spring-security-ldap

org.springframework.security.ldap.userdetails
Class LdapUserDetailsManager

java.lang.Object
  extended by org.springframework.security.ldap.userdetails.LdapUserDetailsManager
All Implemented Interfaces:
org.springframework.security.core.userdetails.UserDetailsService, org.springframework.security.provisioning.UserDetailsManager

public class LdapUserDetailsManager
extends Object
implements org.springframework.security.provisioning.UserDetailsManager

An Ldap implementation of UserDetailsManager.

It is designed around a standard setup where users and groups/roles are stored under separate contexts, defined by the "userDnBase" and "groupSearchBase" properties respectively.

In this case, LDAP is being used purely to retrieve information and this class can be used in place of any other UserDetailsService for authentication. Authentication isn't performed directly against the directory, unlike with the LDAP authentication provider setup.

Since:
2.0
Author:
Luke Taylor

Constructor Summary
LdapUserDetailsManager(ContextSource contextSource)
           
 
Method Summary
protected  void addAuthorities(DistinguishedName userDn, Collection<org.springframework.security.core.GrantedAuthority> authorities)
           
protected  DistinguishedName buildGroupDn(String group)
          Creates a DN from a group name.
 void changePassword(String oldPassword, String newPassword)
          Changes the password for the current user.
protected  void copyToContext(org.springframework.security.core.userdetails.UserDetails user, DirContextAdapter ctx)
           
 void createUser(org.springframework.security.core.userdetails.UserDetails user)
           
 void deleteUser(String username)
           
 org.springframework.security.core.userdetails.UserDetails loadUserByUsername(String username)
           
protected  void removeAuthorities(DistinguishedName userDn, List<org.springframework.security.core.GrantedAuthority> authorities)
           
 void setAttributesToRetrieve(String[] attributesToRetrieve)
           
 void setGroupMemberAttributeName(String groupMemberAttributeName)
          Sets the name of the multi-valued attribute which holds the DNs of users who are members of a group.
 void setGroupRoleAttributeName(String groupRoleAttributeName)
           
 void setGroupSearchBase(String groupSearchBase)
           
 void setPasswordAttributeName(String passwordAttributeName)
           
 void setRoleMapper(AttributesMapper roleMapper)
           
 void setUserDetailsMapper(UserDetailsContextMapper userDetailsMapper)
           
 void setUsernameMapper(LdapUsernameToDnMapper usernameMapper)
           
 void updateUser(org.springframework.security.core.userdetails.UserDetails user)
           
 boolean userExists(String username)
           
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

LdapUserDetailsManager

public LdapUserDetailsManager(ContextSource contextSource)
Method Detail

loadUserByUsername

public org.springframework.security.core.userdetails.UserDetails loadUserByUsername(String username)
                                                                             throws org.springframework.security.core.userdetails.UsernameNotFoundException,
                                                                                    DataAccessException
Specified by:
loadUserByUsername in interface org.springframework.security.core.userdetails.UserDetailsService
Throws:
org.springframework.security.core.userdetails.UsernameNotFoundException
DataAccessException

changePassword

public void changePassword(String oldPassword,
                           String newPassword)
Changes the password for the current user. The username is obtained from the security context.

If the old password is supplied, the update will be made by rebinding as the user, thus modifying the password using the user's permissions. If oldPassword is null, the update will be attempted using a standard read/write context supplied by the context source.

Specified by:
changePassword in interface org.springframework.security.provisioning.UserDetailsManager
Parameters:
oldPassword - the old password
newPassword - the new value of the password.

createUser

public void createUser(org.springframework.security.core.userdetails.UserDetails user)
Specified by:
createUser in interface org.springframework.security.provisioning.UserDetailsManager

updateUser

public void updateUser(org.springframework.security.core.userdetails.UserDetails user)
Specified by:
updateUser in interface org.springframework.security.provisioning.UserDetailsManager

deleteUser

public void deleteUser(String username)
Specified by:
deleteUser in interface org.springframework.security.provisioning.UserDetailsManager

userExists

public boolean userExists(String username)
Specified by:
userExists in interface org.springframework.security.provisioning.UserDetailsManager

buildGroupDn

protected DistinguishedName buildGroupDn(String group)
Creates a DN from a group name.

Parameters:
group - the name of the group
Returns:
the DN of the corresponding group, including the groupSearchBase

copyToContext

protected void copyToContext(org.springframework.security.core.userdetails.UserDetails user,
                             DirContextAdapter ctx)

addAuthorities

protected void addAuthorities(DistinguishedName userDn,
                              Collection<org.springframework.security.core.GrantedAuthority> authorities)

removeAuthorities

protected void removeAuthorities(DistinguishedName userDn,
                                 List<org.springframework.security.core.GrantedAuthority> authorities)

setUsernameMapper

public void setUsernameMapper(LdapUsernameToDnMapper usernameMapper)

setPasswordAttributeName

public void setPasswordAttributeName(String passwordAttributeName)

setGroupSearchBase

public void setGroupSearchBase(String groupSearchBase)

setGroupRoleAttributeName

public void setGroupRoleAttributeName(String groupRoleAttributeName)

setAttributesToRetrieve

public void setAttributesToRetrieve(String[] attributesToRetrieve)

setUserDetailsMapper

public void setUserDetailsMapper(UserDetailsContextMapper userDetailsMapper)

setGroupMemberAttributeName

public void setGroupMemberAttributeName(String groupMemberAttributeName)
Sets the name of the multi-valued attribute which holds the DNs of users who are members of a group.

Usually this will be uniquemember (the default value) or member.

Parameters:
groupMemberAttributeName - the name of the attribute used to store group members.

setRoleMapper

public void setRoleMapper(AttributesMapper roleMapper)

spring-security-ldap