public class SimpleAuthenticator extends AbstractAuthenticator
Authenticator
that authenticates clear text passwords
contained within the userPassword
attribute in DIT. If the
password is stored with a one-way encryption applied (e.g. SHA), the password
is hashed the same way before comparison.
We use a cache to speedup authentication, where the DN/password are stored.Constructor and Description |
---|
SimpleAuthenticator()
Creates a new instance.
|
SimpleAuthenticator(int cacheSize)
Creates a new instance, with an initial cache size
|
Modifier and Type | Method and Description |
---|---|
LdapPrincipal |
authenticate(BindOperationContext opContext)
Looks up userPassword attribute of the entry whose name is the
value of
Context.SECURITY_PRINCIPAL environment variable, and
authenticates a user with the plain-text password. |
protected String |
createDigestedPassword(String algorithm,
byte[] password)
Creates a digested password.
|
protected String |
getAlgorithmForHashedPassword(byte[] password)
Get the algorithm of a password, which is stored in the form "{XYZ}...".
|
void |
invalidateCache(org.apache.directory.shared.ldap.name.DN bindDn)
Remove the principal form the cache.
|
destroy, doDestroy, doInit, getAuthenticatorType, getDirectoryService, init
public SimpleAuthenticator()
AbstractAuthenticator
public SimpleAuthenticator(int cacheSize)
cacheSize
- the size of the credential cachepublic LdapPrincipal authenticate(BindOperationContext opContext) throws Exception
Looks up userPassword attribute of the entry whose name is the
value of Context.SECURITY_PRINCIPAL
environment variable, and
authenticates a user with the plain-text password.
If we get an encrypted password, it is prefixed by the used algorithm, between brackets : {SSHA}password ...
If the password is using SSHA, SMD5 or crypt, some 'salt' is added to the password :For (S)SHA, SHA-256 and (S)MD5, we have to transform the password from Base64 encoded text to a byte[] before comparing the password with the stored one.
For crypt, we only have to remove the salt.
At the end, we use the digest() method for (S)SHA and (S)MD5, the crypt() method for the CRYPT algorithm and a straight comparison for PLAIN TEXT passwords.
The stored password is always using the unsalted form, and is stored as a bytes array.
Exception
protected String getAlgorithmForHashedPassword(byte[] password) throws IllegalArgumentException
password
- a byte[]IllegalArgumentException
- if the algorithm cannot be identifiedprotected String createDigestedPassword(String algorithm, byte[] password) throws IllegalArgumentException
algorithm
- an algorithm which is supported by
java.security.MessageDigest, e.g. SHApassword
- password value, a byte[]IllegalArgumentException
- if password is neither a String nor a byte[], or algorithm is
not known to java.security.MessageDigest classpublic void invalidateCache(org.apache.directory.shared.ldap.name.DN bindDn)
invalidateCache
in interface Authenticator
invalidateCache
in class AbstractAuthenticator
bindDn
- the already normalized distinguished name of the bind principalCopyright © 2003-2013 The Apache Software Foundation. All Rights Reserved.