## org.mortbay.jetty.plus.jaas.ldap
Class LdapLoginModule

    java.lang.Object
      org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule
          org.mortbay.jetty.plus.jaas.ldap.LdapLoginModule

All Implemented Interfaces:
  javax.security.auth.spi.LoginModule

    public class LdapLoginModule

extends AbstractLoginModule

A LdapLoginModule for use with JAAS setups The jvm should be started with the following parameter:
`-Djava.security.auth.login.config=etc/ldap-loginModule.conf`
and an example of the ldap-loginModule.conf would be:

     ldaploginmodule {
        org.mortbay.jetty.plus.jaas.spi.LdapLoginModule required
        debug="true"
        useLdaps="false"
        contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
        hostname="ldap.example.com"
        port="389"
        bindDn="cn=Directory Manager"
        bindPassword="directory"
        authenticationMethod="simple"
        forceBindingLogin="false"
        userBaseDn="ou=people,dc=alcatel"
        userRdnAttribute="uid"
        userIdAttribute="uid"
        userPasswordAttribute="userPassword"
        userObjectClass="inetOrgPerson"
        roleBaseDn="ou=groups,dc=example,dc=com"
        roleNameAttribute="cn"
        roleMemberAttribute="uniqueMember"
        roleObjectClass="groupOfUniqueNames";
        };

Author:
  Jesse McConnell <jesse@codehaus.org>, Frederic Nizery <frederic.nizery@alcatel-lucent.fr>, Trygve Laugstol <trygvis@codehaus.org>

Nested Class Summary

Nested classes/interfaces inherited from class org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule
`AbstractLoginModule.JAASUserInfo`

Constructor Summary
`LdapLoginModule()`

Method Summary
`boolean` `abort()`
`protected boolean` `bindingLogin(java.lang.String username, java.lang.Object password)` binding authentication check This methode of authentication works only if the user branch of the DIT (ldap tree) has an ACI (acces control instruction) that allow the access to any user or at least for the user that logs in.
`boolean` `commit()`
`static java.lang.String` `convertCredentialJettyToLdap(java.lang.String encryptedPassword)`
`static java.lang.String` `convertCredentialLdapToJetty(java.lang.String encryptedPassword)`
`protected boolean` `credentialLogin(java.lang.Object webCredential)` password supplied authentication check
`protected java.lang.String` `doRFC2254Encoding(java.lang.String inputString)`
`java.util.Hashtable` `getEnvironment()` get the context for connection
`UserInfo` `getUserInfo(java.lang.String username)` get the available information about the user for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario roles are also an optional concept if required
`void` `initialize(javax.security.auth.Subject subject, javax.security.auth.callback.CallbackHandler callbackHandler, java.util.Map sharedState, java.util.Map options)`
`boolean` `login()` since ldap uses a context bind for valid authentication checking, we override login() if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic

Methods inherited from class org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule
`configureCallbacks, getCallbackHandler, getCurrentUser, getSubject, isAuthenticated, isCommitted, logout, setAuthenticated, setCallbackHandler, setCommitted, setCurrentUser, setSubject`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Constructor Detail

### LdapLoginModule

    public LdapLoginModule()

Method Detail

### getUserInfo

    public UserInfo getUserInfo(java.lang.String username)
                         throws java.lang.Exception

  get the available information about the user

  for this LoginModule, the credential can be null which will result in a binding ldap authentication scenario

  roles are also an optional concept if required

  Specified by:
    `getUserInfo` in class `AbstractLoginModule`
  Parameters:
    `username` -
  Returns:
  Throws:
    `java.lang.Exception`

### doRFC2254Encoding

    protected java.lang.String doRFC2254Encoding(java.lang.String inputString)

### login

    public boolean login()
                  throws javax.security.auth.login.LoginException

  since ldap uses a context bind for valid authentication checking, we override login()

  if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check, otherwise if we have the users encoded password then we can try authentication via that mechanic

  Specified by:
    `login` in interface `javax.security.auth.spi.LoginModule`
  Overrides:
    `login` in class `AbstractLoginModule`
  Returns:
  Throws:
    `javax.security.auth.login.LoginException`
  See Also:
    `LoginModule.login()`

### credentialLogin

    protected boolean credentialLogin(java.lang.Object webCredential)
                               throws javax.security.auth.login.LoginException

  password supplied authentication check

  Parameters:
    `webCredential` -
  Returns:
  Throws:
    `javax.security.auth.login.LoginException`

### bindingLogin

    protected boolean bindingLogin(java.lang.String username,
                                   java.lang.Object password)
                            throws javax.security.auth.login.LoginException,
                                   javax.naming.NamingException

  binding authentication check This methode of authentication works only if the user branch of the DIT (ldap tree) has an ACI (acces control instruction) that allow the access to any user or at least for the user that logs in.

  Parameters:
    `username` -
    `password` -
  Returns:
  Throws:
    `javax.security.auth.login.LoginException`
    `javax.naming.NamingException`

### initialize

    public void initialize(javax.security.auth.Subject subject,
                           javax.security.auth.callback.CallbackHandler callbackHandler,
                           java.util.Map sharedState,
                           java.util.Map options)

  Specified by:
    `initialize` in interface `javax.security.auth.spi.LoginModule`
  Overrides:
    `initialize` in class `AbstractLoginModule`
  See Also:
    `LoginModule.initialize(javax.security.auth.Subject, javax.security.auth.callback.CallbackHandler, java.util.Map, java.util.Map)`

### commit

    public boolean commit()
                   throws javax.security.auth.login.LoginException

  Specified by:
    `commit` in interface `javax.security.auth.spi.LoginModule`
  Overrides:
    `commit` in class `AbstractLoginModule`
  Throws:
    `javax.security.auth.login.LoginException`
  See Also:
    `LoginModule.commit()`

### abort

    public boolean abort()
                  throws javax.security.auth.login.LoginException

  Specified by:
    `abort` in interface `javax.security.auth.spi.LoginModule`
  Overrides:
    `abort` in class `AbstractLoginModule`
  Throws:
    `javax.security.auth.login.LoginException`
  See Also:
    `LoginModule.abort()`

### getEnvironment

    public java.util.Hashtable getEnvironment()

  get the context for connection

  Returns:

### convertCredentialJettyToLdap

    public static java.lang.String convertCredentialJettyToLdap(java.lang.String encryptedPassword)

### convertCredentialLdapToJetty

    public static java.lang.String convertCredentialLdapToJetty(java.lang.String encryptedPassword)

Copyright © 1995-2010 Mort Bay Consulting. All Rights Reserved.