|
1
18 package org.apache.activemq.security;
19
20 import java.text.MessageFormat  ;
21 import java.util.HashSet ;
22 import java.util.Hashtable ;
23 import java.util.Iterator ;
24 import java.util.Map ;
25 import java.util.Set ;
26
27 import javax.naming.Context ;
28 import javax.naming.NamingEnumeration ;
29 import javax.naming.NamingException ;
30 import javax.naming.directory.Attribute ;
31 import javax.naming.directory.Attributes ;
32 import javax.naming.directory.DirContext ;
33 import javax.naming.directory.InitialDirContext ;
34 import javax.naming.directory.SearchControls ;
35 import javax.naming.directory.SearchResult ;
36
37 import org.apache.activemq.command.ActiveMQDestination;
38 import org.apache.activemq.jaas.GroupPrincipal;
39 import org.apache.activemq.jaas.LDAPLoginModule;
40 import org.apache.commons.logging.Log;
41 import org.apache.commons.logging.LogFactory;
42
43
50 public class LDAPAuthorizationMap implements AuthorizationMap {
51
52 private static Log log = LogFactory.getLog(LDAPLoginModule.class);
53
54 public static final String INITIAL_CONTEXT_FACTORY = "initialContextFactory";
55 public static final String CONNECTION_URL = "connectionURL";
56 public static final String CONNECTION_USERNAME = "connectionUsername";
57 public static final String CONNECTION_PASSWORD = "connectionPassword";
58 public static final String CONNECTION_PROTOCOL = "connectionProtocol";
59 public static final String AUTHENTICATION = "authentication";
60
61 public static final String TOPIC_SEARCH_MATCHING = "topicSearchMatching";
62 public static final String TOPIC_SEARCH_SUBTREE = "topicSearchSubtree";
63 public static final String QUEUE_SEARCH_MATCHING = "queueSearchMatching";
64 public static final String QUEUE_SEARCH_SUBTREE = "queueSearchSubtree";
65
66 public static final String ADMIN_BASE = "adminBase";
67 public static final String ADMIN_ATTRIBUTE = "adminAttribute";
68 public static final String READ_BASE = "readBase";
69 public static final String READ_ATTRIBUTE = "readAttribute";
70 public static final String WRITE_BASE = "writeBAse";
71 public static final String WRITE_ATTRIBUTE = "writeAttribute";
72
73 private String initialContextFactory;
74 private String connectionURL;
75 private String connectionUsername;
76 private String connectionPassword;
77 private String connectionProtocol;
78 private String authentication;
79
80 private DirContext context;
81
82 private MessageFormat topicSearchMatchingFormat;
83 private MessageFormat queueSearchMatchingFormat;
84
85 private boolean topicSearchSubtreeBool = true;
86 private boolean queueSearchSubtreeBool = true;
87
88 private String adminBase;
89 private String adminAttribute;
90 private String readBase;
91 private String readAttribute;
92 private String writeBase;
93 private String writeAttribute;
94
95 public LDAPAuthorizationMap() {
96 initialContextFactory = "com.sun.jndi.ldap.LdapCtxFactory";
98 connectionURL = "ldap://localhost:10389";
99 connectionUsername = "uid=admin,ou=system";
100 connectionPassword = "secret";
101 connectionProtocol = "s";
102 authentication = "simple";
103
104 topicSearchMatchingFormat = new MessageFormat ("uid={0},ou=topics,ou=destinations,o=ActiveMQ,dc=example,dc=com");
105 queueSearchMatchingFormat = new MessageFormat ("uid={0},ou=queues,ou=destinations,o=ActiveMQ,dc=example,dc=com");
106
107 adminBase = "(cn=admin)";
108 adminAttribute = "uniqueMember";
109 readBase = "(cn=read)";
110 readAttribute = "uniqueMember";
111 writeBase = "(cn=write)";
112 writeAttribute = "uniqueMember";
113 }
114
115 public LDAPAuthorizationMap(Map options) {
116 initialContextFactory = (String ) options.get(INITIAL_CONTEXT_FACTORY);
117 connectionURL = (String ) options.get(CONNECTION_URL);
118 connectionUsername = (String ) options.get(CONNECTION_USERNAME);
119 connectionPassword = (String ) options.get(CONNECTION_PASSWORD);
120 connectionProtocol = (String ) options.get(CONNECTION_PROTOCOL);
121 authentication = (String ) options.get(AUTHENTICATION);
122
123 adminBase = (String ) options.get(ADMIN_BASE);
124 adminAttribute = (String ) options.get(ADMIN_ATTRIBUTE);
125 readBase = (String ) options.get(READ_BASE);
126 readAttribute = (String ) options.get(READ_ATTRIBUTE);
127 writeBase = (String ) options.get(WRITE_BASE);
128 writeAttribute = (String ) options.get(WRITE_ATTRIBUTE);
129
130 String topicSearchMatching = (String ) options.get(TOPIC_SEARCH_MATCHING);
131 String topicSearchSubtree = (String ) options.get(TOPIC_SEARCH_SUBTREE);
132 String queueSearchMatching = (String ) options.get(QUEUE_SEARCH_MATCHING);
133 String queueSearchSubtree = (String ) options.get(QUEUE_SEARCH_SUBTREE);
134 topicSearchMatchingFormat = new MessageFormat (topicSearchMatching);
135 queueSearchMatchingFormat = new MessageFormat (queueSearchMatching);
136 topicSearchSubtreeBool = new Boolean (topicSearchSubtree).booleanValue();
137 queueSearchSubtreeBool = new Boolean (queueSearchSubtree).booleanValue();
138 }
139
140 public Set getTempDestinationAdminACLs() {
141
143 return null;
144 }
145
146 public Set getTempDestinationReadACLs() {
147 return null;
149 }
150
151 public Set getTempDestinationWriteACLs() {
152 return null;
154 }
155
156 public Set getAdminACLs(ActiveMQDestination destination) {
157 return getACLs(destination, adminBase, adminAttribute);
158 }
159
160 public Set getReadACLs(ActiveMQDestination destination) {
161 return getACLs(destination, readBase, readAttribute);
162 }
163
164 public Set getWriteACLs(ActiveMQDestination destination) {
165 return getACLs(destination, writeBase, writeAttribute);
166 }
167
168
171 public String getAdminAttribute() {
172 return adminAttribute;
173 }
174
175 public void setAdminAttribute(String adminAttribute) {
176 this.adminAttribute = adminAttribute;
177 }
178
179 public String getAdminBase() {
180 return adminBase;
181 }
182
183 public void setAdminBase(String adminBase) {
184 this.adminBase = adminBase;
185 }
186
187 public String getAuthentication() {
188 return authentication;
189 }
190
191 public void setAuthentication(String authentication) {
192 this.authentication = authentication;
193 }
194
195 public String getConnectionPassword() {
196 return connectionPassword;
197 }
198
199 public void setConnectionPassword(String connectionPassword) {
200 this.connectionPassword = connectionPassword;
201 }
202
203 public String getConnectionProtocol() {
204 return connectionProtocol;
205 }
206
207 public void setConnectionProtocol(String connectionProtocol) {
208 this.connectionProtocol = connectionProtocol;
209 }
210
211 public String getConnectionURL() {
212 return connectionURL;
213 }
214
215 public void setConnectionURL(String connectionURL) {
216 this.connectionURL = connectionURL;
217 }
218
219 public String getConnectionUsername() {
220 return connectionUsername;
221 }
222
223 public void setConnectionUsername(String connectionUsername) {
224 this.connectionUsername = connectionUsername;
225 }
226
227 public DirContext getContext() {
228 return context;
229 }
230
231 public void setContext(DirContext context) {
232 this.context = context;
233 }
234
235 public String getInitialContextFactory() {
236 return initialContextFactory;
237 }
238
239 public void setInitialContextFactory(String initialContextFactory) {
240 this.initialContextFactory = initialContextFactory;
241 }
242
243 public MessageFormat getQueueSearchMatchingFormat() {
244 return queueSearchMatchingFormat;
245 }
246
247 public void setQueueSearchMatchingFormat(MessageFormat queueSearchMatchingFormat) {
248 this.queueSearchMatchingFormat = queueSearchMatchingFormat;
249 }
250
251 public boolean isQueueSearchSubtreeBool() {
252 return queueSearchSubtreeBool;
253 }
254
255 public void setQueueSearchSubtreeBool(boolean queueSearchSubtreeBool) {
256 this.queueSearchSubtreeBool = queueSearchSubtreeBool;
257 }
258
259 public String getReadAttribute() {
260 return readAttribute;
261 }
262
263 public void setReadAttribute(String readAttribute) {
264 this.readAttribute = readAttribute;
265 }
266
267 public String getReadBase() {
268 return readBase;
269 }
270
271 public void setReadBase(String readBase) {
272 this.readBase = readBase;
273 }
274
275 public MessageFormat getTopicSearchMatchingFormat() {
276 return topicSearchMatchingFormat;
277 }
278
279 public void setTopicSearchMatchingFormat(MessageFormat topicSearchMatchingFormat) {
280 this.topicSearchMatchingFormat = topicSearchMatchingFormat;
281 }
282
283 public boolean isTopicSearchSubtreeBool() {
284 return topicSearchSubtreeBool;
285 }
286
287 public void setTopicSearchSubtreeBool(boolean topicSearchSubtreeBool) {
288 this.topicSearchSubtreeBool = topicSearchSubtreeBool;
289 }
290
291 public String getWriteAttribute() {
292 return writeAttribute;
293 }
294
295 public void setWriteAttribute(String writeAttribute) {
296 this.writeAttribute = writeAttribute;
297 }
298
299 public String getWriteBase() {
300 return writeBase;
301 }
302
303 public void setWriteBase(String writeBase) {
304 this.writeBase = writeBase;
305 }
306
307 protected Set getACLs(ActiveMQDestination destination, String roleBase, String roleAttribute) {
310 try {
311 context = open();
312 }
313 catch (NamingException e) {
314 log.error(e);
315 return new HashSet ();
316 }
317
318
323 String destinationBase = "";
324 SearchControls constraints = new SearchControls ();
325
326 if ((destination.getDestinationType() & ActiveMQDestination.QUEUE_TYPE) == ActiveMQDestination.QUEUE_TYPE) {
327 destinationBase = queueSearchMatchingFormat.format(new String [] { destination.getPhysicalName() });
328 if (queueSearchSubtreeBool) {
329 constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
330 }
331 else {
332 constraints.setSearchScope(SearchControls.ONELEVEL_SCOPE);
333 }
334 }
335 if ((destination.getDestinationType() & ActiveMQDestination.TOPIC_TYPE) == ActiveMQDestination.TOPIC_TYPE) {
336 destinationBase = topicSearchMatchingFormat.format(new String [] { destination.getPhysicalName() });
337 if (topicSearchSubtreeBool) {
338 constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
339 }
340 else {
341 constraints.setSearchScope(SearchControls.ONELEVEL_SCOPE);
342 }
343 }
344
345 constraints.setReturningAttributes(new String [] { roleAttribute });
346
347 try {
348 Set roles = new HashSet ();
349 Set acls = new HashSet ();
350 NamingEnumeration results = context.search(destinationBase, roleBase, constraints);
351 while (results.hasMore()) {
352 SearchResult result = (SearchResult ) results.next();
353 Attributes attrs = result.getAttributes();
354 if (attrs == null) {
355 continue;
356 }
357 acls = addAttributeValues(roleAttribute, attrs, acls);
358 }
359 for (Iterator iter = acls.iterator(); iter.hasNext();) {
360 String roleName = (String ) iter.next();
361 roles.add(new GroupPrincipal(roleName));
362 }
363 return roles;
364 }
365 catch (NamingException e) {
366 log.error(e);
367 return new HashSet ();
368 }
369 }
370
371 protected Set addAttributeValues(String attrId, Attributes attrs, Set values) throws NamingException {
372 if (attrId == null || attrs == null) {
373 return values;
374 }
375 if (values == null) {
376 values = new HashSet ();
377 }
378 Attribute attr = attrs.get(attrId);
379 if (attr == null) {
380 return (values);
381 }
382 NamingEnumeration e = attr.getAll();
383 while (e.hasMore()) {
384 String value = (String ) e.next();
385 values.add(value);
386 }
387 return values;
388 }
389
390 protected DirContext open() throws NamingException {
391 if (context != null) {
392 return context;
393 }
394
395 try {
396 Hashtable env = new Hashtable ();
397 env.put(Context.INITIAL_CONTEXT_FACTORY, initialContextFactory);
398 if (connectionUsername != null || !"".equals(connectionUsername)) {
399 env.put(Context.SECURITY_PRINCIPAL, connectionUsername);
400 }
401 if (connectionPassword != null || !"".equals(connectionPassword)) {
402 env.put(Context.SECURITY_CREDENTIALS, connectionPassword);
403 }
404 env.put(Context.SECURITY_PROTOCOL, connectionProtocol);
405 env.put(Context.PROVIDER_URL, connectionURL);
406 env.put(Context.SECURITY_AUTHENTICATION, authentication);
407 context = new InitialDirContext (env);
408
409 }
410 catch (NamingException e) {
411 log.error(e);
412 throw e;
413 }
414 return context;
415 }
416
417 }
418 |
Popular Tags |
Java API By Example, From Geeks To Geeks.