hudson.plugins.active_directory

Class ActiveDirectorySecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<hudson.security.SecurityRealm>

hudson.security.SecurityRealm

hudson.security.AbstractPasswordBasedSecurityRealm

hudson.plugins.active_directory.ActiveDirectorySecurityRealm

All Implemented Interfaces:

hudson.ExtensionPoint, hudson.model.Describable<hudson.security.SecurityRealm>, org.acegisecurity.userdetails.UserDetailsService

public class ActiveDirectorySecurityRealm
extends hudson.security.AbstractPasswordBasedSecurityRealm

SecurityRealm that talks to Active Directory.

Author:

Kohsuke Kawaguchi

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ActiveDirectorySecurityRealm.DescriptorImpl

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

hudson.security.SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
String	bindName If non-null, use this name and password to bind to LDAP to obtain the DN of the user trying to login.
hudson.util.Secret	bindPassword
protected CacheConfiguration	cache Cache of the Active Directory plugin
String	domain Active directory domain name to authenticate against.
static String	DOMAIN_CONTROLLERS Deprecated. as of 1.28 Use the UI field.
static boolean	FORCE_LDAPS Instead of LDAP+TLS upgrade, start right away with LDAPS.
boolean	removeIrrelevantGroups If true, Jenkins ignores Active Directory groups that are not being used by the active Authorization Strategy.
String	server If non-null, Jenkins will try to connect at this server at the first priority, before falling back to discovered DNS servers.
String	site Active directory site (which specifies the physical concentration of the servers), if any.

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, Boolean customDomain, CacheConfiguration cache)

Method Summary

Methods

Modifier and Type	Method and Description
protected org.acegisecurity.userdetails.UserDetails	authenticate(String username, String password)
hudson.security.SecurityRealm.SecurityComponents	createSecurityComponents()
void	doAuthTest(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp, String username, String password) Authentication test.
AbstractActiveDirectoryAuthenticationProvider	getAuthenticationProvider() Interface that actually talks to Active Directory.
CacheConfiguration	getCache()
ActiveDirectorySecurityRealm.DescriptorImpl	getDescriptor()
hudson.plugins.active_directory.GroupLookupStrategy	getGroupLookupStrategy()
Integer	getSize()
Integer	getTtl()
hudson.security.GroupDetails	loadGroupByGroupname(String groupname)
org.acegisecurity.userdetails.UserDetails	loadUserByUsername(String username)

Methods inherited from class hudson.security.AbstractPasswordBasedSecurityRealm

createCliAuthenticator

Methods inherited from class hudson.security.SecurityRealm

all, allowsSignup, canLogOut, commenceSignup, createFilter, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getLoginUrl, getPostLogOutUrl, getSecurityComponents, loadGroupByGroupname, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

domain

public final String domain

Active directory domain name to authenticate against.

When this plugin is used on Windows, this field is null, and we use ADSI and ADO through com4j to perform authentication.

OTOH, when this plugin runs on non-Windows, this field must be non-null, and we'll use LDAP for authentication.

site

public final String site

Active directory site (which specifies the physical concentration of the servers), if any. If the value is non-null, we'll only contact servers in this site.

On Windows, I'm assuming ADSI takes care of everything automatically.

bindName

public final String bindName

If non-null, use this name and password to bind to LDAP to obtain the DN of the user trying to login. This is unnecessary in a single-domain mode, where we can just bind with the user name and password provided during the login, but in a forest mode, without some known credential, we cannot figure out which domain in the forest the user belongs to.

bindPassword

public final hudson.util.Secret bindPassword

server

public final String server

If non-null, Jenkins will try to connect at this server at the first priority, before falling back to discovered DNS servers.

removeIrrelevantGroups

public final boolean removeIrrelevantGroups

If true, Jenkins ignores Active Directory groups that are not being used by the active Authorization Strategy. This can significantly improve performance in environments with a large number of groups but a small number of corresponding rules defined by the Authorization Strategy. Groups are considered as used if they are returned by AuthorizationStrategy.getGroups().

cache

protected CacheConfiguration cache

Cache of the Active Directory plugin

DOMAIN_CONTROLLERS

public static String DOMAIN_CONTROLLERS

Deprecated. as of 1.28 Use the UI field.

If non-null, this value specifies the domain controllers and overrides all the lookups. The format is "host:port,host:port,..."

FORCE_LDAPS

public static boolean FORCE_LDAPS

Instead of LDAP+TLS upgrade, start right away with LDAPS. For the time being I'm trying not to expose this to users. I don't see why any AD shouldn't support TLS upgrade if it's got the certificate. One legitimate use case is when the domain controller is Windows 2000, which doesn't support TLS (according to http://support.microsoft.com/kb/321051).

Constructor Detail

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                            String site,
                            String bindName,
                            String bindPassword,
                            String server)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                            String site,
                            String bindName,
                            String bindPassword,
                            String server,
                            hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                            String site,
                            String bindName,
                            String bindPassword,
                            String server,
                            hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy,
                            boolean removeIrrelevantGroups)

ActiveDirectorySecurityRealm

@DataBoundConstructor
public ActiveDirectorySecurityRealm(String domain,
                                                 String site,
                                                 String bindName,
                                                 String bindPassword,
                                                 String server,
                                                 hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy,
                                                 boolean removeIrrelevantGroups,
                                                 Boolean customDomain,
                                                 CacheConfiguration cache)

Method Detail

getCache

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public CacheConfiguration getCache()

getSize

public Integer getSize()

getTtl

public Integer getTtl()

getGroupLookupStrategy

public hudson.plugins.active_directory.GroupLookupStrategy getGroupLookupStrategy()

createSecurityComponents

public hudson.security.SecurityRealm.SecurityComponents createSecurityComponents()

Overrides:

createSecurityComponents in class hudson.security.AbstractPasswordBasedSecurityRealm

getDescriptor

public ActiveDirectorySecurityRealm.DescriptorImpl getDescriptor()

Specified by:

getDescriptor in interface hudson.model.Describable<hudson.security.SecurityRealm>

Overrides:

getDescriptor in class hudson.security.SecurityRealm

doAuthTest

public void doAuthTest(org.kohsuke.stapler.StaplerRequest req,
              org.kohsuke.stapler.StaplerResponse rsp,
              @QueryParameter
              String username,
              @QueryParameter
              String password)
                throws IOException,
                       javax.servlet.ServletException

Authentication test.

Throws:

IOException

javax.servlet.ServletException

loadGroupByGroupname

public hudson.security.GroupDetails loadGroupByGroupname(String groupname)
                                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                         org.springframework.dao.DataAccessException

Specified by:

loadGroupByGroupname in class hudson.security.AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

getAuthenticationProvider

public AbstractActiveDirectoryAuthenticationProvider getAuthenticationProvider()

Interface that actually talks to Active Directory.

loadUserByUsername

public org.acegisecurity.userdetails.UserDetails loadUserByUsername(String username)
                                                             throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                                    org.springframework.dao.DataAccessException

Specified by:

loadUserByUsername in interface org.acegisecurity.userdetails.UserDetailsService

Specified by:

loadUserByUsername in class hudson.security.AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

authenticate

protected org.acegisecurity.userdetails.UserDetails authenticate(String username,
                                                     String password)
                                                          throws org.acegisecurity.AuthenticationException

Specified by:

authenticate in class hudson.security.AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.AuthenticationException