Skip to content

Commit 01da0b8

Browse files
author
Piyush Sadangi (EXT)
committed
LDAP cahcing
1 parent b6f644f commit 01da0b8

File tree

3 files changed

+163
-6
lines changed

3 files changed

+163
-6
lines changed

‎publish-service/pom.xml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,33 @@
8181
</exclusion>
8282
</exclusions>
8383
</dependency>
84+
<dependency>
85+
<groupId>org.springframework.security</groupId>
86+
<artifactId>spring-security-test</artifactId>
87+
<version>5.7.4</version>
88+
<scope>test</scope>
89+
</dependency>
90+
<dependency>
91+
<groupId>org.springframework.security</groupId>
92+
<artifactId>spring-security-ldap</artifactId>
93+
<version>5.7.4</version>
94+
</dependency>
95+
<dependency>
96+
<groupId>org.springframework.security</groupId>
97+
<artifactId>spring-security-config</artifactId>
98+
<version>5.7.4</version>
99+
</dependency>
100+
<dependency>
101+
<groupId>org.springframework.ldap</groupId>
102+
<artifactId>spring-ldap-core</artifactId>
103+
<version>2.4.1</version>
104+
</dependency>
105+
<dependency>
106+
<groupId>org.springframework.boot</groupId>
107+
<artifactId>spring-boot-starter-cache</artifactId>
108+
<version>${springboot.version}</version>
109+
</dependency>
110+
84111
<dependency>
85112
<groupId>io.springfox</groupId>
86113
<artifactId>springfox-swagger-ui</artifactId>

‎publish-service/src/main/java/com/ericsson/eiffel/remrem/publish/config/CachingLdapAuthenticationProvider.java

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
package com.ericsson.eiffel.remrem.publish.config;
2+
3+
import org.springframework.cache.concurrent.ConcurrentMapCache;
4+
import org.springframework.security.authentication.BadCredentialsException;
5+
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
6+
import org.springframework.security.core.Authentication;
7+
import org.springframework.security.core.userdetails.UserCache;
8+
import org.springframework.security.core.userdetails.UserDetails;
9+
import org.springframework.security.core.userdetails.cache.NullUserCache;
10+
import org.springframework.security.core.userdetails.cache.SpringCacheBasedUserCache;
11+
import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
12+
import org.springframework.security.ldap.authentication.LdapAuthenticator;
13+
import org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator;
14+
import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
15+
import org.springframework.stereotype.Component;
16+
import org.springframework.util.StringUtils;
17+
18+
public class CachingLdapAuthenticationProvider extends LdapAuthenticationProvider {
19+
20+
private UserCache userCache = new NullUserCache();
21+
22+
/**
23+
* Create an instance with the supplied authenticator and authorities populator
24+
* implementations.
25+
*
26+
* @param authenticator the authentication strategy (bind, password comparison, etc)
27+
* to be used by this provider for authenticating users.
28+
* @param authoritiesPopulator the strategy for obtaining the authorities for a given
29+
*/
30+
31+
public CachingLdapAuthenticationProvider(LdapAuthenticator authenticator, LdapAuthoritiesPopulator authoritiesPopulator) {
32+
super(authenticator, authoritiesPopulator);
33+
}
34+
35+
public void setUserCache(UserCache userCache) {
36+
this.userCache = userCache;
37+
}
38+
39+
40+
@Override
41+
public Authentication authenticate(Authentication authentication) {
42+
String userName = authentication.getName();
43+
UsernamePasswordAuthenticationToken userToken = (UsernamePasswordAuthenticationToken) authentication;
44+
UserDetails userDetailsFromCache = userCache.getUserFromCache(userName);
45+
if (userDetailsFromCache != null) {
46+
System.out.println("+++---> user in cache");
47+
System.out.println("+++---> usercache data: " + userDetailsFromCache);
48+
additionalAuthenticationChecks(userDetailsFromCache, userToken);
49+
return createSuccessfulAuthentication(userToken, userDetailsFromCache);
50+
} else {
51+
System.out.println("+++---> user not in cache");
52+
Authentication authenticationFromProvider = super.authenticate(authentication);
53+
userCache.putUserInCache((UserDetails)authenticationFromProvider.getPrincipal());
54+
return authenticationFromProvider;
55+
}
56+
57+
}
58+
59+
protected void additionalAuthenticationChecks(UserDetails userDetails,
60+
UsernamePasswordAuthenticationToken authentication) {
61+
if (StringUtils.isEmpty(authentication.getCredentials())) {
62+
System.out.println("+++---> I am in additional checks");
63+
System.out.println("Authentication failed: no credentials provided");
64+
65+
throw new BadCredentialsException(messages.getMessage(
66+
"AbstractUserDetailsAuthenticationProvider.badCredentials",
67+
"Bad credentials"));
68+
}
69+
String presentedPassword = authentication.getCredentials().toString();
70+
System.out.println("+++---> I am in additional checks");
71+
System.out.println("+++---> passowrd" + presentedPassword);
72+
if (!StringUtils.isEmpty(userDetails.getPassword()) && (!presentedPassword.equals(userDetails.getPassword()))) {
73+
System.out.println("Authentication failed: password does not match stored value");
74+
throw new BadCredentialsException(messages.getMessage(
75+
"AbstractUserDetailsAuthenticationProvider.badCredentials",
76+
"Bad credentials"));
77+
}
78+
}
79+
}

‎publish-service/src/main/java/com/ericsson/eiffel/remrem/publish/config/SecurityConfig.java

Lines changed: 57 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,33 @@
2929
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3030
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
3131
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
32+
import org.springframework.cache.annotation.Cacheable;
33+
import org.springframework.beans.factory.annotation.Autowired;
34+
import org.springframework.context.annotation.Configuration;
35+
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
36+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
37+
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
38+
39+
import org.springframework.beans.factory.annotation.Autowired;
40+
import org.springframework.beans.factory.annotation.Value;
41+
import org.springframework.cache.concurrent.ConcurrentMapCache;
42+
import org.springframework.context.annotation.Bean;
43+
import org.springframework.context.annotation.Configuration;
44+
import org.springframework.ldap.core.support.BaseLdapPathContextSource;
45+
import org.springframework.ldap.core.support.LdapContextSource;
46+
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
47+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
48+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
49+
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
50+
import org.springframework.security.core.userdetails.UserCache;
51+
import org.springframework.security.core.userdetails.cache.SpringCacheBasedUserCache;
52+
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
53+
import org.springframework.security.crypto.password.PasswordEncoder;
54+
import org.springframework.security.ldap.authentication.BindAuthenticator;
55+
import org.springframework.security.ldap.authentication.LdapAuthenticator;
56+
import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
57+
import org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator;
58+
import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
3259

3360
/**
3461
* This class is used to enable the ldap authentication based on property
@@ -74,20 +101,44 @@ public Integer getTimeOut() {
74101
@Autowired
75102
private CustomAuthenticationEntryPoint customAuthenticationEntryPoint;
76103

77-
@Autowired
78-
protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
104+
@Bean
105+
public UserCache userCache() {
106+
// Adjust cache settings as necessary
107+
return new SpringCacheBasedUserCache(new ConcurrentMapCache("authenticationCache"));
108+
}
109+
110+
@Bean
111+
public LdapAuthoritiesPopulator ldapAuthoritiesPopulator() {
112+
return new DefaultLdapAuthoritiesPopulator(ldapContextSource(), null); // Adjust the second parameter based on your group search base
113+
// Additional configuration can be set here if necessary
114+
}
115+
116+
117+
@Override
118+
public void configure(AuthenticationManagerBuilder auth) throws Exception {
79119
final String jasyptKey = RabbitMqPropertiesConfig.readJasyptKeyFile(jasyptKeyFilePath);
80120
if (managerPassword.startsWith("{ENC(") && managerPassword.endsWith("}")) {
81121
managerPassword = DecryptionUtils.decryptString(
82122
managerPassword.substring(1, managerPassword.length() - 1), jasyptKey);
83123
}
84124
LOGGER.debug("LDAP server url: " + ldapUrl);
85-
auth.ldapAuthentication()
86-
.userSearchFilter(userSearchFilter)
87-
.contextSource(ldapContextSource());
125+
126+
BindAuthenticator bindAuthenticator = new BindAuthenticator(ldapContextSource());
127+
bindAuthenticator.setUserSearch(new FilterBasedLdapUserSearch("", userSearchFilter, ldapContextSource()));
128+
129+
130+
LdapAuthoritiesPopulator ldapAuthoritiesPopulator = ldapAuthoritiesPopulator();
131+
132+
// Create and use the caching LDAP authentication provider
133+
CachingLdapAuthenticationProvider cachingProvider =
134+
new CachingLdapAuthenticationProvider(bindAuthenticator, ldapAuthoritiesPopulator);
135+
136+
cachingProvider.setUserCache(userCache());
137+
auth.authenticationProvider(cachingProvider);
138+
88139
}
89140

90-
public BaseLdapPathContextSource ldapContextSource() {
141+
public LdapContextSource ldapContextSource() {
91142
LdapContextSource ldap = new LdapContextSource();
92143
ldap.setUrl(ldapUrl);
93144
ldap.setBase(rootDn);

0 commit comments

Comments
 (0)