org.jenkinsci.plugins.reverse_proxy_auth

Class ReverseProxySecurityRealm

java.lang.Object

hudson.model.AbstractDescribableImpl<SecurityRealm>

hudson.security.SecurityRealm

org.jenkinsci.plugins.reverse_proxy_auth.ReverseProxySecurityRealm

All Implemented Interfaces:

ExtensionPoint, Describable<SecurityRealm>

public class ReverseProxySecurityRealm
extends SecurityRealm

Author:

Kohsuke Kawaguchi

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ReverseProxySecurityRealm.ProxyLDAPDescriptor
static class	ReverseProxySecurityRealm.ReverseProxyUserDetailsService

Nested classes/interfaces inherited from class hudson.security.SecurityRealm

SecurityRealm.SecurityComponents

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
org.acegisecurity.GrantedAuthority[]	authorities The authorities that are granted to the authenticated user.
String	customLogInUrl Custom post logout url
String	customLogOutUrl
boolean	disableLdapEmailResolver
String	forwardedUser The name of the header which the username has to be extracted from.
static String	GROUP_SEARCH LDAP filter to look for groups by their names.
String	groupMembershipFilter Query to locate the group entries that a user belongs to, given the user object.
String	groupNameAttribute Attribute that should be used instead of CN as name to match a users group name to the groupSearchFilter name.
String	groupSearchBase This defines the organizational unit that contains groups.
String	groupSearchFilter Query to locate an entry that identifies the group, given the group name string.
String	headerGroups Header name of the groups field.
String	headerGroupsDelimiter Header name of the groups delimiter field.
boolean	inhibitInferRootDN Allow the rootDN to be inferred? Default is false.
String	managerDN If non-null, we use this and managerPassword when binding to LDAP.
String	retrievedUser The username retrieved from the header field, which is represented by the forwardedUser attribute.
String	rootDN The root DN to connect to.
String	server LDAP server name(s) separated by spaces, optionally with TCP port number, like "ldap.acme.org" or "ldap.acme.org:389" and/or with protcol, like "ldap://ldap.acme.org".
int	updateInterval Sets an interval for updating the LDAP authorities.
String	userSearch Query to locate an entry that identifies the user, given the user name string.
String	userSearchBase Specifies the relative DN from the root DN.

Fields inherited from class hudson.security.SecurityRealm

AUTHENTICATED_AUTHORITY, LIST, NO_AUTHENTICATION

Constructor Summary

Constructors

Constructor and Description

ReverseProxySecurityRealm(String forwardedUser, String headerGroups, String headerGroupsDelimiter, String customLogInUrl, String customLogOutUrl, String server, String rootDN, boolean inhibitInferRootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String groupNameAttribute, String managerDN, String managerPassword, Integer updateInterval, boolean disableLdapEmailResolver, String displayNameLdapAttribute, String emailAddressLdapAttribute)

Method Summary

Modifier and Type	Method and Description
boolean	canLogOut()
javax.servlet.Filter	createFilter(javax.servlet.FilterConfig filterConfig)
SecurityRealm.SecurityComponents	createSecurityComponents()
String	getDisplayNameLdapAttribute()
String	getEmailAddressLdapAttribute()
String	getForwardedUser() Name of the HTTP header to look at.
String	getGroupMembershipFilter()
String	getGroupNameAttribute()
String	getGroupSearchFilter()
String	getHeaderGroups()
String	getHeaderGroupsDelimiter()
String	getLDAPURL()
String	getManagerPassword()
String	getPostLogOutUrl(org.kohsuke.stapler.StaplerRequest req, org.acegisecurity.Authentication auth)
String	getServerUrl()
int	getUpdateInterval()
GroupDetails	loadGroupByGroupname(String groupname)
org.acegisecurity.userdetails.UserDetails	loadUserByUsername(String username)
void	setGroupNameAttribute(String groupNameAttribute)
static String	toProviderUrl(String serverUrl, String rootDN)
org.acegisecurity.userdetails.ldap.LdapUserDetails	updateLdapUserDetails(org.acegisecurity.userdetails.ldap.LdapUserDetails d)

Methods inherited from class hudson.security.SecurityRealm

all, allowsSignup, commenceSignup, createCliAuthenticator, doCaptcha, doLogout, findBean, getAuthenticationGatewayUrl, getCaptchaSupport, getCaptchaSupportDescriptors, getDescriptor, getFrom, getGroupIdStrategy, getLoginUrl, getSecurityComponents, getUserIdStrategy, loadGroupByGroupname, setCaptchaSupport, validateCaptcha

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

GROUP_SEARCH

public static String GROUP_SEARCH

LDAP filter to look for groups by their names. "{0}" is the group name as given by the user. See http://msdn.microsoft.com/en-us/library/aa746475(VS.85).aspx for the syntax by example. WANTED: The specification of the syntax.

server

public final String server

LDAP server name(s) separated by spaces, optionally with TCP port number, like "ldap.acme.org" or "ldap.acme.org:389" and/or with protcol, like "ldap://ldap.acme.org".

rootDN

public final String rootDN

The root DN to connect to. Normally something like "dc=sun,dc=com" How do I infer this?

inhibitInferRootDN

public final boolean inhibitInferRootDN

Allow the rootDN to be inferred? Default is false. If true, allow rootDN to be blank.

userSearchBase

public final String userSearchBase

Specifies the relative DN from the root DN. This is used to narrow down the search space when doing user search. Something like "ou=people" but can be empty.

userSearch

public final String userSearch

Query to locate an entry that identifies the user, given the user name string. Normally "uid={0}"

See Also:

FilterBasedLdapUserSearch

groupSearchBase

public final String groupSearchBase

This defines the organizational unit that contains groups. Normally "" to indicate the full LDAP search, but can be often narrowed down to something like "ou=groups"

See Also:

FilterBasedLdapUserSearch

groupSearchFilter

public final String groupSearchFilter

Query to locate an entry that identifies the group, given the group name string. If non-null it will override the default specified by GROUP_SEARCH

Since:

1.5

groupMembershipFilter

public final String groupMembershipFilter

Query to locate the group entries that a user belongs to, given the user object. {0} is the user's full DN while {1} is the username.

groupNameAttribute

public String groupNameAttribute

Attribute that should be used instead of CN as name to match a users group name to the groupSearchFilter name. When groupSearchFilter is set to search for a field other than CN e.g. GroupDisplayName={0} here you can configure that this (GroupDisplayName) or another field should be used when looking for a users groups.

managerDN

public final String managerDN

If non-null, we use this and managerPassword when binding to LDAP. This is necessary when LDAP doesn't support anonymous access.

updateInterval

public final int updateInterval

Sets an interval for updating the LDAP authorities. The interval is specified in minutes.

authorities

public transient org.acegisecurity.GrantedAuthority[] authorities

The authorities that are granted to the authenticated user. It is not necessary, that the authorities will be stored in the config.xml, they blow up the config.xml

forwardedUser

@CheckForNull
public final String forwardedUser

The name of the header which the username has to be extracted from.

retrievedUser

public String retrievedUser

The username retrieved from the header field, which is represented by the forwardedUser attribute.

headerGroups

public final String headerGroups

Header name of the groups field.

headerGroupsDelimiter

public final String headerGroupsDelimiter

Header name of the groups delimiter field.

disableLdapEmailResolver

public final boolean disableLdapEmailResolver

customLogInUrl

public final String customLogInUrl

Custom post logout url

customLogOutUrl

public final String customLogOutUrl

Constructor Detail

ReverseProxySecurityRealm

@DataBoundConstructor
public ReverseProxySecurityRealm(String forwardedUser,
                                                       String headerGroups,
                                                       String headerGroupsDelimiter,
                                                       String customLogInUrl,
                                                       String customLogOutUrl,
                                                       String server,
                                                       String rootDN,
                                                       boolean inhibitInferRootDN,
                                                       String userSearchBase,
                                                       String userSearch,
                                                       String groupSearchBase,
                                                       String groupSearchFilter,
                                                       String groupMembershipFilter,
                                                       String groupNameAttribute,
                                                       String managerDN,
                                                       String managerPassword,
                                                       Integer updateInterval,
                                                       boolean disableLdapEmailResolver,
                                                       String displayNameLdapAttribute,
                                                       String emailAddressLdapAttribute)

Method Detail

getForwardedUser

public String getForwardedUser()

Name of the HTTP header to look at.

getHeaderGroups

public String getHeaderGroups()

getHeaderGroupsDelimiter

public String getHeaderGroupsDelimiter()

getServerUrl

@CheckForNull
public String getServerUrl()

getGroupSearchFilter

public String getGroupSearchFilter()

getGroupMembershipFilter

public String getGroupMembershipFilter()

getGroupNameAttribute

public String getGroupNameAttribute()

setGroupNameAttribute

public void setGroupNameAttribute(String groupNameAttribute)

getDisplayNameLdapAttribute

public String getDisplayNameLdapAttribute()

getEmailAddressLdapAttribute

public String getEmailAddressLdapAttribute()

toProviderUrl

@Nullable
public static String toProviderUrl(@CheckForNull
                                             String serverUrl,
                                             @CheckForNull
                                             String rootDN)

getManagerPassword

public String getManagerPassword()

getUpdateInterval

public int getUpdateInterval()

getLDAPURL

public String getLDAPURL()

createFilter

public javax.servlet.Filter createFilter(javax.servlet.FilterConfig filterConfig)

Overrides:

createFilter in class SecurityRealm

canLogOut

public boolean canLogOut()

Overrides:

canLogOut in class SecurityRealm

getPostLogOutUrl

public String getPostLogOutUrl(org.kohsuke.stapler.StaplerRequest req,
                               org.acegisecurity.Authentication auth)

Overrides:

getPostLogOutUrl in class SecurityRealm

createSecurityComponents

public SecurityRealm.SecurityComponents createSecurityComponents()
                                                          throws org.springframework.dao.DataAccessException

Specified by:

createSecurityComponents in class SecurityRealm

Throws:

org.springframework.dao.DataAccessException

loadUserByUsername

public org.acegisecurity.userdetails.UserDetails loadUserByUsername(String username)
                                                             throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                                                    org.springframework.dao.DataAccessException

Overrides:

loadUserByUsername in class SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException

updateLdapUserDetails

public org.acegisecurity.userdetails.ldap.LdapUserDetails updateLdapUserDetails(org.acegisecurity.userdetails.ldap.LdapUserDetails d)

loadGroupByGroupname

public GroupDetails loadGroupByGroupname(String groupname)
                                  throws org.acegisecurity.userdetails.UsernameNotFoundException,
                                         org.springframework.dao.DataAccessException

Overrides:

loadGroupByGroupname in class SecurityRealm

Throws:

org.acegisecurity.userdetails.UsernameNotFoundException

org.springframework.dao.DataAccessException