public class SimpleAuthenticator extends AbstractAuthenticator
Authenticator
that authenticates clear text passwords
contained within the userPassword
attribute in DIT. If the
password is stored with a one-way encryption applied (e.g. SHA), the password
is hashed the same way before comparison.
We use a cache to speedup authentication, where the Dn/password are stored.LOG
Constructor and Description |
---|
SimpleAuthenticator()
Creates a new instance.
|
SimpleAuthenticator(org.apache.directory.api.ldap.model.name.Dn baseDn)
Creates a new instance.
|
SimpleAuthenticator(int cacheSize)
Creates a new instance, with an initial cache size
|
SimpleAuthenticator(int cacheSize,
org.apache.directory.api.ldap.model.name.Dn baseDn)
Creates a new instance, with an initial cache size
|
Modifier and Type | Method and Description |
---|---|
LdapPrincipal |
authenticate(BindOperationContext bindContext)
Looks up userPassword attribute of the entry whose name is the
value of
Context#SECURITY_PRINCIPAL environment variable, and
authenticates a user with the plain-text password. |
protected String |
createDigestedPassword(String algorithm,
byte[] password)
Creates a digested password.
|
protected String |
getAlgorithmForHashedPassword(byte[] password)
Get the algorithm of a password, which is stored in the form "{XYZ}...".
|
void |
invalidateCache(org.apache.directory.api.ldap.model.name.Dn bindDn)
Remove the principal form the cache.
|
checkPwdPolicy, destroy, doDestroy, doInit, getAuthenticatorType, getBaseDn, getDirectoryService, init, isValid, setBaseDn
public SimpleAuthenticator()
public SimpleAuthenticator(org.apache.directory.api.ldap.model.name.Dn baseDn)
AbstractAuthenticator
public SimpleAuthenticator(int cacheSize)
cacheSize
- the size of the credential cachepublic SimpleAuthenticator(int cacheSize, org.apache.directory.api.ldap.model.name.Dn baseDn)
cacheSize
- the size of the credential cachepublic LdapPrincipal authenticate(BindOperationContext bindContext) throws org.apache.directory.api.ldap.model.exception.LdapException
Looks up userPassword attribute of the entry whose name is the
value of Context#SECURITY_PRINCIPAL
environment variable, and
authenticates a user with the plain-text password.
bindContext
- The Bind contextorg.apache.directory.api.ldap.model.exception.LdapException
protected String getAlgorithmForHashedPassword(byte[] password) throws IllegalArgumentException
password
- a byte[]IllegalArgumentException
- if the algorithm cannot be identifiedprotected String createDigestedPassword(String algorithm, byte[] password) throws IllegalArgumentException
algorithm
- an algorithm which is supported by
java.security.MessageDigest, e.g. SHApassword
- password value, a byte[]IllegalArgumentException
- if password is neither a String nor a byte[], or algorithm is
not known to java.security.MessageDigest classpublic void invalidateCache(org.apache.directory.api.ldap.model.name.Dn bindDn)
invalidateCache
in interface Authenticator
invalidateCache
in class AbstractAuthenticator
bindDn
- the already normalized distinguished name of the bind principalCopyright © 2016. All rights reserved.