hudson.plugins.active_directory

Class ActiveDirectorySecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<SecurityRealm>

hudson.security.SecurityRealm

hudson.security.AbstractPasswordBasedSecurityRealm

hudson.plugins.active_directory.ActiveDirectorySecurityRealm

All Implemented Interfaces:

ExtensionPoint, Describable<SecurityRealm>, org.acegisecurity.userdetails.UserDetailsService

public class ActiveDirectorySecurityRealm
extends AbstractPasswordBasedSecurityRealm

SecurityRealm that talks to Active Directory.

Author:

Kohsuke Kawaguchi

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ActiveDirectorySecurityRealm.DescriptorImpl
static class	ActiveDirectorySecurityRealm.EnvironmentProperty Store all the extra environment variable to be used on the LDAP Context

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
String	bindName Represent the old bindName
Secret	bindPassword Represent the old bindPassword
protected CacheConfiguration	cache Cache of the Active Directory plugin
String	domain Represent the old Active Directory Domain
static String	DOMAIN_CONTROLLERS Deprecated. as of 1.28 Use the UI field.
List<ActiveDirectoryDomain>	domains List of ActiveDirectoryDomain
protected List<ActiveDirectorySecurityRealm.EnvironmentProperty>	environmentProperties Ldap extra properties
static boolean	FORCE_LDAPS Instead of LDAP+TLS upgrade, start right away with LDAPS.
protected ActiveDirectoryInternalUsersDatabase	internalUsersDatabase The Jenkins internal user to fall back in case f NamingException
boolean	removeIrrelevantGroups If true, Jenkins ignores Active Directory groups that are not being used by the active Authorization Strategy.
String	server Represent the old Active Directory Domain Controllers
String	site Active directory site (which specifies the physical concentration of the servers), if any.
Boolean	startTls If true enable startTls in case plain communication is used.
protected ExecutorService	threadPoolExecutor The threadPool to update the cache on background
protected hudson.plugins.active_directory.TlsConfiguration	tlsConfiguration Deprecated.

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description
ActiveDirectorySecurityRealm(String domain, List<ActiveDirectoryDomain> domains, String site, String bindName, String bindPassword, String server, GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, Boolean customDomain, CacheConfiguration cache, Boolean startTls)
ActiveDirectorySecurityRealm(String domain, List<ActiveDirectoryDomain> domains, String site, String bindName, String bindPassword, String server, GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, Boolean customDomain, CacheConfiguration cache, Boolean startTls, ActiveDirectoryInternalUsersDatabase internalUsersDatabase)
ActiveDirectorySecurityRealm(String domain, List<ActiveDirectoryDomain> domains, String site, String bindName, String bindPassword, String server, GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, Boolean customDomain, CacheConfiguration cache, Boolean startTls, hudson.plugins.active_directory.TlsConfiguration tlsConfiguration)
ActiveDirectorySecurityRealm(String domain, List<ActiveDirectoryDomain> domains, String site, String bindName, String bindPassword, String server, GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, Boolean customDomain, CacheConfiguration cache, Boolean startTls, hudson.plugins.active_directory.TlsConfiguration tlsConfiguration, ActiveDirectoryInternalUsersDatabase internalUsersDatabase) Deprecated.
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, GroupLookupStrategy groupLookupStrategy)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups)
ActiveDirectorySecurityRealm(String domain, String site, String bindName, String bindPassword, String server, GroupLookupStrategy groupLookupStrategy, boolean removeIrrelevantGroups, CacheConfiguration cache)

Method Summary

Modifier and Type	Method and Description
protected org.acegisecurity.userdetails.UserDetails	authenticate(String username, String password)
void	doAuthTest(org.kohsuke.stapler.StaplerRequest req, org.kohsuke.stapler.StaplerResponse rsp, String username, String password) Authentication test.
AbstractActiveDirectoryAuthenticationProvider	getAuthenticationProvider() Interface that actually talks to Active Directory.
CacheConfiguration	getCache()
boolean	getCustomDomain()
ActiveDirectorySecurityRealm.DescriptorImpl	getDescriptor()
ActiveDirectoryDomain	getDomain(String domain) Get the @link{ActiveDirectoryDomain} given the domain
List<ActiveDirectoryDomain>	getDomains()
List<ActiveDirectorySecurityRealm.EnvironmentProperty>	getEnvironmentProperties()
GroupLookupStrategy	getGroupLookupStrategy()
ActiveDirectoryInternalUsersDatabase	getInternalUsersDatabase()
String	getJenkinsInternalUser()
Integer	getSize()
hudson.plugins.active_directory.TlsConfiguration	getTlsConfiguration() Deprecated.
Integer	getTtl()
Boolean	isStartTls()
GroupDetails	loadGroupByGroupname(String groupname)
org.acegisecurity.userdetails.UserDetails	loadUserByUsername(String username)
Object	readResolve()
void	setEnvironmentProperties(List<ActiveDirectorySecurityRealm.EnvironmentProperty> environmentProperties)
void	shutDownthreadPoolExecutors()

Methods inherited from class hudson.security.AbstractPasswordBasedSecurityRealm

createSecurityComponents

Methods inherited from class hudson.security.SecurityRealm

all, allowsSignup, canLogOut, commenceSignup, createCliAuthenticator, createFilter, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getFrom, getGroupIdStrategy, getLoginUrl, getPostLogOutUrl, getSecurityComponents, getUserIdStrategy, loadGroupByGroupname, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

domain

public transient String domain

Represent the old Active Directory Domain

We need to keep this as transient in order to be able to use readResolve to migrate the old descriptor to the newone.

This has been deprecated since ActiveDirectoryDomain

server

public transient String server

Represent the old Active Directory Domain Controllers

We need to keep this as transient in order to be able to use readResolve to migrate the old descriptor to the newone.

This has been deprecated since ActiveDirectoryDomain

domains

public List<ActiveDirectoryDomain> domains

List of ActiveDirectoryDomain

site

public final transient String site

Active directory site (which specifies the physical concentration of the servers), if any. If the value is non-null, we'll only contact servers in this site.

On Windows, I'm assuming ADSI takes care of everything automatically.

We need to keep this as transient in order to be able to use readResolve to migrate the old descriptor to the newone.

bindName

public transient String bindName

Represent the old bindName

We need to keep this as transient in order to be able to use readResolve to migrate the old descriptor to the new one.

This has been deprecated @since Jenkins 2.1

bindPassword

public transient Secret bindPassword

Represent the old bindPassword

We need to keep this as transient in order to be able to use readResolve to migrate the old descriptor to the new one.

This has been deprecated @since Jenkins 2.1

startTls

public Boolean startTls

If true enable startTls in case plain communication is used. In case the plugin is configured to use TLS then this option will not have any impact.

removeIrrelevantGroups

public final boolean removeIrrelevantGroups

If true, Jenkins ignores Active Directory groups that are not being used by the active Authorization Strategy. This can significantly improve performance in environments with a large number of groups but a small number of corresponding rules defined by the Authorization Strategy. Groups are considered as used if they are returned by AuthorizationStrategy.getGroups().

cache

protected CacheConfiguration cache

Cache of the Active Directory plugin

environmentProperties

protected List<ActiveDirectorySecurityRealm.EnvironmentProperty> environmentProperties

Ldap extra properties

tlsConfiguration

@Deprecated
protected transient hudson.plugins.active_directory.TlsConfiguration tlsConfiguration

Deprecated.

Selects the SSL strategy to follow on the TLS connections

Even if we are not using any of the TLS ports (3269/636) the plugin will try to establish a TLS channel using startTLS. Because of this, we need to be able to specify the SSL strategy on the plugin

For the moment there are two possible values: trustAllCertificates and trustStore.

internalUsersDatabase

protected ActiveDirectoryInternalUsersDatabase internalUsersDatabase

The Jenkins internal user to fall back in case f NamingException

threadPoolExecutor

protected transient ExecutorService threadPoolExecutor

The threadPool to update the cache on background

DOMAIN_CONTROLLERS

public static String DOMAIN_CONTROLLERS

Deprecated. as of 1.28 Use the UI field.

If non-null, this value specifies the domain controllers and overrides all the lookups. The format is "host:port,host:port,..."

FORCE_LDAPS

public static boolean FORCE_LDAPS

Instead of LDAP+TLS upgrade, start right away with LDAPS. For the time being I'm trying not to expose this to users. I don't see why any AD shouldn't support TLS upgrade if it's got the certificate. One legitimate use case is when the domain controller is Windows 2000, which doesn't support TLS (according to http://support.microsoft.com/kb/321051).

Constructor Detail

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                                    String site,
                                    String bindName,
                                    String bindPassword,
                                    String server)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                                    String site,
                                    String bindName,
                                    String bindPassword,
                                    String server,
                                    GroupLookupStrategy groupLookupStrategy)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                                    String site,
                                    String bindName,
                                    String bindPassword,
                                    String server,
                                    GroupLookupStrategy groupLookupStrategy,
                                    boolean removeIrrelevantGroups)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                                    String site,
                                    String bindName,
                                    String bindPassword,
                                    String server,
                                    GroupLookupStrategy groupLookupStrategy,
                                    boolean removeIrrelevantGroups,
                                    CacheConfiguration cache)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                                    List<ActiveDirectoryDomain> domains,
                                    String site,
                                    String bindName,
                                    String bindPassword,
                                    String server,
                                    GroupLookupStrategy groupLookupStrategy,
                                    boolean removeIrrelevantGroups,
                                    Boolean customDomain,
                                    CacheConfiguration cache,
                                    Boolean startTls)

ActiveDirectorySecurityRealm

public ActiveDirectorySecurityRealm(String domain,
                                    List<ActiveDirectoryDomain> domains,
                                    String site,
                                    String bindName,
                                    String bindPassword,
                                    String server,
                                    GroupLookupStrategy groupLookupStrategy,
                                    boolean removeIrrelevantGroups,
                                    Boolean customDomain,
                                    CacheConfiguration cache,
                                    Boolean startTls,
                                    hudson.plugins.active_directory.TlsConfiguration tlsConfiguration)

ActiveDirectorySecurityRealm

@Deprecated
public ActiveDirectorySecurityRealm(String domain,
                                                List<ActiveDirectoryDomain> domains,
                                                String site,
                                                String bindName,
                                                String bindPassword,
                                                String server,
                                                GroupLookupStrategy groupLookupStrategy,
                                                boolean removeIrrelevantGroups,
                                                Boolean customDomain,
                                                CacheConfiguration cache,
                                                Boolean startTls,
                                                hudson.plugins.active_directory.TlsConfiguration tlsConfiguration,
                                                ActiveDirectoryInternalUsersDatabase internalUsersDatabase)

Deprecated.

ActiveDirectorySecurityRealm

@DataBoundConstructor
public ActiveDirectorySecurityRealm(String domain,
                                                          List<ActiveDirectoryDomain> domains,
                                                          String site,
                                                          String bindName,
                                                          String bindPassword,
                                                          String server,
                                                          GroupLookupStrategy groupLookupStrategy,
                                                          boolean removeIrrelevantGroups,
                                                          Boolean customDomain,
                                                          CacheConfiguration cache,
                                                          Boolean startTls,
                                                          ActiveDirectoryInternalUsersDatabase internalUsersDatabase)

Method Detail

setEnvironmentProperties

@DataBoundSetter
public void setEnvironmentProperties(List<ActiveDirectorySecurityRealm.EnvironmentProperty> environmentProperties)

getCache

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public CacheConfiguration getCache()

getJenkinsInternalUser

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public String getJenkinsInternalUser()

getInternalUsersDatabase

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public ActiveDirectoryInternalUsersDatabase getInternalUsersDatabase()

isStartTls

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public Boolean isStartTls()

getSize

public Integer getSize()

getTtl

public Integer getTtl()

getEnvironmentProperties

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public List<ActiveDirectorySecurityRealm.EnvironmentProperty> getEnvironmentProperties()

getCustomDomain

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public boolean getCustomDomain()

getGroupLookupStrategy

public GroupLookupStrategy getGroupLookupStrategy()

getTlsConfiguration

@Deprecated
 @Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public hudson.plugins.active_directory.TlsConfiguration getTlsConfiguration()

Deprecated.

getDomains

@Restricted(value=org.kohsuke.accmod.restrictions.NoExternalUse.class)
public List<ActiveDirectoryDomain> getDomains()

getDomain

public ActiveDirectoryDomain getDomain(String domain)

Get the @link{ActiveDirectoryDomain} given the domain

Parameters:

domain - The name of the Active Directory domain

Returns:

the @link{ActiveDirectoryDomain} null if not exist.

readResolve

public Object readResolve()
                   throws ObjectStreamException

Throws:

ObjectStreamException

getDescriptor

public ActiveDirectorySecurityRealm.DescriptorImpl getDescriptor()

Specified by:

getDescriptor in interface Describable<SecurityRealm>

Overrides:

getDescriptor in class SecurityRealm

doAuthTest

public void doAuthTest(org.kohsuke.stapler.StaplerRequest req,
                       org.kohsuke.stapler.StaplerResponse rsp,
                       @QueryParameter
                       String username,
                       @QueryParameter
                       String password)
                throws IOException,
                       javax.servlet.ServletException

Authentication test.

Throws:

IOException

javax.servlet.ServletException

shutDownthreadPoolExecutors

@Restricted(value=org.kohsuke.accmod.restrictions.DoNotUse.class)
public void shutDownthreadPoolExecutors()

loadGroupByGroupname

public GroupDetails loadGroupByGroupname(String groupname)
                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                         org.springframework.dao.DataAccessException

Specified by:

loadGroupByGroupname in class AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

getAuthenticationProvider

public AbstractActiveDirectoryAuthenticationProvider getAuthenticationProvider()

Interface that actually talks to Active Directory.

loadUserByUsername

public org.acegisecurity.userdetails.UserDetails loadUserByUsername(String username)
                                                             throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                                    org.springframework.dao.DataAccessException

Specified by:

loadUserByUsername in interface org.acegisecurity.userdetails.UserDetailsService

Specified by:

loadUserByUsername in class AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

authenticate

protected org.acegisecurity.userdetails.UserDetails authenticate(String username,
                                                                 String password)
                                                          throws org.acegisecurity.AuthenticationException

Specified by:

authenticate in class AbstractPasswordBasedSecurityRealm

Throws:

org.acegisecurity.AuthenticationException