Class ActiveDirectoryRealm
- java.lang.Object
-
- org.apache.shiro.realm.CachingRealm
-
- org.apache.shiro.realm.AuthenticatingRealm
-
- org.apache.shiro.realm.AuthorizingRealm
-
- org.apache.shiro.realm.ldap.AbstractLdapRealm
-
- org.apache.shiro.realm.activedirectory.ActiveDirectoryRealm
-
- All Implemented Interfaces:
LogoutAware
,Authorizer
,PermissionResolverAware
,RolePermissionResolverAware
,org.apache.shiro.cache.CacheManagerAware
,Realm
,org.apache.shiro.util.Initializable
,org.apache.shiro.util.Nameable
public class ActiveDirectoryRealm extends AbstractLdapRealm
ARealm
that authenticates with an active directory LDAP server to determine the roles for a particular user. This implementation queries for the user's groups and then maps the group names to roles using thegroupRolesMap
.- Since:
- 0.1
-
-
Field Summary
-
Fields inherited from class org.apache.shiro.realm.ldap.AbstractLdapRealm
principalSuffix, searchBase, searchFilter, systemPassword, systemUsername, url
-
-
Constructor Summary
Constructors Constructor Description ActiveDirectoryRealm()
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description protected AuthenticationInfo
buildAuthenticationInfo(String username, char[] password)
protected AuthorizationInfo
buildAuthorizationInfo(Set<String> roleNames)
protected Collection<String>
getRoleNamesForGroups(Collection<String> groupNames)
This method is called by the default implementation to translate Active Directory group names to role names.protected Set<String>
getRoleNamesForUser(String username, LdapContext ldapContext)
protected AuthenticationInfo
queryForAuthenticationInfo(AuthenticationToken token, LdapContextFactory ldapContextFactory)
Builds anAuthenticationInfo
object by querying the active directory LDAP context for the specified username.protected AuthorizationInfo
queryForAuthorizationInfo(PrincipalCollection principals, LdapContextFactory ldapContextFactory)
Builds anAuthorizationInfo
object by querying the active directory LDAP context for the groups that a user is a member of.void
setGroupRolesMap(Map<String,String> groupRolesMap)
-
Methods inherited from class org.apache.shiro.realm.ldap.AbstractLdapRealm
doGetAuthenticationInfo, doGetAuthorizationInfo, onInit, setLdapContextFactory, setPrincipalSuffix, setSearchBase, setSearchFilter, setSystemPassword, setSystemUsername, setUrl
-
Methods inherited from class org.apache.shiro.realm.AuthorizingRealm
afterCacheManagerSet, checkPermission, checkPermission, checkPermission, checkPermissions, checkPermissions, checkPermissions, checkRole, checkRole, checkRoles, checkRoles, checkRoles, clearCachedAuthorizationInfo, doClearCache, getAuthorizationCache, getAuthorizationCacheKey, getAuthorizationCacheName, getAuthorizationInfo, getPermissionResolver, getPermissions, getRolePermissionResolver, hasAllRoles, hasRole, hasRole, hasRoles, hasRoles, isAuthorizationCachingEnabled, isPermitted, isPermitted, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, isPermittedAll, setAuthorizationCache, setAuthorizationCacheName, setAuthorizationCachingEnabled, setName, setPermissionResolver, setRolePermissionResolver
-
Methods inherited from class org.apache.shiro.realm.AuthenticatingRealm
assertCredentialsMatch, clearCachedAuthenticationInfo, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, supports
-
Methods inherited from class org.apache.shiro.realm.CachingRealm
clearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabled
-
-
-
-
Constructor Detail
-
ActiveDirectoryRealm
public ActiveDirectoryRealm()
-
-
Method Detail
-
setGroupRolesMap
public void setGroupRolesMap(Map<String,String> groupRolesMap)
-
queryForAuthenticationInfo
protected AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token, LdapContextFactory ldapContextFactory) throws NamingException
Builds anAuthenticationInfo
object by querying the active directory LDAP context for the specified username. This method binds to the LDAP server using the provided username and password - which if successful, indicates that the password is correct. This method can be overridden by subclasses to query the LDAP server in a more complex way.- Specified by:
queryForAuthenticationInfo
in classAbstractLdapRealm
- Parameters:
token
- the authentication token provided by the user.ldapContextFactory
- the factory used to build connections to the LDAP server.- Returns:
- an
AuthenticationInfo
instance containing information retrieved from LDAP. - Throws:
NamingException
- if any LDAP errors occur during the search.
-
buildAuthenticationInfo
protected AuthenticationInfo buildAuthenticationInfo(String username, char[] password)
-
queryForAuthorizationInfo
protected AuthorizationInfo queryForAuthorizationInfo(PrincipalCollection principals, LdapContextFactory ldapContextFactory) throws NamingException
Builds anAuthorizationInfo
object by querying the active directory LDAP context for the groups that a user is a member of. The groups are then translated to role names by using the configuredgroupRolesMap
. This implementation expects the principal argument to be a String username. Subclasses can override this method to determine authorization data (roles, permissions, etc) in a more complex way. Note that this default implementation does not support permissions, only roles.- Specified by:
queryForAuthorizationInfo
in classAbstractLdapRealm
- Parameters:
principals
- the principal of the Subject whose account is being retrieved.ldapContextFactory
- the factory used to create LDAP connections.- Returns:
- the AuthorizationInfo for the given Subject principal.
- Throws:
NamingException
- if an error occurs when searching the LDAP server.
-
buildAuthorizationInfo
protected AuthorizationInfo buildAuthorizationInfo(Set<String> roleNames)
-
getRoleNamesForUser
protected Set<String> getRoleNamesForUser(String username, LdapContext ldapContext) throws NamingException
- Throws:
NamingException
-
getRoleNamesForGroups
protected Collection<String> getRoleNamesForGroups(Collection<String> groupNames)
This method is called by the default implementation to translate Active Directory group names to role names. This implementation uses thegroupRolesMap
to map group names to role names.- Parameters:
groupNames
- the group names that apply to the current user.- Returns:
- a collection of roles that are implied by the given role names.
-
-