org.jenkinsci.plugins.reverse_proxy_auth

Class ReverseProxySecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<hudson.security.SecurityRealm>

hudson.security.SecurityRealm

org.jenkinsci.plugins.reverse_proxy_auth.ReverseProxySecurityRealm

All Implemented Interfaces:

hudson.ExtensionPoint, hudson.model.Describable<hudson.security.SecurityRealm>

public class ReverseProxySecurityRealm
extends hudson.security.SecurityRealm

Author:

Kohsuke Kawaguchi

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ReverseProxySecurityRealm.ProxyLDAPDescriptor
static class	ReverseProxySecurityRealm.ReverseProxyUserDetailsService

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

hudson.security.SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
org.acegisecurity.GrantedAuthority[]	authorities The authorities that are granted to the authenticated user.
String	forwardedUser The name of the header which the username has to be extracted from.
static String	GROUP_SEARCH LDAP filter to look for groups by their names.
String	groupSearchBase This defines the organizational unit that contains groups.
String	groupSearchFilter Query to locate an entry that identifies the group, given the group name string.
String	headerGroups Header name of the groups field.
String	headerGroupsDelimiter Header name of the groups delimiter field.
boolean	inhibitInferRootDN Allow the rootDN to be inferred? Default is false.
String	managerDN If non-null, we use this and managerPassword when binding to LDAP.
String	rootDN The root DN to connect to.
String	server LDAP server name(s) separated by spaces, optionally with TCP port number, like "ldap.acme.org" or "ldap.acme.org:389" and/or with protcol, like "ldap://ldap.acme.org".
String	userSearch Query to locate an entry that identifies the user, given the user name string.
String	userSearchBase Specifies the relative DN from the root DN.

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description
ReverseProxySecurityRealm(String forwardedUser, String headerGroups, String headerGroupsDelimiter, String server, String rootDN, boolean inhibitInferRootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String managerDN, String managerPassword)

Method Summary

Methods

Modifier and Type	Method and Description
boolean	canLogOut()
javax.servlet.Filter	createFilter(javax.servlet.FilterConfig filterConfig)
hudson.security.SecurityRealm.SecurityComponents	createSecurityComponents()
<T> T	extractBean(Class<T> type, org.springframework.web.context.WebApplicationContext appContext)
String	getForwardedUser() Name of the HTTP header to look at.
String	getGroupSearchFilter()
String	getHeaderGroups()
String	getHeaderGroupsDelimiter()
String	getLDAPURL()
String	getManagerPassword()
String	getServerUrl()
hudson.security.GroupDetails	loadGroupByGroupname(String groupname)
org.acegisecurity.userdetails.UserDetails	loadUserByUsername(String username)
static String	toProviderUrl(String serverUrl, String rootDN)

Methods inherited from class hudson.security.SecurityRealm

all, allowsSignup, commenceSignup, createCliAuthenticator, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getDescriptor, getLoginUrl, getPostLogOutUrl, getSecurityComponents, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

GROUP_SEARCH

public static String GROUP_SEARCH

LDAP filter to look for groups by their names. "{0}" is the group name as given by the user. See http://msdn.microsoft.com/en-us/library/aa746475(VS.85).aspx for the syntax by example. WANTED: The specification of the syntax.

server

public final String server

LDAP server name(s) separated by spaces, optionally with TCP port number, like "ldap.acme.org" or "ldap.acme.org:389" and/or with protcol, like "ldap://ldap.acme.org".

rootDN

public final String rootDN

The root DN to connect to. Normally something like "dc=sun,dc=com" How do I infer this?

inhibitInferRootDN

public final boolean inhibitInferRootDN

Allow the rootDN to be inferred? Default is false. If true, allow rootDN to be blank.

userSearchBase

public final String userSearchBase

Specifies the relative DN from the root DN. This is used to narrow down the search space when doing user search. Something like "ou=people" but can be empty.

userSearch

public final String userSearch

Query to locate an entry that identifies the user, given the user name string. Normally "uid={0}"

See Also:

FilterBasedLdapUserSearch

groupSearchBase

public final String groupSearchBase

This defines the organizational unit that contains groups. Normally "" to indicate the full LDAP search, but can be often narrowed down to something like "ou=groups"

See Also:

FilterBasedLdapUserSearch

groupSearchFilter

public final String groupSearchFilter

Query to locate an entry that identifies the group, given the group name string. If non-null it will override the default specified by GROUP_SEARCH

Since:

1.5

managerDN

public final String managerDN

If non-null, we use this and managerPassword when binding to LDAP. This is necessary when LDAP doesn't support anonymous access.

authorities

public org.acegisecurity.GrantedAuthority[] authorities

The authorities that are granted to the authenticated user.

forwardedUser

public final String forwardedUser

The name of the header which the username has to be extracted from.

headerGroups

public final String headerGroups

Header name of the groups field.

headerGroupsDelimiter

public final String headerGroupsDelimiter

Header name of the groups delimiter field.

Constructor Detail

ReverseProxySecurityRealm

@DataBoundConstructor
public ReverseProxySecurityRealm(String forwardedUser,
                                              String headerGroups,
                                              String headerGroupsDelimiter,
                                              String server,
                                              String rootDN,
                                              boolean inhibitInferRootDN,
                                              String userSearchBase,
                                              String userSearch,
                                              String groupSearchBase,
                                              String groupSearchFilter,
                                              String managerDN,
                                              String managerPassword)

Method Detail

getForwardedUser

public String getForwardedUser()

Name of the HTTP header to look at.

getHeaderGroups

public String getHeaderGroups()

getHeaderGroupsDelimiter

public String getHeaderGroupsDelimiter()

getServerUrl

public String getServerUrl()

getGroupSearchFilter

public String getGroupSearchFilter()

toProviderUrl

public static String toProviderUrl(String serverUrl,
                   String rootDN)

getManagerPassword

public String getManagerPassword()

getLDAPURL

public String getLDAPURL()

createFilter

public javax.servlet.Filter createFilter(javax.servlet.FilterConfig filterConfig)

Overrides:

createFilter in class hudson.security.SecurityRealm

canLogOut

public boolean canLogOut()

Overrides:

canLogOut in class hudson.security.SecurityRealm

createSecurityComponents

public hudson.security.SecurityRealm.SecurityComponents createSecurityComponents()

Specified by:

createSecurityComponents in class hudson.security.SecurityRealm

loadUserByUsername

public org.acegisecurity.userdetails.UserDetails loadUserByUsername(String username)
                                                             throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                                    org.springframework.dao.DataAccessException

Overrides:

loadUserByUsername in class hudson.security.SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

loadGroupByGroupname

public hudson.security.GroupDetails loadGroupByGroupname(String groupname)
                                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                         org.springframework.dao.DataAccessException

Overrides:

loadGroupByGroupname in class hudson.security.SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

extractBean

public <T> T extractBean(Class<T> type,
                org.springframework.web.context.WebApplicationContext appContext)