You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@knox.apache.org by di...@apache.org on 2014/05/15 02:30:05 UTC
[1/3] git commit: KNOX-368: add support for new config param
userSearchBase
Repository: knox
Updated Branches:
refs/heads/master 25fc2375e -> a0efb4b4c
KNOX-368: add support for new config param userSearchBase
Project: http://git-wip-us.apache.org/repos/asf/knox/repo
Commit: http://git-wip-us.apache.org/repos/asf/knox/commit/2759abe4
Tree: http://git-wip-us.apache.org/repos/asf/knox/tree/2759abe4
Diff: http://git-wip-us.apache.org/repos/asf/knox/diff/2759abe4
Branch: refs/heads/master
Commit: 2759abe4766849f506d95268f0e16a604ea55c80
Parents: 25fc237
Author: Dilli Dorai Arumugam <da...@hortonworks.com>
Authored: Wed May 14 17:03:50 2014 -0700
Committer: Dilli Dorai Arumugam <da...@hortonworks.com>
Committed: Wed May 14 17:03:50 2014 -0700
----------------------------------------------------------------------
.../hadoop/gateway/shirorealm/KnoxLdapRealm.java | 19 ++++++++++++++++---
.../gateway/shirorealm/KnoxLdapRealmTest.java | 7 +++++++
2 files changed, 23 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/knox/blob/2759abe4/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java b/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
index 07cedf2..1d6009d 100644
--- a/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
+++ b/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
@@ -116,7 +116,9 @@ public class KnoxLdapRealm extends JndiLdapRealm {
SUBTREE_SCOPE.setSearchScope(SearchControls.SUBTREE_SCOPE);
ONELEVEL_SCOPE.setSearchScope(SearchControls.ONELEVEL_SCOPE);
}
-
+
+ private String userSearchBase;
+
private String searchBase;
// typical alue: groupOfNames, groupOfUniqueNames, groupOfUrls
private String groupObjectClass = "groupOfNames";
@@ -276,7 +278,15 @@ public class KnoxLdapRealm extends JndiLdapRealm {
public void setSearchBase(String searchBase) {
this.searchBase = searchBase;
}
-
+
+ public String getUserSearchBase() {
+ return userSearchBase;
+ }
+
+ public void setUserSearchBase(String userSearchBase) {
+ this.userSearchBase = userSearchBase;
+ }
+
public String getGroupObjectClass() {
return groupObjectClass;
}
@@ -446,6 +456,9 @@ public class KnoxLdapRealm extends JndiLdapRealm {
return super.getUserDn(principal);
}
+ String base = (userSearchBase != null && !userSearchBase.isEmpty()) ?
+ userSearchBase : searchBase;
+
// search for userDn and return
String userDn = null;
LdapContext systemLdapCtx = null;
@@ -454,7 +467,7 @@ public class KnoxLdapRealm extends JndiLdapRealm {
String searchFilter = String.format("(&(objectclass=%1$s)(%2$s=%3$s))",
userObjectClass, userSearchAttributeName, principal);
final NamingEnumeration<SearchResult> searchResultEnum = systemLdapCtx.search(
- searchBase,
+ base,
searchFilter,
SUBTREE_SCOPE);
if (searchResultEnum.hasMore()) { // searchResults contains all the groups in search scope
http://git-wip-us.apache.org/repos/asf/knox/blob/2759abe4/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java b/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
index 81f863c..3306896 100644
--- a/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
+++ b/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
@@ -59,5 +59,12 @@ public class KnoxLdapRealmTest {
assertEquals(realm.getUserObjectClass(), "inetuser");
}
+ @Test
+ public void setGetUserSearchBase() {
+ KnoxLdapRealm realm = new KnoxLdapRealm();
+ realm.setUserSearchBase("dc=knox,dc=example,dc=com");
+ assertEquals(realm.getUserSearchBase(), "dc=knox,dc=example,dc=com");
+ }
+
}
[3/3] git commit: KNOX-371: group membership lookup need to use
userdn computed by search
Posted by di...@apache.org.
KNOX-371: group membership lookup need to use userdn computed by search
Project: http://git-wip-us.apache.org/repos/asf/knox/repo
Commit: http://git-wip-us.apache.org/repos/asf/knox/commit/a0efb4b4
Tree: http://git-wip-us.apache.org/repos/asf/knox/tree/a0efb4b4
Diff: http://git-wip-us.apache.org/repos/asf/knox/diff/a0efb4b4
Branch: refs/heads/master
Commit: a0efb4b4c15cb0a223e33cae1c21027b02f408dc
Parents: 5de7465
Author: Dilli Dorai Arumugam <da...@hortonworks.com>
Authored: Wed May 14 17:29:24 2014 -0700
Committer: Dilli Dorai Arumugam <da...@hortonworks.com>
Committed: Wed May 14 17:29:24 2014 -0700
----------------------------------------------------------------------
.../org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/knox/blob/a0efb4b4/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java b/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
index 22a54e9..d918cc6 100644
--- a/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
+++ b/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
@@ -217,7 +217,13 @@ public class KnoxLdapRealm extends JndiLdapRealm {
final Set<String> roleNames, final Set<String> groupNames,
final LdapContextFactory ldapContextFactory) throws NamingException {
- String userDn = memberAttributeValuePrefix + userName + memberAttributeValueSuffix;
+ String userDn = null;
+ if (userSearchAttributeName == null || userSearchAttributeName.isEmpty()) {
+ // memberAttributeValuePrefix and memberAttributeValueSuffix were computed from memberAttributeValueTemplate
+ userDn = memberAttributeValuePrefix + userName + memberAttributeValueSuffix;
+ } else {
+ userDn = getUserDn(userName);
+ }
Attribute attribute = group.getAttributes().get(getGroupIdAttribute());
String groupName = attribute.get().toString();
[2/3] git commit: KNOX-369: add support for new config param
groupSearchBase
Posted by di...@apache.org.
KNOX-369: add support for new config param groupSearchBase
Project: http://git-wip-us.apache.org/repos/asf/knox/repo
Commit: http://git-wip-us.apache.org/repos/asf/knox/commit/5de7465b
Tree: http://git-wip-us.apache.org/repos/asf/knox/tree/5de7465b
Diff: http://git-wip-us.apache.org/repos/asf/knox/diff/5de7465b
Branch: refs/heads/master
Commit: 5de7465b2505b4c49f0c37d93aabc368eb6abc18
Parents: 2759abe
Author: Dilli Dorai Arumugam <da...@hortonworks.com>
Authored: Wed May 14 17:14:25 2014 -0700
Committer: Dilli Dorai Arumugam <da...@hortonworks.com>
Committed: Wed May 14 17:14:25 2014 -0700
----------------------------------------------------------------------
.../gateway/shirorealm/KnoxLdapRealm.java | 25 ++++++++++++++++----
.../gateway/shirorealm/KnoxLdapRealmTest.java | 7 ++++++
2 files changed, 27 insertions(+), 5 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/knox/blob/5de7465b/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java b/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
index 1d6009d..22a54e9 100644
--- a/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
+++ b/gateway-provider-security-shiro/src/main/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealm.java
@@ -117,10 +117,11 @@ public class KnoxLdapRealm extends JndiLdapRealm {
ONELEVEL_SCOPE.setSearchScope(SearchControls.ONELEVEL_SCOPE);
}
- private String userSearchBase;
private String searchBase;
- // typical alue: groupOfNames, groupOfUniqueNames, groupOfUrls
+ private String userSearchBase;
+ private String groupSearchBase;
+
private String groupObjectClass = "groupOfNames";
// typical value: member, uniqueMember, meberUrl
@@ -189,10 +190,16 @@ public class KnoxLdapRealm extends JndiLdapRealm {
final LdapContextFactory ldapContextFactory) throws NamingException {
final Set<String> roleNames = new HashSet();
final Set<String> groupNames = new HashSet();
-
+
+ String base = (groupSearchBase != null && !groupSearchBase.isEmpty()) ?
+ groupSearchBase : searchBase;
+
// ldapsearch -h localhost -p 33389 -D uid=guest,ou=people,dc=hadoop,dc=apache,dc=org -w guest-password
// -b dc=hadoop,dc=apache,dc=org -s sub '(objectclass=*)'
- final NamingEnumeration<SearchResult> searchResultEnum = ldapCtx.search(searchBase, "objectClass="+groupObjectClass, SUBTREE_SCOPE);
+ final NamingEnumeration<SearchResult> searchResultEnum = ldapCtx.search(
+ base,
+ "objectClass=" + groupObjectClass,
+ SUBTREE_SCOPE);
while (searchResultEnum.hasMore()) { // searchResults contains all the groups in search scope
final SearchResult group = searchResultEnum.next();
@@ -286,7 +293,15 @@ public class KnoxLdapRealm extends JndiLdapRealm {
public void setUserSearchBase(String userSearchBase) {
this.userSearchBase = userSearchBase;
}
-
+
+ public String getGroupSearchBase() {
+ return groupSearchBase;
+ }
+
+ public void setGroupSearchBase(String groupSearchBase) {
+ this.groupSearchBase = groupSearchBase;
+ }
+
public String getGroupObjectClass() {
return groupObjectClass;
}
http://git-wip-us.apache.org/repos/asf/knox/blob/5de7465b/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
----------------------------------------------------------------------
diff --git a/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java b/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
index 3306896..2e2eb9d 100644
--- a/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
+++ b/gateway-provider-security-shiro/src/test/java/org/apache/hadoop/gateway/shirorealm/KnoxLdapRealmTest.java
@@ -66,5 +66,12 @@ public class KnoxLdapRealmTest {
assertEquals(realm.getUserSearchBase(), "dc=knox,dc=example,dc=com");
}
+ @Test
+ public void setGetGroupSearchBase() {
+ KnoxLdapRealm realm = new KnoxLdapRealm();
+ realm.setGroupSearchBase("dc=knox,dc=example,dc=com");
+ assertEquals(realm.getGroupSearchBase(), "dc=knox,dc=example,dc=com");
+ }
+
}