ActiveDirectoryLoginModule (Cams API Documentation)

Overview

Package

Class

Use

Tree

Deprecated

Index

Help

PREV CLASS NEXT CLASS

FRAMES NO FRAMES

SUMMARY: NESTED | FIELD | CONSTR | METHOD

DETAIL: FIELD | CONSTR | METHOD

com.cafesoft.cams.auth.login.module
Class ActiveDirectoryLoginModule

java.lang.Object
  |
  +--com.cafesoft.cams.auth.login.module.ActiveDirectoryLoginModule

All Implemented Interfaces:: LoggerClient, LoginModule, ServiceClient

public class ActiveDirectoryLoginModule
extends Object
implements LoginModule, LoggerClient, ServiceClient

Implements the LoginModule interface found in JAAS to authenticate users against an Active Directory repository. This implementation attempts to bind the connection with the user supplied credentials. If successful, the user roles are retrieved and the user is authenticated. All configuration parameters are listed below:

host - The DNS name or IP address of the Active Directory host.
port - The host's Active Directory port to use.
useSSL - Enables/disables use of SSL.
connectTimeout - (Optional) The number of milliseconds to wait for a connection to the ActiveDirectory before timing out.
emptyPassword - (Optional) Enable empty passwords (true or false). By default, the ActiveDirectoryLoginModule does not allow a password to be empty. Set this value to true to allow use of empty passwords when Active Directory is configured for and anonymous binds are required.
defaultRoles - (Optional) A list of one or more default roles separated by a comma to be added to the user session.
domain - (Optional) The Active Directory domain to use. If this value is present and the user name does not end with @domain, then append "@" and the value of domain to the user name before attempting to bind.
useRoleSearch - (Optional) A value of "true" (default) indicates that a role search will be attempted [true|false].
useDomainInRoleSearch - (Optional) A value of "true" (default) indicates that an optionally supplied "domain" used for authentication will be included in the role search filter's {username} substitution value [true|false].
baseDN - (Conditional) The base distinguished name for the User entries.
scope - (Conditional) The scope for the role search. Valid values are "BASE", "ONE", and "SUB".
filter - (Conditional) The role search filter.
roleAttr - (Conditional) The user entity attribute where the roles are listed.
addPrivateCredentials - (Optional) A flag that indicates whether or not a java.net.PasswordAuthentication object containing the user name and password should be added to the Subject's private credential set on successful authentication. WARNING: The values in this object can be accessed by other Cams components to enable SSO to other other systems, so administrator must take care that only trusted components have are used!

Since:: 10/20/01
See Also:: Subject, CallbackHandler, LoginModule

Constructor Summary

ActiveDirectoryLoginModule()
          Default ActiveDirectoryLoginModule Constructor.

Method Summary

boolean abort()
          Method to abort the authentication process (phase 2).

boolean commit()
          Method to commit the authentication process (phase 2).

void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options)
          Initialize this LoginModule.

boolean login()
          Method to authenticate a Subject (phase 1).

boolean logout()
          Method which logs out a Subject.

void setLogger(Logger logger)
          Sets the logger.

void setServiceFinder(ServiceFinder finder)
          Set the ServiceFinder.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ActiveDirectoryLoginModule

public ActiveDirectoryLoginModule()

Default ActiveDirectoryLoginModule Constructor.

Method Detail

setServiceFinder

public void setServiceFinder(ServiceFinder finder)

Set the ServiceFinder.

Specified by:: setServiceFinder in interface ServiceClient

Parameters:: finder - the class used by find Services by the ServiceClient.

setLogger

public void setLogger(Logger logger)

Sets the logger.

Specified by:: setLogger in interface LoggerClient

Parameters:: logger - logs messages

initialize

public void initialize(Subject subject,
                       CallbackHandler callbackHandler,
                       Map sharedState,
                       Map options)

Initialize this LoginModule.

This method is called by the LoginContext after this LoginModule has been instantiated. The purpose of this method is to initialize this LoginModule with the relevant information. If this LoginModule does not understand any of the data stored in sharedState or options parameters, they can be ignored.

Specified by:: initialize in interface LoginModule

Parameters:: subject - the Subject to be authenticated.; callbackHandler - a CallbackHandler for communicating with the end user (prompting for usernames and passwords, for example).; sharedState - state shared with other configured LoginModules.; options - options specified in the login Configuration for this particular LoginModule.

login

public boolean login()
              throws LoginException

Method to authenticate a Subject (phase 1).

The implementation of this method authenticates a Subject. For example, it may prompt for Subject information such as a username and password and then attempt to verify the password. This method saves the result of the authentication attempt as private state within the LoginModule.

Specified by:: login in interface LoginModule

Returns:: true if the authentication succeeded, or false if this LoginModule should be ignored.
Throws:: LoginException - if the authentication fails

commit

public boolean commit()
               throws LoginException

Method to commit the authentication process (phase 2).

This method is called if the LoginContext's overall authentication succeeded (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules succeeded).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method associates relevant Principals and Credentials with the Subject located in the LoginModule. If this LoginModule's own authentication attempted failed, then this method removes/destroys any state that was originally saved.

Specified by:: commit in interface LoginModule

Returns:: true if this method succeeded, or false if this LoginModule should be ignored.
Throws:: LoginException - if the commit fails

abort

public boolean abort()
              throws LoginException

Method to abort the authentication process (phase 2).

This method is called if the LoginContext's overall authentication failed. (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules did not succeed).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method cleans up any state that was originally saved.

Specified by:: abort in interface LoginModule

Returns:: true if this method succeeded, or false if this LoginModule should be ignored.
Throws:: LoginException - if the abort fails

logout

public boolean logout()
               throws LoginException

Method which logs out a Subject.

An implementation of this method might remove/destroy a Subject's Principals and Credentials.

Specified by:: logout in interface LoginModule

Returns:: true if this method succeeded, or false if this LoginModule should be ignored.
Throws:: LoginException - if the logout fails