LdapRealm extends JndiLdapRealm { protected Set<String> rolesFor(PrincipalCollection principals, String userNameIn, final LdapContext ldapCtx, final LdapContextFactory ldapContextFactory, Session session) throws NamingException { final Set<String> roleNames = new HashSet<>(); final Set<String> groupNames = new HashSet<>(); final String userName; if (getUserLowerCase()) { log.debug("userLowerCase true"); userName = userNameIn.toLowerCase(); } else { userName = userNameIn; } String userDn = getUserDnForSearch(userName); int pageSize = getPagingSize(); if (log.isDebugEnabled()) { log.debug("Ldap PagingSize: " + pageSize); } int numResults = 0; byte[] cookie = null; try { ldapCtx.addToEnvironment(Context.REFERRAL, "ignore"); ldapCtx.setRequestControls(new Control[]{new PagedResultsControl(pageSize, Control.NONCRITICAL)}); do { NamingEnumeration<SearchResult> searchResultEnum = null; SearchControls searchControls = getGroupSearchControls(); try { if (groupSearchEnableMatchingRuleInChain) { searchResultEnum = ldapCtx.search( getGroupSearchBase(), String.format( MATCHING_RULE_IN_CHAIN_FORMAT, groupObjectClass, memberAttribute, userDn), searchControls); while (searchResultEnum != null && searchResultEnum.hasMore()) { numResults++; final SearchResult group = searchResultEnum.next(); Attribute attribute = group.getAttributes().get(getGroupIdAttribute()); String groupName = attribute.get().toString(); String roleName = roleNameFor(groupName); if (roleName != null) { roleNames.add(roleName); } else { roleNames.add(groupName); } } } else { String searchFilter = String.format("(objectclass=%1$s)", groupObjectClass); if (groupSearchFilter != null) { searchFilter = expandTemplate(groupSearchFilter, userName); } if (log.isDebugEnabled()) { log.debug("Group SearchBase|SearchFilter|GroupSearchScope: " + getGroupSearchBase() + "|" + searchFilter + "|" + groupSearchScope); } searchResultEnum = ldapCtx.search( getGroupSearchBase(), searchFilter, searchControls); while (searchResultEnum != null && searchResultEnum.hasMore()) { numResults++; final SearchResult group = searchResultEnum.next(); addRoleIfMember(userDn, group, roleNames, groupNames, ldapContextFactory); } } } catch (PartialResultException e) { log.debug("Ignoring PartitalResultException"); } finally { if (searchResultEnum != null) { searchResultEnum.close(); } } ldapCtx.setRequestControls(new Control[]{new PagedResultsControl(pageSize, cookie, Control.CRITICAL)}); } while (cookie != null); } catch (SizeLimitExceededException e) { log.info("Only retrieved first " + numResults + " groups due to SizeLimitExceededException."); } catch (IOException e) { log.error("Unabled to setup paged results"); } session.setAttribute(SUBJECT_USER_ROLES, roleNames); session.setAttribute(SUBJECT_USER_GROUPS, groupNames); if (!groupNames.isEmpty() && (principals instanceof MutablePrincipalCollection)) { ((MutablePrincipalCollection) principals).addAll(groupNames, getName()); } if (log.isDebugEnabled()) { log.debug("User RoleNames: " + userName + "::" + roleNames); } return roleNames; } LdapRealm(); void setHadoopSecurityCredentialPath(String hadoopSecurityCredentialPath); @Override AuthorizationInfo queryForAuthorizationInfo(final PrincipalCollection principals,
      final LdapContextFactory ldapContextFactory); Map<String, String> getListRoles(); String getSearchBase(); void setSearchBase(String searchBase); String getUserSearchBase(); void setUserSearchBase(String userSearchBase); int getPagingSize(); void setPagingSize(int pagingSize); String getGroupSearchBase(); void setGroupSearchBase(String groupSearchBase); String getGroupObjectClass(); void setGroupObjectClass(String groupObjectClassAttribute); String getMemberAttribute(); void setMemberAttribute(String memberAttribute); String getGroupIdAttribute(); void setGroupIdAttribute(String groupIdAttribute); void setMemberAttributeValueTemplate(String template); void setAllowedRolesForAuthentication(List<String> allowedRolesForAuthencation); void setRolesByGroup(Map<String, String> rolesByGroup); Map<String, String> getRolesByGroup(); void setPermissionsByRole(String permissionsByRoleStr); Map<String, List<String>> getPermissionsByRole(); boolean isAuthorizationEnabled(); void setAuthorizationEnabled(boolean authorizationEnabled); String getUserSearchAttributeName(); void setUserSearchAttributeName(String userSearchAttributeName); String getUserObjectClass(); void setUserObjectClass(String userObjectClass); String getPrincipalRegex(); void setPrincipalRegex(String regex); String getUserSearchAttributeTemplate(); void setUserSearchAttributeTemplate(final String template); String getUserSearchFilter(); void setUserSearchFilter(final String filter); String getGroupSearchFilter(); void setGroupSearchFilter(final String filter); boolean getUserLowerCase(); void setUserLowerCase(boolean userLowerCase); String getUserSearchScope(); void setUserSearchScope(final String scope); String getGroupSearchScope(); void setGroupSearchScope(final String scope); boolean isGroupSearchEnableMatchingRuleInChain(); void setGroupSearchEnableMatchingRuleInChain(
      boolean groupSearchEnableMatchingRuleInChain); @Override void setUserDnTemplate(final String template);  }
@Test public void testRolesFor() throws NamingException { LdapRealm realm = new LdapRealm(); realm.setGroupSearchBase("cn=groups,dc=apache"); realm.setGroupObjectClass("posixGroup"); realm.setMemberAttributeValueTemplate("cn={0},ou=people,dc=apache"); HashMap<String, String> rolesByGroups = new HashMap<>(); rolesByGroups.put("group-three", "zeppelin-role"); realm.setRolesByGroup(rolesByGroups); LdapContextFactory ldapContextFactory = mock(LdapContextFactory.class); LdapContext ldapCtx = mock(LdapContext.class); Session session = mock(Session.class); BasicAttributes group1 = new BasicAttributes(); group1.put(realm.getGroupIdAttribute(), "group-one"); group1.put(realm.getMemberAttribute(), "principal"); BasicAttributes group2 = new BasicAttributes(); group2.put(realm.getGroupIdAttribute(), "group-two"); group2.put(realm.getMemberAttribute(), "someoneelse"); BasicAttributes group3 = new BasicAttributes(); group3.put(realm.getGroupIdAttribute(), "group-three"); group3.put(realm.getMemberAttribute(), "principal"); NamingEnumeration<SearchResult> results = enumerationOf(group1, group2, group3); when(ldapCtx.search(any(String.class), any(String.class), any(SearchControls.class))) .thenReturn(results); Set<String> roles = realm.rolesFor( new SimplePrincipalCollection("principal", "ldapRealm"), "principal", ldapCtx, ldapContextFactory, session); verify(ldapCtx).search("cn=groups,dc=apache", "(objectclass=posixGroup)", realm.getGroupSearchControls()); assertEquals(new HashSet(Arrays.asList("group-one", "zeppelin-role")), roles); }