LdapAuthenticator implements Authenticator<BasicCredentials, User> { @Override public Optional<User> authenticate(BasicCredentials credentials) { User user = null; try { String username = credentials.getUsername(); if (!User.isSanitizedUsername(username)) { logger.info("Username: {} must match pattern: {}", username, User.USERNAME_PATTERN); return Optional.empty(); } String userDN = dnFromUsername(username); String password = credentials.getPassword(); if (Strings.isNullOrEmpty(password)) { logger.info("No password for user provided"); return Optional.empty(); } LDAPConnection authenticatedConnection = connectionFactory.getLDAPConnection(userDN, password); authenticatedConnection.close(); Set<String> requiredRoles = config.getRequiredRoles(); if (!requiredRoles.isEmpty()) { Set<String> roles = rolesFromDN(userDN); boolean accessAllowed = false; for (String requiredRole : requiredRoles) { if (roles.contains(requiredRole)) { accessAllowed = true; } } if (!accessAllowed) { logger.warn("User {} not in one of required LDAP roles: [{}].", username, requiredRoles); throw new ForbiddenException(); } } user = User.named(username); } catch (LDAPException le) { if (le.getResultCode() != ResultCode.INVALID_CREDENTIALS) { logger.error("Error connecting to LDAP", le); throw Throwables.propagate(le); } } catch (GeneralSecurityException gse) { logger.error("TLS error connecting to LDAP", gse); throw Throwables.propagate(gse); } return Optional.ofNullable(user); } LdapAuthenticator(LdapConnectionFactory connectionFactory, LdapLookupConfig config); @Override Optional<User> authenticate(BasicCredentials credentials);  }
@Ignore @Test public void ldapAuthenticatorCreatesUserOnSuccess() throws Exception { when(ldapConnectionFactory.getLDAPConnection(PEOPLE_DN, "validpass")) .thenReturn(ldapUserAuthConnection); User user = ldapAuthenticator.authenticate(new BasicCredentials("sysadmin", "validpass")) .orElseThrow(RuntimeException::new); assertThat(user).isEqualTo(User.named("sysadmin")); }
@Ignore @Test public void ldapAuthenticatorThrowsWhenAuthFails() throws Exception { when(dnSearchResult.getEntryCount()).thenReturn(0); Optional<User> missingUser = ldapAuthenticator.authenticate(new BasicCredentials("sysadmin", "badpass")); assertThat(missingUser).isEmpty(); }
@Ignore @Test public void ldapAuthenticatorRejectsInvalidUsername() throws Exception { String crazyUsername = "sysadmin)`~!@#$%^&*()+=[]{}\\|;:'\",<>?/\r\n\t"; Optional<User> missingUser = ldapAuthenticator.authenticate(new BasicCredentials(crazyUsername, "badpass")); assertThat(missingUser).isEmpty(); }
@Ignore @Test public void ldapAuthenticatorRejectsEmptyPassword() throws Exception { Optional<User> user = ldapAuthenticator.authenticate(new BasicCredentials("sysadmin", "")); assertThat(user).isEmpty(); }