org.jenkinsci.plugins.reverse_proxy_auth

Class ReverseProxySecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<hudson.security.SecurityRealm>

hudson.security.SecurityRealm

org.jenkinsci.plugins.reverse_proxy_auth.ReverseProxySecurityRealm

All Implemented Interfaces:

hudson.ExtensionPoint, hudson.model.Describable<hudson.security.SecurityRealm>

public class ReverseProxySecurityRealm
extends hudson.security.SecurityRealm

Author:

Kohsuke Kawaguchi

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ReverseProxySecurityRealm.ProxyLDAPDescriptor
static class	ReverseProxySecurityRealm.ReverseProxyUserDetailsService

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

hudson.security.SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
org.acegisecurity.GrantedAuthority[]	authorities The authorities that are granted to the authenticated user.
boolean	disableLdapEmailResolver
String	forwardedUser The name of the header which the username has to be extracted from.
static String	GROUP_SEARCH LDAP filter to look for groups by their names.
String	groupMembershipFilter Query to locate the group entries that a user belongs to, given the user object.
String	groupSearchBase This defines the organizational unit that contains groups.
String	groupSearchFilter Query to locate an entry that identifies the group, given the group name string.
String	headerGroups Header name of the groups field.
String	headerGroupsDelimiter Header name of the groups delimiter field.
boolean	inhibitInferRootDN Allow the rootDN to be inferred? Default is false.
String	managerDN If non-null, we use this and managerPassword when binding to LDAP.
String	retrievedUser The username retrieved from the header field, which is represented by the forwardedUser attribute.
String	rootDN The root DN to connect to.
String	server LDAP server name(s) separated by spaces, optionally with TCP port number, like "ldap.acme.org" or "ldap.acme.org:389" and/or with protcol, like "ldap://ldap.acme.org".
int	updateInterval Sets an interval for updating the LDAP authorities.
String	userSearch Query to locate an entry that identifies the user, given the user name string.
String	userSearchBase Specifies the relative DN from the root DN.

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description

ReverseProxySecurityRealm(String forwardedUser, String headerGroups, String headerGroupsDelimiter, String server, String rootDN, boolean inhibitInferRootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String managerDN, String managerPassword, Integer updateInterval, boolean disableLdapEmailResolver, String displayNameLdapAttribute, String emailAddressLdapAttribute)

Method Summary

Modifier and Type	Method and Description
boolean	canLogOut()
javax.servlet.Filter	createFilter(javax.servlet.FilterConfig filterConfig)
hudson.security.SecurityRealm.SecurityComponents	createSecurityComponents()
<T> T	extractBean(Class<T> type, org.springframework.web.context.WebApplicationContext appContext)
String	getDisplayNameLdapAttribute()
String	getEmailAddressLdapAttribute()
String	getForwardedUser() Name of the HTTP header to look at.
String	getGroupMembershipFilter()
String	getGroupSearchFilter()
String	getHeaderGroups()
String	getHeaderGroupsDelimiter()
String	getLDAPURL()
String	getManagerPassword()
String	getServerUrl()
int	getUpdateInterval()
hudson.security.GroupDetails	loadGroupByGroupname(String groupname)
org.acegisecurity.userdetails.UserDetails	loadUserByUsername(String username)
static String	toProviderUrl(String serverUrl, String rootDN)
org.acegisecurity.userdetails.ldap.LdapUserDetails	updateLdapUserDetails(org.acegisecurity.userdetails.ldap.LdapUserDetails d)

Methods inherited from class hudson.security.SecurityRealm

all, allowsSignup, commenceSignup, createCliAuthenticator, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getDescriptor, getLoginUrl, getPostLogOutUrl, getSecurityComponents, loadGroupByGroupname, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

GROUP_SEARCH

public static String GROUP_SEARCH

LDAP filter to look for groups by their names. "{0}" is the group name as given by the user. See http://msdn.microsoft.com/en-us/library/aa746475(VS.85).aspx for the syntax by example. WANTED: The specification of the syntax.

server

public final String server

LDAP server name(s) separated by spaces, optionally with TCP port number, like "ldap.acme.org" or "ldap.acme.org:389" and/or with protcol, like "ldap://ldap.acme.org".

rootDN

public final String rootDN

The root DN to connect to. Normally something like "dc=sun,dc=com" How do I infer this?

inhibitInferRootDN

public final boolean inhibitInferRootDN

Allow the rootDN to be inferred? Default is false. If true, allow rootDN to be blank.

userSearchBase

public final String userSearchBase

Specifies the relative DN from the root DN. This is used to narrow down the search space when doing user search. Something like "ou=people" but can be empty.

userSearch

public final String userSearch

Query to locate an entry that identifies the user, given the user name string. Normally "uid={0}"

See Also:

FilterBasedLdapUserSearch

groupSearchBase

public final String groupSearchBase

This defines the organizational unit that contains groups. Normally "" to indicate the full LDAP search, but can be often narrowed down to something like "ou=groups"

See Also:

FilterBasedLdapUserSearch

groupSearchFilter

public final String groupSearchFilter

Query to locate an entry that identifies the group, given the group name string. If non-null it will override the default specified by GROUP_SEARCH

Since:

1.5

groupMembershipFilter

public final String groupMembershipFilter

Query to locate the group entries that a user belongs to, given the user object. {0} is the user's full DN while {1} is the username.

managerDN

public final String managerDN

If non-null, we use this and managerPassword when binding to LDAP. This is necessary when LDAP doesn't support anonymous access.

updateInterval

public final int updateInterval

Sets an interval for updating the LDAP authorities. The interval is specified in minutes.

authorities

public transient org.acegisecurity.GrantedAuthority[] authorities

The authorities that are granted to the authenticated user. It is not necessary, that the authorities will be stored in the config.xml, they blow up the config.xml

forwardedUser

public final String forwardedUser

The name of the header which the username has to be extracted from.

retrievedUser

public String retrievedUser

The username retrieved from the header field, which is represented by the forwardedUser attribute.

headerGroups

public final String headerGroups

Header name of the groups field.

headerGroupsDelimiter

public final String headerGroupsDelimiter

Header name of the groups delimiter field.

disableLdapEmailResolver

public final boolean disableLdapEmailResolver

Constructor Detail

ReverseProxySecurityRealm

@DataBoundConstructor
public ReverseProxySecurityRealm(String forwardedUser,
                                                       String headerGroups,
                                                       String headerGroupsDelimiter,
                                                       String server,
                                                       String rootDN,
                                                       boolean inhibitInferRootDN,
                                                       String userSearchBase,
                                                       String userSearch,
                                                       String groupSearchBase,
                                                       String groupSearchFilter,
                                                       String groupMembershipFilter,
                                                       String managerDN,
                                                       String managerPassword,
                                                       Integer updateInterval,
                                                       boolean disableLdapEmailResolver,
                                                       String displayNameLdapAttribute,
                                                       String emailAddressLdapAttribute)

Method Detail

getForwardedUser

public String getForwardedUser()

Name of the HTTP header to look at.

getHeaderGroups

public String getHeaderGroups()

getHeaderGroupsDelimiter

public String getHeaderGroupsDelimiter()

getServerUrl

public String getServerUrl()

getGroupSearchFilter

public String getGroupSearchFilter()

getGroupMembershipFilter

public String getGroupMembershipFilter()

getDisplayNameLdapAttribute

public String getDisplayNameLdapAttribute()

getEmailAddressLdapAttribute

public String getEmailAddressLdapAttribute()

toProviderUrl

public static String toProviderUrl(String serverUrl,
                                   String rootDN)

getManagerPassword

public String getManagerPassword()

getUpdateInterval

public int getUpdateInterval()

getLDAPURL

public String getLDAPURL()

createFilter

public javax.servlet.Filter createFilter(javax.servlet.FilterConfig filterConfig)

Overrides:

createFilter in class hudson.security.SecurityRealm

canLogOut

public boolean canLogOut()

Overrides:

canLogOut in class hudson.security.SecurityRealm

createSecurityComponents

public hudson.security.SecurityRealm.SecurityComponents createSecurityComponents()

Specified by:

createSecurityComponents in class hudson.security.SecurityRealm

loadUserByUsername

public org.acegisecurity.userdetails.UserDetails loadUserByUsername(String username)
                                                             throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                                    org.springframework.dao.DataAccessException

Overrides:

loadUserByUsername in class hudson.security.SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

updateLdapUserDetails

public org.acegisecurity.userdetails.ldap.LdapUserDetails updateLdapUserDetails(org.acegisecurity.userdetails.ldap.LdapUserDetails d)

loadGroupByGroupname

public hudson.security.GroupDetails loadGroupByGroupname(String groupname)
                                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                         org.springframework.dao.DataAccessException

Overrides:

loadGroupByGroupname in class hudson.security.SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

extractBean

public <T> T extractBean(Class<T> type,
                         org.springframework.web.context.WebApplicationContext appContext)