AmbariLdapAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { if (isLdapEnabled()) { String username = getUserName(authentication); try { Authentication auth = loadLdapAuthenticationProvider(username).authenticate(authentication); Integer userId = getUserId(auth); return new AmbariAuthentication(auth, userId); } catch (AuthenticationException e) { LOG.debug("Got exception during LDAP authentication attempt", e); Throwable cause = e.getCause(); if ((cause != null) && (cause != e)) { if (cause instanceof org.springframework.ldap.CommunicationException) { if (LOG.isDebugEnabled()) { LOG.warn("Failed to communicate with the LDAP server: " + cause.getMessage(), e); } else { LOG.warn("Failed to communicate with the LDAP server: " + cause.getMessage()); } } else if (cause instanceof org.springframework.ldap.AuthenticationException) { LOG.warn("Looks like LDAP manager credentials (that are used for " + "connecting to LDAP server) are invalid.", e); } } throw new InvalidUsernamePasswordCombinationException(e); } catch (IncorrectResultSizeDataAccessException multipleUsersFound) { String message = configuration.isLdapAlternateUserSearchEnabled() ? String.format("Login Failed: Please append your domain to your username and try again. Example: %s@domain", username) : "Login Failed: More than one user with that username found, please work with your Ambari Administrator to adjust your LDAP configuration"; throw new DuplicateLdapUserFoundAuthenticationException(message); } } else { return null; } } @Inject  AmbariLdapAuthenticationProvider(Configuration configuration,
                                          AmbariLdapAuthoritiesPopulator authoritiesPopulator, UserDAO userDAO); @Override Authentication authenticate(Authentication authentication); @Override boolean supports(Class<?> authentication);  }
@Test(expected = InvalidUsernamePasswordCombinationException.class) public void testBadCredential() throws Exception { Authentication authentication = new UsernamePasswordAuthenticationToken("notFound", "wrong"); authenticationProvider.authenticate(authentication); }
@Test public void testAuthenticate() throws Exception { assertNull("User alread exists in DB", userDAO.findLdapUserByName("allowedUser")); users.createUser("allowedUser", "password", UserType.LDAP, true, false); UserEntity ldapUser = userDAO.findLdapUserByName("allowedUser"); Authentication authentication = new UsernamePasswordAuthenticationToken("allowedUser", "password"); AmbariAuthentication result = (AmbariAuthentication) authenticationProvider.authenticate(authentication); assertTrue(result.isAuthenticated()); assertEquals(ldapUser.getUserId(), result.getUserId()); result = (AmbariAuthentication) authenticationProvider.authenticate(authentication); assertTrue(result.isAuthenticated()); assertEquals(ldapUser.getUserId(), result.getUserId()); }
@Test public void testDisabled() throws Exception { configuration.setClientSecurityType(ClientSecurityType.LOCAL); Authentication authentication = new UsernamePasswordAuthenticationToken("allowedUser", "password"); Authentication auth = authenticationProvider.authenticate(authentication); Assert.assertTrue(auth == null); }
@Test public void testAuthenticateLoginAlias() throws Exception { assertNull("User already exists in DB", userDAO.findLdapUserByName("allowedUser@ambari.apache.org")); users.createUser("allowedUser@ambari.apache.org", "password", UserType.LDAP, true, false); Authentication authentication = new UsernamePasswordAuthenticationToken("allowedUser@ambari.apache.org", "password"); configuration.setProperty(Configuration.LDAP_ALT_USER_SEARCH_ENABLED.getKey(), "true"); Authentication result = authenticationProvider.authenticate(authentication); assertTrue(result.isAuthenticated()); }
@Test(expected = InvalidUsernamePasswordCombinationException.class) public void testBadCredentialsForMissingLoginAlias() throws Exception { assertNull("User already exists in DB", userDAO.findLdapUserByName("allowedUser")); Authentication authentication = new UsernamePasswordAuthenticationToken("missingloginalias@ambari.apache.org", "password"); configuration.setProperty(Configuration.LDAP_ALT_USER_SEARCH_ENABLED.getKey(), "true"); authenticationProvider.authenticate(authentication); }
@Test(expected = InvalidUsernamePasswordCombinationException.class) public void testBadCredentialsBadPasswordForLoginAlias() throws Exception { assertNull("User already exists in DB", userDAO.findLdapUserByName("allowedUser")); Authentication authentication = new UsernamePasswordAuthenticationToken("allowedUser@ambari.apache.org", "bad_password"); configuration.setProperty(Configuration.LDAP_ALT_USER_SEARCH_ENABLED.getKey(), "true"); authenticationProvider.authenticate(authentication); }