Class LdapAuthenticationProvider<T,I,S>

java.lang.Object

io.micronaut.security.ldap.LdapAuthenticationProvider<T,I,S>

Type Parameters:

T - Request Context Type

I - Authentication Request Identity Type

S - Authentication Request Secret Type

All Implemented Interfaces:

io.micronaut.core.order.Ordered, AuthenticationProvider<T,I,S>, ExecutorAuthenticationProvider<T,I,S>, Closeable, AutoCloseable

public class LdapAuthenticationProvider<T,I,S>
extends Object
implements ExecutorAuthenticationProvider<T,I,S>, Closeable

Authenticates against an LDAP server using the configuration provided through LdapConfiguration. One provider will be created for each configuration.

Since:

1.0

Author:

James Kleeh

Field Summary

Fields inherited from interface io.micronaut.core.order.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor	Description
LdapAuthenticationProvider(LdapConfiguration configuration, LdapSearchService ldapSearchService, ContextBuilder contextBuilder, ContextAuthenticationMapper contextAuthenticationMapper, LdapGroupProcessor ldapGroupProcessor, ExecutorService executorService)

Method Summary

Modifier and Type	Method	Description
AuthenticationResponse	authenticate(T requestContext, AuthenticationRequest<I,S> authenticationRequest)	Authenticates a user with the given request.
void	close()
protected AuthenticationResponse	rejectUnknownUser(T requestContext, AuthenticationRequest<I,S> authenticationRequest)	Rejects an authentication request whose username did not match any directory entry.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface AuthenticationProvider

authenticate

Methods inherited from interface ExecutorAuthenticationProvider

getExecutorName

Methods inherited from interface io.micronaut.core.order.Ordered

getOrder

Constructor Details

LdapAuthenticationProvider

public LdapAuthenticationProvider(LdapConfiguration configuration,
 LdapSearchService ldapSearchService,
 ContextBuilder contextBuilder,
 ContextAuthenticationMapper contextAuthenticationMapper,
 LdapGroupProcessor ldapGroupProcessor,
 @Named("io")
 ExecutorService executorService)

Parameters:

configuration - The configuration to use to authenticate

ldapSearchService - The search service

contextBuilder - The context builder

contextAuthenticationMapper - The authentication mapper

ldapGroupProcessor - The group processor

executorService - Executor Service

Method Details

authenticate

public AuthenticationResponse authenticate(T requestContext,
 AuthenticationRequest<I,S> authenticationRequest)

Description copied from interface: AuthenticationProvider

Authenticates a user with the given request. If authenticated successfully return AuthenticationResponse.success(String). If not authenticated return AuthenticationResponse.failure(). If your implementation is blocking, annotate the overriden method with Blocking and it will be safely executed on a dedicated thread in order to not block the main reactive chain of execution.

Specified by:

authenticate in interface AuthenticationProvider<T,I,S>

Parameters:

requestContext - The context request (typically an HTTP Request).

authenticationRequest - The credentials to authenticate

Returns:

An AuthenticationResponse indicating either success or failure.

rejectUnknownUser

protected AuthenticationResponse rejectUnknownUser(T requestContext,
 AuthenticationRequest<I,S> authenticationRequest)

Rejects an authentication request whose username did not match any directory entry.

To prevent username enumeration (CWE-204) the response is indistinguishable from the one returned for a wrong password: the failure reason is always AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH, never AuthenticationFailureReason.USER_NOT_FOUND, and a bind against a decoy DN is attempted so that an unknown username costs roughly the same client-side directory round trip as a known username with a wrong password. The outcome of that bind is ignored. The decoy DN is LdapConfiguration.SearchConfiguration.getDecoyDn() when configured, otherwise a random, non-existent entry under the search base.

Only the client-side cost is equalised. A directory may still answer faster for a non-existent DN than for a wrong password; configure a real decoy entry where that matters.

Parameters:

requestContext - The request context

authenticationRequest - The authentication request, whose identity matched no entry

Returns:

a AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH failure

Since:

5.5.2

close

public void close()

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable