@Test(expected = AuthorizerCreationException.class) public void testSearchGroupsWithoutMemberAttribute() throws Exception { final AuthorizerConfigurationContext configurationContext = getBaseConfiguration(null, GROUP_SEARCH_BASE); ldapUserGroupProvider.onConfigured(configurationContext); }
@Override public void onConfigured(final AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { final LdapContextSource context = new LdapContextSource(); final Map<String, Object> baseEnvironment = new HashMap<>(); setTimeout(configurationContext, baseEnvironment, PROP_CONNECT_TIMEOUT, "com.sun.jndi.ldap.connect.timeout"); setTimeout(configurationContext, baseEnvironment, PROP_READ_TIMEOUT, "com.sun.jndi.ldap.read.timeout"); final PropertyValue rawAuthenticationStrategy = configurationContext.getProperty(PROP_AUTHENTICATION_STRATEGY); final LdapAuthenticationStrategy authenticationStrategy; try { authenticationStrategy = LdapAuthenticationStrategy.valueOf(rawAuthenticationStrategy.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized authentication strategy '%s'. Possible values are [%s]", rawAuthenticationStrategy.getValue(), StringUtils.join(LdapAuthenticationStrategy.values(), ", "))); } switch (authenticationStrategy) { case ANONYMOUS: context.setAnonymousReadOnly(true); break; default: final String userDn = configurationContext.getProperty(PROP_MANAGER_DN).getValue(); final String password = configurationContext.getProperty(PROP_MANAGER_PASSWORD).getValue(); context.setUserDn(userDn); context.setPassword(password); switch (authenticationStrategy) { case SIMPLE: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); break; case LDAPS: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); baseEnvironment.put(Context.SECURITY_PROTOCOL, "ssl"); final SSLContext ldapsSslContext = getConfiguredSslContext(configurationContext); if (ldapsSslContext != null) { LdapsSocketFactory.initialize(ldapsSslContext.getSocketFactory()); baseEnvironment.put("java.naming.ldap.factory.socket", LdapsSocketFactory.class.getName()); } break; case START_TLS: final AbstractTlsDirContextAuthenticationStrategy tlsAuthenticationStrategy = new DefaultTlsDirContextAuthenticationStrategy(); final String rawShutdownGracefully = configurationContext.getProperty("TLS - Shutdown Gracefully").getValue(); if (StringUtils.isNotBlank(rawShutdownGracefully)) { final boolean shutdownGracefully = Boolean.TRUE.toString().equalsIgnoreCase(rawShutdownGracefully); tlsAuthenticationStrategy.setShutdownTlsGracefully(shutdownGracefully); } final SSLContext startTlsSslContext = getConfiguredSslContext(configurationContext); if (startTlsSslContext != null) { tlsAuthenticationStrategy.setSslSocketFactory(startTlsSslContext.getSocketFactory()); } context.setAuthenticationStrategy(tlsAuthenticationStrategy); break; } break; } final String rawReferralStrategy = configurationContext.getProperty(PROP_REFERRAL_STRATEGY).getValue(); final ReferralStrategy referralStrategy; try { referralStrategy = ReferralStrategy.valueOf(rawReferralStrategy); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized referral strategy '%s'. Possible values are [%s]", rawReferralStrategy, StringUtils.join(ReferralStrategy.values(), ", "))); } context.setReferral(referralStrategy.getValue()); final String urls = configurationContext.getProperty(PROP_URL).getValue(); if (StringUtils.isBlank(urls)) { throw new AuthorizerCreationException("LDAP identity provider 'Url' must be specified."); } context.setUrls(StringUtils.split(urls)); final PropertyValue rawUserSearchBase = configurationContext.getProperty(PROP_USER_SEARCH_BASE); final PropertyValue rawUserObjectClass = configurationContext.getProperty(PROP_USER_OBJECT_CLASS); final PropertyValue rawUserSearchScope = configurationContext.getProperty(PROP_USER_SEARCH_SCOPE); if (rawUserSearchBase.isSet() && !rawUserObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Object Class' must be specified when 'User Search Base' is set."); } if (rawUserSearchBase.isSet() && !rawUserSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Scope' must be specified when 'User Search Base' is set."); } userSearchBase = rawUserSearchBase.getValue(); userObjectClass = rawUserObjectClass.getValue(); userSearchFilter = configurationContext.getProperty(PROP_USER_SEARCH_FILTER).getValue(); userIdentityAttribute = configurationContext.getProperty(PROP_USER_IDENTITY_ATTRIBUTE).getValue(); userGroupNameAttribute = configurationContext.getProperty(PROP_USER_GROUP_ATTRIBUTE).getValue(); userGroupReferencedGroupAttribute = configurationContext.getProperty(PROP_USER_GROUP_REFERENCED_GROUP_ATTRIBUTE).getValue(); try { userSearchScope = SearchScope.valueOf(rawUserSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized user search scope '%s'. Possible values are [%s]", rawUserSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForUserIdentity = StringUtils.isBlank(userIdentityAttribute); performUserSearch = StringUtils.isNotBlank(userSearchBase); final PropertyValue rawGroupSearchBase = configurationContext.getProperty(PROP_GROUP_SEARCH_BASE); final PropertyValue rawGroupObjectClass = configurationContext.getProperty(PROP_GROUP_OBJECT_CLASS); final PropertyValue rawGroupSearchScope = configurationContext.getProperty(PROP_GROUP_SEARCH_SCOPE); if (rawGroupSearchBase.isSet() && !rawGroupObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Object Class' must be specified when 'Group Search Base' is set."); } if (rawGroupSearchBase.isSet() && !rawGroupSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Search Scope' must be specified when 'Group Search Base' is set."); } groupSearchBase = rawGroupSearchBase.getValue(); groupObjectClass = rawGroupObjectClass.getValue(); groupSearchFilter = configurationContext.getProperty(PROP_GROUP_SEARCH_FILTER).getValue(); groupNameAttribute = configurationContext.getProperty(PROP_GROUP_NAME_ATTRIBUTE).getValue(); groupMemberAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_ATTRIBUTE).getValue(); groupMemberReferencedUserAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_REFERENCED_USER_ATTRIBUTE).getValue(); try { groupSearchScope = SearchScope.valueOf(rawGroupSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized group search scope '%s'. Possible values are [%s]", rawGroupSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForGroupName = StringUtils.isBlank(groupNameAttribute); performGroupSearch = StringUtils.isNotBlank(groupSearchBase); if (!performUserSearch && !performGroupSearch) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Base' or 'Group Search Base' must be specified."); } if (performGroupSearch && !performUserSearch && StringUtils.isBlank(groupMemberAttribute)) { throw new AuthorizerCreationException("'Group Member Attribute' is required when searching groups but not users."); } if (StringUtils.isNotBlank(groupMemberReferencedUserAttribute) && !performUserSearch) { throw new AuthorizerCreationException("''User Search Base' must be set when specifying 'Group Member Attribute - Referenced User Attribute'."); } if (StringUtils.isNotBlank(userGroupReferencedGroupAttribute) && !performGroupSearch) { throw new AuthorizerCreationException("'Group Search Base' must be set when specifying 'User Group Name Attribute - Referenced Group Attribute'."); } final PropertyValue rawPageSize = configurationContext.getProperty(PROP_PAGE_SIZE); if (rawPageSize.isSet() && StringUtils.isNotBlank(rawPageSize.getValue())) { pageSize = rawPageSize.asInteger(); } identityMappings = Collections.unmodifiableList(IdentityMappingUtil.getIdentityMappings(properties)); groupMappings = Collections.unmodifiableList(IdentityMappingUtil.getGroupMappings(properties)); if (!baseEnvironment.isEmpty()) { context.setBaseEnvironmentProperties(baseEnvironment); } try { context.afterPropertiesSet(); } catch (final Exception e) { throw new AuthorizerCreationException(e.getMessage(), e); } final PropertyValue rawSyncInterval = configurationContext.getProperty(PROP_SYNC_INTERVAL); final long syncInterval; if (rawSyncInterval.isSet()) { try { syncInterval = FormatUtils.getTimeDuration(rawSyncInterval.getValue(), TimeUnit.MILLISECONDS); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("The %s '%s' is not a valid time duration", PROP_SYNC_INTERVAL, rawSyncInterval.getValue())); } if (syncInterval < MINIMUM_SYNC_INTERVAL_MILLISECONDS) { throw new AuthorizerCreationException(String.format("The %s '%s' is below the minimum value of '%d ms'", PROP_SYNC_INTERVAL, rawSyncInterval.getValue(), MINIMUM_SYNC_INTERVAL_MILLISECONDS)); } } else { throw new AuthorizerCreationException(String.format("The '%s' must be specified.", PROP_SYNC_INTERVAL)); } try { load(context); if (tenants.get() == null) { throw new AuthorizerCreationException("Unable to sync users and groups."); } ldapSync.scheduleWithFixedDelay(() -> load(context), syncInterval, syncInterval, TimeUnit.MILLISECONDS); } catch (final AuthorizationAccessException e) { throw new AuthorizerCreationException(e); } }
LdapUserGroupProvider implements UserGroupProvider { @Override public void onConfigured(final AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { final LdapContextSource context = new LdapContextSource(); final Map<String, Object> baseEnvironment = new HashMap<>(); setTimeout(configurationContext, baseEnvironment, PROP_CONNECT_TIMEOUT, "com.sun.jndi.ldap.connect.timeout"); setTimeout(configurationContext, baseEnvironment, PROP_READ_TIMEOUT, "com.sun.jndi.ldap.read.timeout"); final PropertyValue rawAuthenticationStrategy = configurationContext.getProperty(PROP_AUTHENTICATION_STRATEGY); final LdapAuthenticationStrategy authenticationStrategy; try { authenticationStrategy = LdapAuthenticationStrategy.valueOf(rawAuthenticationStrategy.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized authentication strategy '%s'. Possible values are [%s]", rawAuthenticationStrategy.getValue(), StringUtils.join(LdapAuthenticationStrategy.values(), ", "))); } switch (authenticationStrategy) { case ANONYMOUS: context.setAnonymousReadOnly(true); break; default: final String userDn = configurationContext.getProperty(PROP_MANAGER_DN).getValue(); final String password = configurationContext.getProperty(PROP_MANAGER_PASSWORD).getValue(); context.setUserDn(userDn); context.setPassword(password); switch (authenticationStrategy) { case SIMPLE: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); break; case LDAPS: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); baseEnvironment.put(Context.SECURITY_PROTOCOL, "ssl"); final SSLContext ldapsSslContext = getConfiguredSslContext(configurationContext); if (ldapsSslContext != null) { LdapsSocketFactory.initialize(ldapsSslContext.getSocketFactory()); baseEnvironment.put("java.naming.ldap.factory.socket", LdapsSocketFactory.class.getName()); } break; case START_TLS: final AbstractTlsDirContextAuthenticationStrategy tlsAuthenticationStrategy = new DefaultTlsDirContextAuthenticationStrategy(); final String rawShutdownGracefully = configurationContext.getProperty("TLS - Shutdown Gracefully").getValue(); if (StringUtils.isNotBlank(rawShutdownGracefully)) { final boolean shutdownGracefully = Boolean.TRUE.toString().equalsIgnoreCase(rawShutdownGracefully); tlsAuthenticationStrategy.setShutdownTlsGracefully(shutdownGracefully); } final SSLContext startTlsSslContext = getConfiguredSslContext(configurationContext); if (startTlsSslContext != null) { tlsAuthenticationStrategy.setSslSocketFactory(startTlsSslContext.getSocketFactory()); } context.setAuthenticationStrategy(tlsAuthenticationStrategy); break; } break; } final String rawReferralStrategy = configurationContext.getProperty(PROP_REFERRAL_STRATEGY).getValue(); final ReferralStrategy referralStrategy; try { referralStrategy = ReferralStrategy.valueOf(rawReferralStrategy); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized referral strategy '%s'. Possible values are [%s]", rawReferralStrategy, StringUtils.join(ReferralStrategy.values(), ", "))); } context.setReferral(referralStrategy.getValue()); final String urls = configurationContext.getProperty(PROP_URL).getValue(); if (StringUtils.isBlank(urls)) { throw new AuthorizerCreationException("LDAP identity provider 'Url' must be specified."); } context.setUrls(StringUtils.split(urls)); final PropertyValue rawUserSearchBase = configurationContext.getProperty(PROP_USER_SEARCH_BASE); final PropertyValue rawUserObjectClass = configurationContext.getProperty(PROP_USER_OBJECT_CLASS); final PropertyValue rawUserSearchScope = configurationContext.getProperty(PROP_USER_SEARCH_SCOPE); if (rawUserSearchBase.isSet() && !rawUserObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Object Class' must be specified when 'User Search Base' is set."); } if (rawUserSearchBase.isSet() && !rawUserSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Scope' must be specified when 'User Search Base' is set."); } userSearchBase = rawUserSearchBase.getValue(); userObjectClass = rawUserObjectClass.getValue(); userSearchFilter = configurationContext.getProperty(PROP_USER_SEARCH_FILTER).getValue(); userIdentityAttribute = configurationContext.getProperty(PROP_USER_IDENTITY_ATTRIBUTE).getValue(); userGroupNameAttribute = configurationContext.getProperty(PROP_USER_GROUP_ATTRIBUTE).getValue(); userGroupReferencedGroupAttribute = configurationContext.getProperty(PROP_USER_GROUP_REFERENCED_GROUP_ATTRIBUTE).getValue(); try { userSearchScope = SearchScope.valueOf(rawUserSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized user search scope '%s'. Possible values are [%s]", rawUserSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForUserIdentity = StringUtils.isBlank(userIdentityAttribute); performUserSearch = StringUtils.isNotBlank(userSearchBase); final PropertyValue rawGroupSearchBase = configurationContext.getProperty(PROP_GROUP_SEARCH_BASE); final PropertyValue rawGroupObjectClass = configurationContext.getProperty(PROP_GROUP_OBJECT_CLASS); final PropertyValue rawGroupSearchScope = configurationContext.getProperty(PROP_GROUP_SEARCH_SCOPE); if (rawGroupSearchBase.isSet() && !rawGroupObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Object Class' must be specified when 'Group Search Base' is set."); } if (rawGroupSearchBase.isSet() && !rawGroupSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Search Scope' must be specified when 'Group Search Base' is set."); } groupSearchBase = rawGroupSearchBase.getValue(); groupObjectClass = rawGroupObjectClass.getValue(); groupSearchFilter = configurationContext.getProperty(PROP_GROUP_SEARCH_FILTER).getValue(); groupNameAttribute = configurationContext.getProperty(PROP_GROUP_NAME_ATTRIBUTE).getValue(); groupMemberAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_ATTRIBUTE).getValue(); groupMemberReferencedUserAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_REFERENCED_USER_ATTRIBUTE).getValue(); try { groupSearchScope = SearchScope.valueOf(rawGroupSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized group search scope '%s'. Possible values are [%s]", rawGroupSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForGroupName = StringUtils.isBlank(groupNameAttribute); performGroupSearch = StringUtils.isNotBlank(groupSearchBase); if (!performUserSearch && !performGroupSearch) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Base' or 'Group Search Base' must be specified."); } if (performGroupSearch && !performUserSearch && StringUtils.isBlank(groupMemberAttribute)) { throw new AuthorizerCreationException("'Group Member Attribute' is required when searching groups but not users."); } if (StringUtils.isNotBlank(groupMemberReferencedUserAttribute) && !performUserSearch) { throw new AuthorizerCreationException("''User Search Base' must be set when specifying 'Group Member Attribute - Referenced User Attribute'."); } if (StringUtils.isNotBlank(userGroupReferencedGroupAttribute) && !performGroupSearch) { throw new AuthorizerCreationException("'Group Search Base' must be set when specifying 'User Group Name Attribute - Referenced Group Attribute'."); } final PropertyValue rawPageSize = configurationContext.getProperty(PROP_PAGE_SIZE); if (rawPageSize.isSet() && StringUtils.isNotBlank(rawPageSize.getValue())) { pageSize = rawPageSize.asInteger(); } identityMappings = Collections.unmodifiableList(IdentityMappingUtil.getIdentityMappings(properties)); groupMappings = Collections.unmodifiableList(IdentityMappingUtil.getGroupMappings(properties)); if (!baseEnvironment.isEmpty()) { context.setBaseEnvironmentProperties(baseEnvironment); } try { context.afterPropertiesSet(); } catch (final Exception e) { throw new AuthorizerCreationException(e.getMessage(), e); } final PropertyValue rawSyncInterval = configurationContext.getProperty(PROP_SYNC_INTERVAL); final long syncInterval; if (rawSyncInterval.isSet()) { try { syncInterval = FormatUtils.getTimeDuration(rawSyncInterval.getValue(), TimeUnit.MILLISECONDS); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("The %s '%s' is not a valid time duration", PROP_SYNC_INTERVAL, rawSyncInterval.getValue())); } if (syncInterval < MINIMUM_SYNC_INTERVAL_MILLISECONDS) { throw new AuthorizerCreationException(String.format("The %s '%s' is below the minimum value of '%d ms'", PROP_SYNC_INTERVAL, rawSyncInterval.getValue(), MINIMUM_SYNC_INTERVAL_MILLISECONDS)); } } else { throw new AuthorizerCreationException(String.format("The '%s' must be specified.", PROP_SYNC_INTERVAL)); } try { load(context); if (tenants.get() == null) { throw new AuthorizerCreationException("Unable to sync users and groups."); } ldapSync.scheduleWithFixedDelay(() -> load(context), syncInterval, syncInterval, TimeUnit.MILLISECONDS); } catch (final AuthorizationAccessException e) { throw new AuthorizerCreationException(e); } } }
LdapUserGroupProvider implements UserGroupProvider { @Override public void onConfigured(final AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { final LdapContextSource context = new LdapContextSource(); final Map<String, Object> baseEnvironment = new HashMap<>(); setTimeout(configurationContext, baseEnvironment, PROP_CONNECT_TIMEOUT, "com.sun.jndi.ldap.connect.timeout"); setTimeout(configurationContext, baseEnvironment, PROP_READ_TIMEOUT, "com.sun.jndi.ldap.read.timeout"); final PropertyValue rawAuthenticationStrategy = configurationContext.getProperty(PROP_AUTHENTICATION_STRATEGY); final LdapAuthenticationStrategy authenticationStrategy; try { authenticationStrategy = LdapAuthenticationStrategy.valueOf(rawAuthenticationStrategy.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized authentication strategy '%s'. Possible values are [%s]", rawAuthenticationStrategy.getValue(), StringUtils.join(LdapAuthenticationStrategy.values(), ", "))); } switch (authenticationStrategy) { case ANONYMOUS: context.setAnonymousReadOnly(true); break; default: final String userDn = configurationContext.getProperty(PROP_MANAGER_DN).getValue(); final String password = configurationContext.getProperty(PROP_MANAGER_PASSWORD).getValue(); context.setUserDn(userDn); context.setPassword(password); switch (authenticationStrategy) { case SIMPLE: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); break; case LDAPS: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); baseEnvironment.put(Context.SECURITY_PROTOCOL, "ssl"); final SSLContext ldapsSslContext = getConfiguredSslContext(configurationContext); if (ldapsSslContext != null) { LdapsSocketFactory.initialize(ldapsSslContext.getSocketFactory()); baseEnvironment.put("java.naming.ldap.factory.socket", LdapsSocketFactory.class.getName()); } break; case START_TLS: final AbstractTlsDirContextAuthenticationStrategy tlsAuthenticationStrategy = new DefaultTlsDirContextAuthenticationStrategy(); final String rawShutdownGracefully = configurationContext.getProperty("TLS - Shutdown Gracefully").getValue(); if (StringUtils.isNotBlank(rawShutdownGracefully)) { final boolean shutdownGracefully = Boolean.TRUE.toString().equalsIgnoreCase(rawShutdownGracefully); tlsAuthenticationStrategy.setShutdownTlsGracefully(shutdownGracefully); } final SSLContext startTlsSslContext = getConfiguredSslContext(configurationContext); if (startTlsSslContext != null) { tlsAuthenticationStrategy.setSslSocketFactory(startTlsSslContext.getSocketFactory()); } context.setAuthenticationStrategy(tlsAuthenticationStrategy); break; } break; } final String rawReferralStrategy = configurationContext.getProperty(PROP_REFERRAL_STRATEGY).getValue(); final ReferralStrategy referralStrategy; try { referralStrategy = ReferralStrategy.valueOf(rawReferralStrategy); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized referral strategy '%s'. Possible values are [%s]", rawReferralStrategy, StringUtils.join(ReferralStrategy.values(), ", "))); } context.setReferral(referralStrategy.getValue()); final String urls = configurationContext.getProperty(PROP_URL).getValue(); if (StringUtils.isBlank(urls)) { throw new AuthorizerCreationException("LDAP identity provider 'Url' must be specified."); } context.setUrls(StringUtils.split(urls)); final PropertyValue rawUserSearchBase = configurationContext.getProperty(PROP_USER_SEARCH_BASE); final PropertyValue rawUserObjectClass = configurationContext.getProperty(PROP_USER_OBJECT_CLASS); final PropertyValue rawUserSearchScope = configurationContext.getProperty(PROP_USER_SEARCH_SCOPE); if (rawUserSearchBase.isSet() && !rawUserObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Object Class' must be specified when 'User Search Base' is set."); } if (rawUserSearchBase.isSet() && !rawUserSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Scope' must be specified when 'User Search Base' is set."); } userSearchBase = rawUserSearchBase.getValue(); userObjectClass = rawUserObjectClass.getValue(); userSearchFilter = configurationContext.getProperty(PROP_USER_SEARCH_FILTER).getValue(); userIdentityAttribute = configurationContext.getProperty(PROP_USER_IDENTITY_ATTRIBUTE).getValue(); userGroupNameAttribute = configurationContext.getProperty(PROP_USER_GROUP_ATTRIBUTE).getValue(); userGroupReferencedGroupAttribute = configurationContext.getProperty(PROP_USER_GROUP_REFERENCED_GROUP_ATTRIBUTE).getValue(); try { userSearchScope = SearchScope.valueOf(rawUserSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized user search scope '%s'. Possible values are [%s]", rawUserSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForUserIdentity = StringUtils.isBlank(userIdentityAttribute); performUserSearch = StringUtils.isNotBlank(userSearchBase); final PropertyValue rawGroupSearchBase = configurationContext.getProperty(PROP_GROUP_SEARCH_BASE); final PropertyValue rawGroupObjectClass = configurationContext.getProperty(PROP_GROUP_OBJECT_CLASS); final PropertyValue rawGroupSearchScope = configurationContext.getProperty(PROP_GROUP_SEARCH_SCOPE); if (rawGroupSearchBase.isSet() && !rawGroupObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Object Class' must be specified when 'Group Search Base' is set."); } if (rawGroupSearchBase.isSet() && !rawGroupSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Search Scope' must be specified when 'Group Search Base' is set."); } groupSearchBase = rawGroupSearchBase.getValue(); groupObjectClass = rawGroupObjectClass.getValue(); groupSearchFilter = configurationContext.getProperty(PROP_GROUP_SEARCH_FILTER).getValue(); groupNameAttribute = configurationContext.getProperty(PROP_GROUP_NAME_ATTRIBUTE).getValue(); groupMemberAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_ATTRIBUTE).getValue(); groupMemberReferencedUserAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_REFERENCED_USER_ATTRIBUTE).getValue(); try { groupSearchScope = SearchScope.valueOf(rawGroupSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized group search scope '%s'. Possible values are [%s]", rawGroupSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForGroupName = StringUtils.isBlank(groupNameAttribute); performGroupSearch = StringUtils.isNotBlank(groupSearchBase); if (!performUserSearch && !performGroupSearch) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Base' or 'Group Search Base' must be specified."); } if (performGroupSearch && !performUserSearch && StringUtils.isBlank(groupMemberAttribute)) { throw new AuthorizerCreationException("'Group Member Attribute' is required when searching groups but not users."); } if (StringUtils.isNotBlank(groupMemberReferencedUserAttribute) && !performUserSearch) { throw new AuthorizerCreationException("''User Search Base' must be set when specifying 'Group Member Attribute - Referenced User Attribute'."); } if (StringUtils.isNotBlank(userGroupReferencedGroupAttribute) && !performGroupSearch) { throw new AuthorizerCreationException("'Group Search Base' must be set when specifying 'User Group Name Attribute - Referenced Group Attribute'."); } final PropertyValue rawPageSize = configurationContext.getProperty(PROP_PAGE_SIZE); if (rawPageSize.isSet() && StringUtils.isNotBlank(rawPageSize.getValue())) { pageSize = rawPageSize.asInteger(); } identityMappings = Collections.unmodifiableList(IdentityMappingUtil.getIdentityMappings(properties)); groupMappings = Collections.unmodifiableList(IdentityMappingUtil.getGroupMappings(properties)); if (!baseEnvironment.isEmpty()) { context.setBaseEnvironmentProperties(baseEnvironment); } try { context.afterPropertiesSet(); } catch (final Exception e) { throw new AuthorizerCreationException(e.getMessage(), e); } final PropertyValue rawSyncInterval = configurationContext.getProperty(PROP_SYNC_INTERVAL); final long syncInterval; if (rawSyncInterval.isSet()) { try { syncInterval = FormatUtils.getTimeDuration(rawSyncInterval.getValue(), TimeUnit.MILLISECONDS); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("The %s '%s' is not a valid time duration", PROP_SYNC_INTERVAL, rawSyncInterval.getValue())); } if (syncInterval < MINIMUM_SYNC_INTERVAL_MILLISECONDS) { throw new AuthorizerCreationException(String.format("The %s '%s' is below the minimum value of '%d ms'", PROP_SYNC_INTERVAL, rawSyncInterval.getValue(), MINIMUM_SYNC_INTERVAL_MILLISECONDS)); } } else { throw new AuthorizerCreationException(String.format("The '%s' must be specified.", PROP_SYNC_INTERVAL)); } try { load(context); if (tenants.get() == null) { throw new AuthorizerCreationException("Unable to sync users and groups."); } ldapSync.scheduleWithFixedDelay(() -> load(context), syncInterval, syncInterval, TimeUnit.MILLISECONDS); } catch (final AuthorizationAccessException e) { throw new AuthorizerCreationException(e); } }  }
LdapUserGroupProvider implements UserGroupProvider { @Override public void onConfigured(final AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { final LdapContextSource context = new LdapContextSource(); final Map<String, Object> baseEnvironment = new HashMap<>(); setTimeout(configurationContext, baseEnvironment, PROP_CONNECT_TIMEOUT, "com.sun.jndi.ldap.connect.timeout"); setTimeout(configurationContext, baseEnvironment, PROP_READ_TIMEOUT, "com.sun.jndi.ldap.read.timeout"); final PropertyValue rawAuthenticationStrategy = configurationContext.getProperty(PROP_AUTHENTICATION_STRATEGY); final LdapAuthenticationStrategy authenticationStrategy; try { authenticationStrategy = LdapAuthenticationStrategy.valueOf(rawAuthenticationStrategy.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized authentication strategy '%s'. Possible values are [%s]", rawAuthenticationStrategy.getValue(), StringUtils.join(LdapAuthenticationStrategy.values(), ", "))); } switch (authenticationStrategy) { case ANONYMOUS: context.setAnonymousReadOnly(true); break; default: final String userDn = configurationContext.getProperty(PROP_MANAGER_DN).getValue(); final String password = configurationContext.getProperty(PROP_MANAGER_PASSWORD).getValue(); context.setUserDn(userDn); context.setPassword(password); switch (authenticationStrategy) { case SIMPLE: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); break; case LDAPS: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); baseEnvironment.put(Context.SECURITY_PROTOCOL, "ssl"); final SSLContext ldapsSslContext = getConfiguredSslContext(configurationContext); if (ldapsSslContext != null) { LdapsSocketFactory.initialize(ldapsSslContext.getSocketFactory()); baseEnvironment.put("java.naming.ldap.factory.socket", LdapsSocketFactory.class.getName()); } break; case START_TLS: final AbstractTlsDirContextAuthenticationStrategy tlsAuthenticationStrategy = new DefaultTlsDirContextAuthenticationStrategy(); final String rawShutdownGracefully = configurationContext.getProperty("TLS - Shutdown Gracefully").getValue(); if (StringUtils.isNotBlank(rawShutdownGracefully)) { final boolean shutdownGracefully = Boolean.TRUE.toString().equalsIgnoreCase(rawShutdownGracefully); tlsAuthenticationStrategy.setShutdownTlsGracefully(shutdownGracefully); } final SSLContext startTlsSslContext = getConfiguredSslContext(configurationContext); if (startTlsSslContext != null) { tlsAuthenticationStrategy.setSslSocketFactory(startTlsSslContext.getSocketFactory()); } context.setAuthenticationStrategy(tlsAuthenticationStrategy); break; } break; } final String rawReferralStrategy = configurationContext.getProperty(PROP_REFERRAL_STRATEGY).getValue(); final ReferralStrategy referralStrategy; try { referralStrategy = ReferralStrategy.valueOf(rawReferralStrategy); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized referral strategy '%s'. Possible values are [%s]", rawReferralStrategy, StringUtils.join(ReferralStrategy.values(), ", "))); } context.setReferral(referralStrategy.getValue()); final String urls = configurationContext.getProperty(PROP_URL).getValue(); if (StringUtils.isBlank(urls)) { throw new AuthorizerCreationException("LDAP identity provider 'Url' must be specified."); } context.setUrls(StringUtils.split(urls)); final PropertyValue rawUserSearchBase = configurationContext.getProperty(PROP_USER_SEARCH_BASE); final PropertyValue rawUserObjectClass = configurationContext.getProperty(PROP_USER_OBJECT_CLASS); final PropertyValue rawUserSearchScope = configurationContext.getProperty(PROP_USER_SEARCH_SCOPE); if (rawUserSearchBase.isSet() && !rawUserObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Object Class' must be specified when 'User Search Base' is set."); } if (rawUserSearchBase.isSet() && !rawUserSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Scope' must be specified when 'User Search Base' is set."); } userSearchBase = rawUserSearchBase.getValue(); userObjectClass = rawUserObjectClass.getValue(); userSearchFilter = configurationContext.getProperty(PROP_USER_SEARCH_FILTER).getValue(); userIdentityAttribute = configurationContext.getProperty(PROP_USER_IDENTITY_ATTRIBUTE).getValue(); userGroupNameAttribute = configurationContext.getProperty(PROP_USER_GROUP_ATTRIBUTE).getValue(); userGroupReferencedGroupAttribute = configurationContext.getProperty(PROP_USER_GROUP_REFERENCED_GROUP_ATTRIBUTE).getValue(); try { userSearchScope = SearchScope.valueOf(rawUserSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized user search scope '%s'. Possible values are [%s]", rawUserSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForUserIdentity = StringUtils.isBlank(userIdentityAttribute); performUserSearch = StringUtils.isNotBlank(userSearchBase); final PropertyValue rawGroupSearchBase = configurationContext.getProperty(PROP_GROUP_SEARCH_BASE); final PropertyValue rawGroupObjectClass = configurationContext.getProperty(PROP_GROUP_OBJECT_CLASS); final PropertyValue rawGroupSearchScope = configurationContext.getProperty(PROP_GROUP_SEARCH_SCOPE); if (rawGroupSearchBase.isSet() && !rawGroupObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Object Class' must be specified when 'Group Search Base' is set."); } if (rawGroupSearchBase.isSet() && !rawGroupSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Search Scope' must be specified when 'Group Search Base' is set."); } groupSearchBase = rawGroupSearchBase.getValue(); groupObjectClass = rawGroupObjectClass.getValue(); groupSearchFilter = configurationContext.getProperty(PROP_GROUP_SEARCH_FILTER).getValue(); groupNameAttribute = configurationContext.getProperty(PROP_GROUP_NAME_ATTRIBUTE).getValue(); groupMemberAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_ATTRIBUTE).getValue(); groupMemberReferencedUserAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_REFERENCED_USER_ATTRIBUTE).getValue(); try { groupSearchScope = SearchScope.valueOf(rawGroupSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized group search scope '%s'. Possible values are [%s]", rawGroupSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForGroupName = StringUtils.isBlank(groupNameAttribute); performGroupSearch = StringUtils.isNotBlank(groupSearchBase); if (!performUserSearch && !performGroupSearch) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Base' or 'Group Search Base' must be specified."); } if (performGroupSearch && !performUserSearch && StringUtils.isBlank(groupMemberAttribute)) { throw new AuthorizerCreationException("'Group Member Attribute' is required when searching groups but not users."); } if (StringUtils.isNotBlank(groupMemberReferencedUserAttribute) && !performUserSearch) { throw new AuthorizerCreationException("''User Search Base' must be set when specifying 'Group Member Attribute - Referenced User Attribute'."); } if (StringUtils.isNotBlank(userGroupReferencedGroupAttribute) && !performGroupSearch) { throw new AuthorizerCreationException("'Group Search Base' must be set when specifying 'User Group Name Attribute - Referenced Group Attribute'."); } final PropertyValue rawPageSize = configurationContext.getProperty(PROP_PAGE_SIZE); if (rawPageSize.isSet() && StringUtils.isNotBlank(rawPageSize.getValue())) { pageSize = rawPageSize.asInteger(); } identityMappings = Collections.unmodifiableList(IdentityMappingUtil.getIdentityMappings(properties)); groupMappings = Collections.unmodifiableList(IdentityMappingUtil.getGroupMappings(properties)); if (!baseEnvironment.isEmpty()) { context.setBaseEnvironmentProperties(baseEnvironment); } try { context.afterPropertiesSet(); } catch (final Exception e) { throw new AuthorizerCreationException(e.getMessage(), e); } final PropertyValue rawSyncInterval = configurationContext.getProperty(PROP_SYNC_INTERVAL); final long syncInterval; if (rawSyncInterval.isSet()) { try { syncInterval = FormatUtils.getTimeDuration(rawSyncInterval.getValue(), TimeUnit.MILLISECONDS); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("The %s '%s' is not a valid time duration", PROP_SYNC_INTERVAL, rawSyncInterval.getValue())); } if (syncInterval < MINIMUM_SYNC_INTERVAL_MILLISECONDS) { throw new AuthorizerCreationException(String.format("The %s '%s' is below the minimum value of '%d ms'", PROP_SYNC_INTERVAL, rawSyncInterval.getValue(), MINIMUM_SYNC_INTERVAL_MILLISECONDS)); } } else { throw new AuthorizerCreationException(String.format("The '%s' must be specified.", PROP_SYNC_INTERVAL)); } try { load(context); if (tenants.get() == null) { throw new AuthorizerCreationException("Unable to sync users and groups."); } ldapSync.scheduleWithFixedDelay(() -> load(context), syncInterval, syncInterval, TimeUnit.MILLISECONDS); } catch (final AuthorizationAccessException e) { throw new AuthorizerCreationException(e); } }  @Override void initialize(final UserGroupProviderInitializationContext initializationContext); @Override void onConfigured(final AuthorizerConfigurationContext configurationContext); @Override Set<User> getUsers(); @Override User getUser(String identifier); @Override User getUserByIdentity(String identity); @Override Set<Group> getGroups(); @Override Group getGroup(String identifier); @Override UserAndGroups getUserAndGroups(String identity); @AuthorizerContext void setNiFiProperties(NiFiProperties properties); @Override final void preDestruction(); }
LdapUserGroupProvider implements UserGroupProvider { @Override public void onConfigured(final AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException { final LdapContextSource context = new LdapContextSource(); final Map<String, Object> baseEnvironment = new HashMap<>(); setTimeout(configurationContext, baseEnvironment, PROP_CONNECT_TIMEOUT, "com.sun.jndi.ldap.connect.timeout"); setTimeout(configurationContext, baseEnvironment, PROP_READ_TIMEOUT, "com.sun.jndi.ldap.read.timeout"); final PropertyValue rawAuthenticationStrategy = configurationContext.getProperty(PROP_AUTHENTICATION_STRATEGY); final LdapAuthenticationStrategy authenticationStrategy; try { authenticationStrategy = LdapAuthenticationStrategy.valueOf(rawAuthenticationStrategy.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized authentication strategy '%s'. Possible values are [%s]", rawAuthenticationStrategy.getValue(), StringUtils.join(LdapAuthenticationStrategy.values(), ", "))); } switch (authenticationStrategy) { case ANONYMOUS: context.setAnonymousReadOnly(true); break; default: final String userDn = configurationContext.getProperty(PROP_MANAGER_DN).getValue(); final String password = configurationContext.getProperty(PROP_MANAGER_PASSWORD).getValue(); context.setUserDn(userDn); context.setPassword(password); switch (authenticationStrategy) { case SIMPLE: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); break; case LDAPS: context.setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy()); baseEnvironment.put(Context.SECURITY_PROTOCOL, "ssl"); final SSLContext ldapsSslContext = getConfiguredSslContext(configurationContext); if (ldapsSslContext != null) { LdapsSocketFactory.initialize(ldapsSslContext.getSocketFactory()); baseEnvironment.put("java.naming.ldap.factory.socket", LdapsSocketFactory.class.getName()); } break; case START_TLS: final AbstractTlsDirContextAuthenticationStrategy tlsAuthenticationStrategy = new DefaultTlsDirContextAuthenticationStrategy(); final String rawShutdownGracefully = configurationContext.getProperty("TLS - Shutdown Gracefully").getValue(); if (StringUtils.isNotBlank(rawShutdownGracefully)) { final boolean shutdownGracefully = Boolean.TRUE.toString().equalsIgnoreCase(rawShutdownGracefully); tlsAuthenticationStrategy.setShutdownTlsGracefully(shutdownGracefully); } final SSLContext startTlsSslContext = getConfiguredSslContext(configurationContext); if (startTlsSslContext != null) { tlsAuthenticationStrategy.setSslSocketFactory(startTlsSslContext.getSocketFactory()); } context.setAuthenticationStrategy(tlsAuthenticationStrategy); break; } break; } final String rawReferralStrategy = configurationContext.getProperty(PROP_REFERRAL_STRATEGY).getValue(); final ReferralStrategy referralStrategy; try { referralStrategy = ReferralStrategy.valueOf(rawReferralStrategy); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized referral strategy '%s'. Possible values are [%s]", rawReferralStrategy, StringUtils.join(ReferralStrategy.values(), ", "))); } context.setReferral(referralStrategy.getValue()); final String urls = configurationContext.getProperty(PROP_URL).getValue(); if (StringUtils.isBlank(urls)) { throw new AuthorizerCreationException("LDAP identity provider 'Url' must be specified."); } context.setUrls(StringUtils.split(urls)); final PropertyValue rawUserSearchBase = configurationContext.getProperty(PROP_USER_SEARCH_BASE); final PropertyValue rawUserObjectClass = configurationContext.getProperty(PROP_USER_OBJECT_CLASS); final PropertyValue rawUserSearchScope = configurationContext.getProperty(PROP_USER_SEARCH_SCOPE); if (rawUserSearchBase.isSet() && !rawUserObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Object Class' must be specified when 'User Search Base' is set."); } if (rawUserSearchBase.isSet() && !rawUserSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Scope' must be specified when 'User Search Base' is set."); } userSearchBase = rawUserSearchBase.getValue(); userObjectClass = rawUserObjectClass.getValue(); userSearchFilter = configurationContext.getProperty(PROP_USER_SEARCH_FILTER).getValue(); userIdentityAttribute = configurationContext.getProperty(PROP_USER_IDENTITY_ATTRIBUTE).getValue(); userGroupNameAttribute = configurationContext.getProperty(PROP_USER_GROUP_ATTRIBUTE).getValue(); userGroupReferencedGroupAttribute = configurationContext.getProperty(PROP_USER_GROUP_REFERENCED_GROUP_ATTRIBUTE).getValue(); try { userSearchScope = SearchScope.valueOf(rawUserSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized user search scope '%s'. Possible values are [%s]", rawUserSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForUserIdentity = StringUtils.isBlank(userIdentityAttribute); performUserSearch = StringUtils.isNotBlank(userSearchBase); final PropertyValue rawGroupSearchBase = configurationContext.getProperty(PROP_GROUP_SEARCH_BASE); final PropertyValue rawGroupObjectClass = configurationContext.getProperty(PROP_GROUP_OBJECT_CLASS); final PropertyValue rawGroupSearchScope = configurationContext.getProperty(PROP_GROUP_SEARCH_SCOPE); if (rawGroupSearchBase.isSet() && !rawGroupObjectClass.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Object Class' must be specified when 'Group Search Base' is set."); } if (rawGroupSearchBase.isSet() && !rawGroupSearchScope.isSet()) { throw new AuthorizerCreationException("LDAP user group provider 'Group Search Scope' must be specified when 'Group Search Base' is set."); } groupSearchBase = rawGroupSearchBase.getValue(); groupObjectClass = rawGroupObjectClass.getValue(); groupSearchFilter = configurationContext.getProperty(PROP_GROUP_SEARCH_FILTER).getValue(); groupNameAttribute = configurationContext.getProperty(PROP_GROUP_NAME_ATTRIBUTE).getValue(); groupMemberAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_ATTRIBUTE).getValue(); groupMemberReferencedUserAttribute = configurationContext.getProperty(PROP_GROUP_MEMBER_REFERENCED_USER_ATTRIBUTE).getValue(); try { groupSearchScope = SearchScope.valueOf(rawGroupSearchScope.getValue()); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("Unrecognized group search scope '%s'. Possible values are [%s]", rawGroupSearchScope.getValue(), StringUtils.join(SearchScope.values(), ", "))); } useDnForGroupName = StringUtils.isBlank(groupNameAttribute); performGroupSearch = StringUtils.isNotBlank(groupSearchBase); if (!performUserSearch && !performGroupSearch) { throw new AuthorizerCreationException("LDAP user group provider 'User Search Base' or 'Group Search Base' must be specified."); } if (performGroupSearch && !performUserSearch && StringUtils.isBlank(groupMemberAttribute)) { throw new AuthorizerCreationException("'Group Member Attribute' is required when searching groups but not users."); } if (StringUtils.isNotBlank(groupMemberReferencedUserAttribute) && !performUserSearch) { throw new AuthorizerCreationException("''User Search Base' must be set when specifying 'Group Member Attribute - Referenced User Attribute'."); } if (StringUtils.isNotBlank(userGroupReferencedGroupAttribute) && !performGroupSearch) { throw new AuthorizerCreationException("'Group Search Base' must be set when specifying 'User Group Name Attribute - Referenced Group Attribute'."); } final PropertyValue rawPageSize = configurationContext.getProperty(PROP_PAGE_SIZE); if (rawPageSize.isSet() && StringUtils.isNotBlank(rawPageSize.getValue())) { pageSize = rawPageSize.asInteger(); } identityMappings = Collections.unmodifiableList(IdentityMappingUtil.getIdentityMappings(properties)); groupMappings = Collections.unmodifiableList(IdentityMappingUtil.getGroupMappings(properties)); if (!baseEnvironment.isEmpty()) { context.setBaseEnvironmentProperties(baseEnvironment); } try { context.afterPropertiesSet(); } catch (final Exception e) { throw new AuthorizerCreationException(e.getMessage(), e); } final PropertyValue rawSyncInterval = configurationContext.getProperty(PROP_SYNC_INTERVAL); final long syncInterval; if (rawSyncInterval.isSet()) { try { syncInterval = FormatUtils.getTimeDuration(rawSyncInterval.getValue(), TimeUnit.MILLISECONDS); } catch (final IllegalArgumentException iae) { throw new AuthorizerCreationException(String.format("The %s '%s' is not a valid time duration", PROP_SYNC_INTERVAL, rawSyncInterval.getValue())); } if (syncInterval < MINIMUM_SYNC_INTERVAL_MILLISECONDS) { throw new AuthorizerCreationException(String.format("The %s '%s' is below the minimum value of '%d ms'", PROP_SYNC_INTERVAL, rawSyncInterval.getValue(), MINIMUM_SYNC_INTERVAL_MILLISECONDS)); } } else { throw new AuthorizerCreationException(String.format("The '%s' must be specified.", PROP_SYNC_INTERVAL)); } try { load(context); if (tenants.get() == null) { throw new AuthorizerCreationException("Unable to sync users and groups."); } ldapSync.scheduleWithFixedDelay(() -> load(context), syncInterval, syncInterval, TimeUnit.MILLISECONDS); } catch (final AuthorizationAccessException e) { throw new AuthorizerCreationException(e); } }  @Override void initialize(final UserGroupProviderInitializationContext initializationContext); @Override void onConfigured(final AuthorizerConfigurationContext configurationContext); @Override Set<User> getUsers(); @Override User getUser(String identifier); @Override User getUserByIdentity(String identity); @Override Set<Group> getGroups(); @Override Group getGroup(String identifier); @Override UserAndGroups getUserAndGroups(String identity); @AuthorizerContext void setNiFiProperties(NiFiProperties properties); @Override final void preDestruction(); static final String PROP_CONNECT_TIMEOUT; static final String PROP_READ_TIMEOUT; static final String PROP_AUTHENTICATION_STRATEGY; static final String PROP_MANAGER_DN; static final String PROP_MANAGER_PASSWORD; static final String PROP_REFERRAL_STRATEGY; static final String PROP_URL; static final String PROP_PAGE_SIZE; static final String PROP_USER_SEARCH_BASE; static final String PROP_USER_OBJECT_CLASS; static final String PROP_USER_SEARCH_SCOPE; static final String PROP_USER_SEARCH_FILTER; static final String PROP_USER_IDENTITY_ATTRIBUTE; static final String PROP_USER_GROUP_ATTRIBUTE; static final String PROP_USER_GROUP_REFERENCED_GROUP_ATTRIBUTE; static final String PROP_GROUP_SEARCH_BASE; static final String PROP_GROUP_OBJECT_CLASS; static final String PROP_GROUP_SEARCH_SCOPE; static final String PROP_GROUP_SEARCH_FILTER; static final String PROP_GROUP_NAME_ATTRIBUTE; static final String PROP_GROUP_MEMBER_ATTRIBUTE; static final String PROP_GROUP_MEMBER_REFERENCED_USER_ATTRIBUTE; static final String PROP_SYNC_INTERVAL; }