemberAttributeValueTemplate(final String template) {
- if (!StringUtils.hasText(template)) {
- String msg = "User DN template cannot be null or empty.";
- throw new IllegalArgumentException(msg);
- }
- int index = template.indexOf(UNIQUEMEMBER_SUBSTITUTION_TOKEN);
- if (index < 0) {
- String msg = "UniqueMember attribute value template must contain the '" +
- UNIQUEMEMBER_SUBSTITUTION_TOKEN + "' replacement token to understand how to " +
- "parse the group members.";
- throw new IllegalArgumentException(msg);
- }
- String prefix = template.substring(0, index);
- String suffix = template.substring(prefix.length() + UNIQUEMEMBER_SUBSTITUTION_TOKEN.length());
- this.uniqueMemberAttributeValuePrefix = prefix;
- this.uniqueMemberAttributeValueSuffix = suffix;
- }
-
- public void setRolesByGroup(final Map<String, String> rolesByGroup) {
- this.rolesByGroup.putAll(rolesByGroup);
- }
-
- /**
- * Retrieves permissions by role set using {@link #setResourcePath(String)}.
- */
- private Map<String, Set<String>> getPermissionsByRole() {
- if (permissionToRoleMapper == null) {
- throw new IllegalStateException("Permissions by role not yet set.");
- }
- return permissionToRoleMapper.getPermissionsByRole();
- }
-
- /**
- * <pre>
- * ldapRealm.resourcePath=classpath:webapp/myroles.ini
- * </pre>
- * <p/>
- * <p/>
- * where <tt>myroles.ini</tt> is in <tt>src/main/resources/webapp</tt>, and takes the form:
- * <p/>
- * <pre>
- * [roles]
- * user_role = *:ToDoItemsJdo:*:*,\
- * *:ToDoItem:*:*
- * self-install_role = *:ToDoItemsFixturesService:install:*
- * admin_role = *
- * </pre>
- * <p/>
- * <p/>
- * This 'ini' file can then be referenced by other realms (if multiple realm are configured
- * with the Shiro security manager).
- *
- * @see #setResourcePath(String)
- */
- public void setResourcePath(final String resourcePath) {
- if (permissionToRoleMapper != null) {
- throw new IllegalStateException("Permissions already set, " + permissionToRoleMapper.getClass().getName());
- }
- final Ini ini = Ini.fromResourcePath(resourcePath);
- this.permissionToRoleMapper = new PermissionToRoleMapperFromIni(ini);
- }
-
- public void setPermissionByUserAttribute(final String permissionByUserAttr) {
- String[] list = permissionByUserAttr.split(",");
- stream(list).forEach(this.permissionByUserAttribute::add);
- }
-
- public void setPermissionByGroupAttribute(final String permissionByGroupAttribute) {
- String[] list = permissionByGroupAttribute.split(",");
- stream(list).forEach(this.permissionByGroupAttribute::add);
- }
-
- public void setUserExtractedAttribute(final String userExtractedAttribute) {
- String[] list = userExtractedAttribute.split(",");
- stream(list).forEach(this.userExtractedAttribute::add);
- }
-
- public void setGroupExtractedAttribute(final String groupExtractedAttribute) {
- String[] list = groupExtractedAttribute.split(",");
- stream(list).forEach(this.groupExtractedAttribute::add);
- }
-
- public void setSearchUserBase(final String searchUserBase) {
- this.searchUserBase = searchUserBase;
- }
-
- public void setUserObjectClass(final String userObjectClass) {
- this.userObjectClass = userObjectClass;
- }
-
- public void setCnAttribute(final String cnAttribute) {
- this.cnAttribute = cnAttribute;
- }
-
-}
diff --git a/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayModuleExtShiroRealmLdapImpl.java b/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayModuleExtShiroRealmLdapImpl.java
deleted file mode 100644
index 9953fc4b8a..0000000000
--- a/extensions/security/shiro-realm-ldap/impl/src/main/java/org/apache/causeway/extensions/shirorealmldap/realm/impl/CausewayModuleExtShiroRealmLdapImpl.java
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.causeway.extensions.shirorealmldap.realm.impl;
-
-import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Import;
-
-import org.apache.causeway.security.shiro.CausewayModuleSecurityShiro;
-
-
-/**
- * @since 1.x {@index}
- */
-@Configuration
-@Import({
- // Modules
- CausewayModuleSecurityShiro.class
-
-})
-public class CausewayModuleExtShiroRealmLdapImpl {
-
-}
diff --git a/extensions/security/shiro-realm-ldap/pom.xml b/extensions/security/shiro-realm-ldap/pom.xml
deleted file mode 100644
index 91b8cc6b1d..0000000000
--- a/extensions/security/shiro-realm-ldap/pom.xml
+++ /dev/null
@@ -1,42 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
--->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
- <modelVersion>4.0.0</modelVersion>
-
- <parent>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions</artifactId>
- <version>2.0.0-SNAPSHOT</version>
- <relativePath>../../pom.xml</relativePath>
- </parent>
-
- <artifactId>causeway-extensions-shiro-realm-ldap</artifactId>
-
- <name>Apache Causeway Ext - Security - Shiro LDAP Realm (parent)</name>
- <description>
- Implementation of Shiro Realm using LDAP.
- </description>
- <packaging>pom</packaging>
-
- <modules>
- <module>impl</module>
- </modules>
-
-</project>
diff --git a/regressiontests/incubating/pom.xml b/regressiontests/incubating/pom.xml
index aa23131f37..9c446ad496 100644
--- a/regressiontests/incubating/pom.xml
+++ b/regressiontests/incubating/pom.xml
@@ -23,7 +23,7 @@
<artifactId>causeway-regressiontests-incubating</artifactId>
<name>Apache Causeway - Regression Tests (incubating)</name>
-
+
<properties>
<maven.install.skip>true</maven.install.skip>
<maven.deploy.skip>true</maven.deploy.skip>
@@ -98,12 +98,6 @@
<scope>test</scope>
</dependency>
- <dependency>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions-shiro-realm-ldap-impl</artifactId>
- <scope>test</scope>
- </dependency>
-
<dependency>
<groupId>org.apache.directory.server</groupId>
<artifactId>apacheds-test-framework</artifactId>
diff --git a/regressiontests/incubating/src/test/java/org/apache/causeway/testdomain/shiro/ShiroLdapTest.java b/regressiontests/incubating/src/test/java/org/apache/causeway/testdomain/shiro/ShiroLdapTest.java
deleted file mode 100644
index 5db921629d..0000000000
--- a/regressiontests/incubating/src/test/java/org/apache/causeway/testdomain/shiro/ShiroLdapTest.java
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.causeway.testdomain.shiro;
-
-import javax.inject.Inject;
-
-import org.apache.shiro.SecurityUtils;
-import org.apache.shiro.authc.AuthenticationException;
-import org.apache.shiro.authc.AuthenticationToken;
-import org.apache.shiro.authc.UsernamePasswordToken;
-import org.junit.jupiter.api.AfterAll;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.context.annotation.Import;
-import org.springframework.test.context.TestPropertySource;
-
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-
-import org.apache.causeway.applib.services.inject.ServiceInjector;
-import org.apache.causeway.core.config.presets.CausewayPresets;
-import org.apache.causeway.testdomain.conf.Configuration_usingJdoAndShiro;
-import org.apache.causeway.testdomain.ldap.LdapConstants;
-import org.apache.causeway.testdomain.ldap.LdapServerService;
-
-import lombok.val;
-import lombok.extern.log4j.Log4j2;
-
-@SpringBootTest(
- classes = {
- Configuration_usingJdoAndShiro.class,
- })
-@Import({
- LdapServerService.class,
-})
-@TestPropertySource(CausewayPresets.UseLog4j2Test)
-//XXX inconsistent state when run in a test batch
-@Log4j2
-class ShiroLdapTest extends AbstractShiroTest {
-
- @Inject LdapServerService ldapServerService;
- @Inject ServiceInjector serviceInjector;
-
- @BeforeEach
- void beforeEach() {
- // Build and set the SecurityManager used to build Subject instances used in your tests
- // This typically only needs to be done once per class if your shiro.ini doesn't change,
- // otherwise, you'll need to do this logic in each test that is different
- setSecurityManager(serviceInjector, "classpath:shiro-ldap.ini");
- }
-
- @AfterEach
- void afterEach() {
- SecurityUtils.setSecurityManager(null);
- }
-
- @AfterAll
- static void afterClass() {
- tearDownShiro();
- }
-
- @Test
- void loginLogoutRoundtrip() {
-
- log.info("starting login/logout roundtrip");
-
- val secMan = SecurityUtils.getSecurityManager();
- assertNotNull(secMan);
-
- val subject = SecurityUtils.getSubject();
- assertNotNull(subject);
- assertFalse(subject.isAuthenticated());
-
- val token = (AuthenticationToken) new UsernamePasswordToken(
- LdapConstants.SVEN_PRINCIPAL,
- "pass");
-
- subject.login(token);
- assertTrue(subject.isAuthenticated());
-
- subject.logout();
- assertFalse(subject.isAuthenticated());
-
- }
-
- @Test
- void login_withInvalidPassword() {
-
- val secMan = SecurityUtils.getSecurityManager();
- assertNotNull(secMan);
-
- val subject = SecurityUtils.getSubject();
- assertNotNull(subject);
- assertFalse(subject.isAuthenticated());
-
- val token = (AuthenticationToken) new UsernamePasswordToken(
- LdapConstants.SVEN_PRINCIPAL,
- "invalid-pass");
-
- assertThrows(AuthenticationException.class, ()->{
- subject.login(token);
- });
-
- assertFalse(subject.isAuthenticated());
-
- }
-
- @Test
- void login_withNonExistentUser() {
-
- val secMan = SecurityUtils.getSecurityManager();
- assertNotNull(secMan);
-
- val subject = SecurityUtils.getSubject();
- assertNotNull(subject);
- assertFalse(subject.isAuthenticated());
-
- val token = (AuthenticationToken) new UsernamePasswordToken(
- "non-existent-user",
- "invalid-pass");
-
- assertThrows(AuthenticationException.class, ()->{
- subject.login(token);
- });
-
- assertFalse(subject.isAuthenticated());
-
-
- }
-
-
-}
diff --git a/regressiontests/incubating/src/test/resources/shiro-ldap.ini b/regressiontests/incubating/src/test/resources/shiro-ldap.ini
deleted file mode 100644
index 25be2bb5f1..0000000000
--- a/regressiontests/incubating/src/test/resources/shiro-ldap.ini
+++ /dev/null
@@ -1,61 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-[main]
-
-contextFactory = org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapContextFactory
-contextFactory.url = ldap://localhost:10389
-contextFactory.authenticationMechanism = simple
-contextFactory.systemAuthenticationMechanism = simple
-contextFactory.systemUsername = uid=admin,ou=system
-contextFactory.systemPassword = secret
-
-ldapRealm = org.apache.causeway.extensions.shirorealmldap.realm.impl.CausewayLdapRealm
-ldapRealm.contextFactory = $contextFactory
-
-ldapRealm.searchBase = ou=groups,o=mojo
-ldapRealm.groupObjectClass = groupOfUniqueNames
-ldapRealm.uniqueMemberAttribute = uniqueMember
-ldapRealm.uniqueMemberAttributeValueTemplate = uid={0}
-
-# optional mapping from physical groups to logical application roles
-ldapRealm.rolesByGroup = \
- LDN_USERS: user_role,\
- NYK_USERS: user_role,\
- HKG_USERS: user_role,\
- GLOBAL_ADMIN: admin_role,\
- DEMOS: self-install_role
-
-ldapRealm.permissionsByRole=\
- user_role = *:InventoryManager:*:*,\
- *:Product:*:*; \
- self-install_role = *:FixtureScriptsDefault:*:* ; \
- admin_role = *
-
-securityManager.realms = $ldapRealm
-
-[users]
-# unused
-
-[roles]
-# unused
-
-
-
-
diff --git a/regressiontests/pom.xml b/regressiontests/pom.xml
index 13aa3bfab1..fb594ce614 100644
--- a/regressiontests/pom.xml
+++ b/regressiontests/pom.xml
@@ -255,12 +255,6 @@
<version>${project.version}</version>
</dependency>
- <dependency>
- <groupId>org.apache.causeway.extensions</groupId>
- <artifactId>causeway-extensions-shiro-realm-ldap-impl</artifactId>
- <version>${project.version}</version>
- </dependency>
-
<!-- TEST DEPENDENCIES -->
diff --git a/tooling/cli/adoc/modules/tooling-cli/examples/causeway-tooling.yml b/tooling/cli/adoc/modules/tooling-cli/examples/causeway-tooling.yml
index 07a43727c4..2e39503a00 100644
--- a/tooling/cli/adoc/modules/tooling-cli/examples/causeway-tooling.yml
+++ b/tooling/cli/adoc/modules/tooling-cli/examples/causeway-tooling.yml
@@ -64,7 +64,6 @@ commands:
"Security: Audit Trail": "org.apache.causeway.security:causeway-extensions-audittrail.*"
"Security: Secman": "org.apache.causeway.security:causeway-extensions-secman.*"
"Security: Session Log": "org.apache.causeway.security:causeway-extensions-sessionlog.*"
- "Security: Shiro LDAP Realm": "org.apache.causeway.security:causeway-extensions-shiro-realm-ldap.*"
"Security: Spring Oauth2": "org.apache.causeway.security:causeway-extensions-spring-security-oauth2.*"
"RO Viewer: CORS": "org.apache.causeway.security:causeway-extensions-cors.*"
"Wicket Viewer: Excel Download": "org.apache.causeway.security:causeway-extensions-exceldownload.*"
diff --git a/tooling/cli/src/test/resources/org/apache/causeway/tooling/cli/test/causeway-tooling.yml b/tooling/cli/src/test/resources/org/apache/causeway/tooling/cli/test/causeway-tooling.yml
index 07a43727c4..2e39503a00 100644
--- a/tooling/cli/src/test/resources/org/apache/causeway/tooling/cli/test/causeway-tooling.yml
+++ b/tooling/cli/src/test/resources/org/apache/causeway/tooling/cli/test/causeway-tooling.yml
@@ -64,7 +64,6 @@ commands:
"Security: Audit Trail": "org.apache.causeway.security:causeway-extensions-audittrail.*"
"Security: Secman": "org.apache.causeway.security:causeway-extensions-secman.*"
"Security: Session Log": "org.apache.causeway.security:causeway-extensions-sessionlog.*"
- "Security: Shiro LDAP Realm": "org.apache.causeway.security:causeway-extensions-shiro-realm-ldap.*"
"Security: Spring Oauth2": "org.apache.causeway.security:causeway-extensions-spring-security-oauth2.*"
"RO Viewer: CORS": "org.apache.causeway.security:causeway-extensions-cors.*"
"Wicket Viewer: Excel Download": "org.apache.causeway.security:causeway-extensions-exceldownload.*"