hudson.plugins.active_directory

Class ActiveDirectorySecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<hudson.security.SecurityRealm>

hudson.security.SecurityRealm

hudson.security.AbstractPasswordBasedSecurityRealm

hudson.plugins.active_directory.ActiveDirectorySecurityRealm

All Implemented Interfaces:

hudson.ExtensionPoint, hudson.model.Describable<hudson.security.SecurityRealm>, org.acegisecurity.userdetails.UserDetailsService

public class ActiveDirectorySecurityRealm
extends hudson.security.AbstractPasswordBasedSecurityRealm

SecurityRealm that talks to Active Directory.

Author:

Kohsuke Kawaguchi

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ActiveDirectorySecurityRealm.DescriptorImpl
static class	ActiveDirectorySecurityRealm.EnvironmentProperty Store all the extra environment variable to be used on the LDAP Context

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

hudson.security.SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
String	bindName If non-null, use this name and password to bind to LDAP to obtain the DN of the user trying to login.
hudson.util.Secret	bindPassword
protected CacheConfiguration	cache Cache of the Active Directory plugin
String	domain Represent the old Active Directory Domain
static String	DOMAIN_CONTROLLERS Deprecated. as of 1.28 Use the UI field.
List<ActiveDirectoryDomain>	domains List of ActiveDirectoryDomain
protected List<ActiveDirectorySecurityRealm.EnvironmentProperty>	environmentProperties Ldap extra properties
static boolean	FORCE_LDAPS Instead of LDAP+TLS upgrade, start right away with LDAPS.
boolean	removeIrrelevantGroups If true, Jenkins ignores Active Directory groups that are not being used by the active Authorization Strategy.
String	server Represent the old Active Directory Domain Controllers
String	site Active directory site (which specifies the physical concentration of the servers), if any.
String	testDomain
String	testDomainControllers

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description
ActiveDirectorySecurityRealm(String domain, List<ActiveDirectoryDomain> domains, String site, String bindName, String bindPassword, String server, hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, Boolean customDomain, CacheConfiguration cache)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, CacheConfiguration cache)

Method Summary

Methods

Modifier and Type	Method and Description
protected org.acegisecurity.userdetails.UserDetails	authenticate(String username, String password)
hudson.security.SecurityRealm.SecurityComponents	createSecurityComponents()
void	doAuthTest(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp, String username, String password) Authentication test.
hudson.util.FormValidation	doCheckBindName(String bindName)
AbstractActiveDirectoryAuthenticationProvider	getAuthenticationProvider() Interface that actually talks to Active Directory.
CacheConfiguration	getCache()
ActiveDirectorySecurityRealm.DescriptorImpl	getDescriptor()
List<ActiveDirectoryDomain>	getDomains()
List<ActiveDirectorySecurityRealm.EnvironmentProperty>	getEnvironmentProperties()
hudson.plugins.active_directory.GroupLookupStrategy	getGroupLookupStrategy()
Integer	getSize()
String	getTestDomain()
String	getTestDomainControllers()
Integer	getTtl()
hudson.security.GroupDetails	loadGroupByGroupname(String groupname)
org.acegisecurity.userdetails.UserDetails	loadUserByUsername(String username)
Object	readResolve()
void	setEnvironmentProperties(List<ActiveDirectorySecurityRealm.EnvironmentProperty> environmentProperties)

Methods inherited from class hudson.security.AbstractPasswordBasedSecurityRealm

createCliAuthenticator

Methods inherited from class hudson.security.SecurityRealm

all, allowsSignup, canLogOut, commenceSignup, createFilter, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getLoginUrl, getPostLogOutUrl, getSecurityComponents, loadGroupByGroupname, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

domain

public transient String domain

Represent the old Active Directory Domain

We need to keep this as transient in order to be able to use readResolve to migrate the old descriptor to the newone.

This has been deprecated since ActiveDirectoryDomain

server

public transient String server

Represent the old Active Directory Domain Controllers

We need to keep this as transient in order to be able to use readResolve to migrate the old descriptor to the newone.

This has been deprecated since ActiveDirectoryDomain

domains

public List<ActiveDirectoryDomain> domains

List of ActiveDirectoryDomain

site

public final String site

Active directory site (which specifies the physical concentration of the servers), if any. If the value is non-null, we'll only contact servers in this site.

On Windows, I'm assuming ADSI takes care of everything automatically.

bindName

public final String bindName

If non-null, use this name and password to bind to LDAP to obtain the DN of the user trying to login. This is unnecessary in a single-domain mode, where we can just bind with the user name and password provided during the login, but in a forest mode, without some known credential, we cannot figure out which domain in the forest the user belongs to.

bindPassword

public final hudson.util.Secret bindPassword

removeIrrelevantGroups

public final boolean removeIrrelevantGroups

If true, Jenkins ignores Active Directory groups that are not being used by the active Authorization Strategy. This can significantly improve performance in environments with a large number of groups but a small number of corresponding rules defined by the Authorization Strategy. Groups are considered as used if they are returned by AuthorizationStrategy.getGroups().

cache

protected CacheConfiguration cache

Cache of the Active Directory plugin

environmentProperties

protected List<ActiveDirectorySecurityRealm.EnvironmentProperty> environmentProperties

Ldap extra properties

testDomain

public transient String testDomain

testDomainControllers

public transient String testDomainControllers

DOMAIN_CONTROLLERS

public static String DOMAIN_CONTROLLERS

Deprecated. as of 1.28 Use the UI field.

If non-null, this value specifies the domain controllers and overrides all the lookups. The format is "host:port,host:port,..."

FORCE_LDAPS

public static boolean FORCE_LDAPS

Instead of LDAP+TLS upgrade, start right away with LDAPS. For the time being I'm trying not to expose this to users. I don't see why any AD shouldn't support TLS upgrade if it's got the certificate. One legitimate use case is when the domain controller is Windows 2000, which doesn't support TLS (according to http://support.microsoft.com/kb/321051).

Constructor Detail

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                            String site,
                            String bindName,
                            String bindPassword,
                            String server)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                            String site,
                            String bindName,
                            String bindPassword,
                            String server,
                            hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                            String site,
                            String bindName,
                            String bindPassword,
                            String server,
                            hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy,
                            boolean removeIrrelevantGroups)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                            String site,
                            String bindName,
                            String bindPassword,
                            String server,
                            hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy,
                            boolean removeIrrelevantGroups,
                            CacheConfiguration cache)

ActiveDirectorySecurityRealm

@DataBoundConstructor
public ActiveDirectorySecurityRealm(String domain,
                                                 List<ActiveDirectoryDomain> domains,
                                                 String site,
                                                 String bindName,
                                                 String bindPassword,
                                                 String server,
                                                 hudson.plugins.active_directory.GroupLookupStrategy groupLookupStrategy,
                                                 boolean removeIrrelevantGroups,
                                                 Boolean customDomain,
                                                 CacheConfiguration cache)

Method Detail

setEnvironmentProperties

@DataBoundSetter
public void setEnvironmentProperties(List<ActiveDirectorySecurityRealm.EnvironmentProperty> environmentProperties)

getCache

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public CacheConfiguration getCache()

getSize

public Integer getSize()

getTtl

public Integer getTtl()

getEnvironmentProperties

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public List<ActiveDirectorySecurityRealm.EnvironmentProperty> getEnvironmentProperties()

getGroupLookupStrategy

public hudson.plugins.active_directory.GroupLookupStrategy getGroupLookupStrategy()

createSecurityComponents

public hudson.security.SecurityRealm.SecurityComponents createSecurityComponents()

Overrides:

createSecurityComponents in class hudson.security.AbstractPasswordBasedSecurityRealm

getDomains

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public List<ActiveDirectoryDomain> getDomains()

getTestDomain

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public String getTestDomain()

getTestDomainControllers

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public String getTestDomainControllers()

readResolve

public Object readResolve()
                   throws ObjectStreamException

Throws:

ObjectStreamException

getDescriptor

public ActiveDirectorySecurityRealm.DescriptorImpl getDescriptor()

Specified by:

getDescriptor in interface hudson.model.Describable<hudson.security.SecurityRealm>

Overrides:

getDescriptor in class hudson.security.SecurityRealm

doAuthTest

public void doAuthTest(org.kohsuke.stapler.StaplerRequest req,
              org.kohsuke.stapler.StaplerResponse rsp,
              @QueryParameter
              String username,
              @QueryParameter
              String password)
                throws IOException,
                       javax.servlet.ServletException

Authentication test.

Throws:

IOException

javax.servlet.ServletException

doCheckBindName

public hudson.util.FormValidation doCheckBindName(@QueryParameter
                                         String bindName)

loadGroupByGroupname

public hudson.security.GroupDetails loadGroupByGroupname(String groupname)
                                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                         org.springframework.dao.DataAccessException

Specified by:

loadGroupByGroupname in class hudson.security.AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

getAuthenticationProvider

public AbstractActiveDirectoryAuthenticationProvider getAuthenticationProvider()

Interface that actually talks to Active Directory.

loadUserByUsername

public org.acegisecurity.userdetails.UserDetails loadUserByUsername(String username)
                                                             throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                                    org.springframework.dao.DataAccessException

Specified by:

loadUserByUsername in interface org.acegisecurity.userdetails.UserDetailsService

Specified by:

loadUserByUsername in class hudson.security.AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

authenticate

protected org.acegisecurity.userdetails.UserDetails authenticate(String username,
                                                     String password)
                                                          throws org.acegisecurity.AuthenticationException

Specified by:

authenticate in class hudson.security.AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.AuthenticationException