Package net.shibboleth.idp.authn.impl

Class LDAPCredentialValidator

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

net.shibboleth.idp.authn.AbstractCredentialValidator

net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator

net.shibboleth.idp.authn.impl.LDAPCredentialValidator

All Implemented Interfaces:

CredentialValidator, PrincipalSupportingComponent, Component, DestructableComponent, IdentifiableComponent, IdentifiedComponent, InitializableComponent

@ThreadSafeAfterInit
public class LDAPCredentialValidator
extends AbstractUsernamePasswordCredentialValidator

A password validator that authenticates against LDAP natively.

Since:

4.0.0

Nested Class Summary

Nested classes/interfaces inherited from interface net.shibboleth.idp.authn.CredentialValidator

CredentialValidator.ErrorHandler, CredentialValidator.WarningHandler

Field Summary

Fields

Modifier and Type	Field	Description
private Authenticator	authenticator	LDAP authenticator.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,char[]>	passwordLookupStrategy	Optional strategy for obtaining/transforming the password.
private String[]	returnAttributes	Attributes to return from authentication.

Constructor Summary

Constructors

Constructor	Description
LDAPCredentialValidator()

Method Summary

Modifier and Type	Method	Description
protected void	doDestroy()
protected void	doInitialize()
protected Subject	doValidate(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext, UsernamePasswordContext usernamePasswordContext, CredentialValidator.WarningHandler warningHandler, CredentialValidator.ErrorHandler errorHandler)	Override method for subclasses to use to perform the actual validation.
Authenticator	getAuthenticator()	Returns the authenticator.
String[]	getReturnAttributes()	Returns the return attributes.
protected Subject	populateSubject(UsernamePasswordContext usernamePasswordContext, AuthenticationResponse ldapResponse)	Builds a new Subject populated with the necessary data.
void	setAuthenticator(Authenticator auth)	Sets the authenticator.
void	setPasswordLookupStrategy(Function<ProfileRequestContext,char[]> strategy)	Set a strategy function to produce the password to bind with.
void	setReturnAttributes(String... attributes)	Sets the return attributes.

Methods inherited from class net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator

applyTransforms, doValidate, populateSubject, savePasswordToCredentialSet, setLowercase, setMatchExpression, setSavePasswordToCredentialSet, setTransforms, setTrim, setUppercase, setUsernamePasswordContextLookupStrategy

Methods inherited from class net.shibboleth.idp.authn.AbstractCredentialValidator

getLogPrefix, getSupportedPrincipals, isAcceptable, populateSubject, setActivationCondition, setId, setSupportedPrincipals, validate

Methods inherited from class net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent

ensureId, getId, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.IdentifiedComponent

getId

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

authenticator

@NonnullAfterInit
private Authenticator authenticator

LDAP authenticator.

returnAttributes

@Nullable
private String[] returnAttributes

Attributes to return from authentication.

passwordLookupStrategy

@Nullable
private Function<ProfileRequestContext,char[]> passwordLookupStrategy

Optional strategy for obtaining/transforming the password.

Constructor Details

LDAPCredentialValidator

public LDAPCredentialValidator()

Method Details

getAuthenticator

@NonnullAfterInit
public Authenticator getAuthenticator()

Returns the authenticator.

Returns:

authenticator

setAuthenticator

public void setAuthenticator(@Nonnull
 Authenticator auth)

Sets the authenticator.

Parameters:

auth - to authenticate with

getReturnAttributes

@Nullable
public String[] getReturnAttributes()

Returns the return attributes.

Returns:

attribute names

setReturnAttributes

public void setReturnAttributes(@Nullable
 String... attributes)

Sets the return attributes.

Parameters:

attributes - attribute names

setPasswordLookupStrategy

public void setPasswordLookupStrategy(@Nullable
 Function<ProfileRequestContext,char[]> strategy)

Set a strategy function to produce the password to bind with.

Parameters:

strategy - strategy function

doInitialize

protected void doInitialize()
                     throws ComponentInitializationException

Overrides:

doInitialize in class AbstractIdentifiedInitializableComponent

Throws:

ComponentInitializationException

doDestroy

protected void doDestroy()

Overrides:

doDestroy in class AbstractInitializableComponent

doValidate

@Nullable
protected Subject doValidate(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext,
 @Nonnull
 UsernamePasswordContext usernamePasswordContext,
 @Nullable
 CredentialValidator.WarningHandler warningHandler,
 @Nullable
 CredentialValidator.ErrorHandler errorHandler)
                      throws Exception

Override method for subclasses to use to perform the actual validation.

Any configured transforms will have been applied to populate the context with a transformed username prior to this method call.

Specified by:

doValidate in class AbstractUsernamePasswordCredentialValidator

Parameters:

profileRequestContext - profile request context

authenticationContext - authentication context

usernamePasswordContext - the username/password to validate

warningHandler - optional warning handler interface

errorHandler - optional error handler interface

Returns:

the validated result, or null if inapplicable

Throws:

Exception - if an error occurs

populateSubject

@Nonnull
protected Subject populateSubject(@Nonnull
 UsernamePasswordContext usernamePasswordContext,
 @Nonnull
 AuthenticationResponse ldapResponse)

Builds a new Subject populated with the necessary data.

Parameters:

usernamePasswordContext - input context

ldapResponse - LDAP response data

Returns:

the subject to return