001/*
002 *  Licensed to the Apache Software Foundation (ASF) under one
003 *  or more contributor license agreements.  See the NOTICE file
004 *  distributed with this work for additional information
005 *  regarding copyright ownership.  The ASF licenses this file
006 *  to you under the Apache License, Version 2.0 (the
007 *  "License"); you may not use this file except in compliance
008 *  with the License.  You may obtain a copy of the License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 *  Unless required by applicable law or agreed to in writing,
013 *  software distributed under the License is distributed on an
014 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 *  KIND, either express or implied.  See the License for the
016 *  specific language governing permissions and limitations
017 *  under the License.
018 *
019 */
020package org.apache.directory.server.ldap.handlers.sasl.gssapi;
021
022
023import javax.naming.Context;
024import javax.security.auth.kerberos.KerberosPrincipal;
025import javax.security.sasl.AuthorizeCallback;
026
027import org.apache.directory.api.ldap.model.constants.AuthenticationLevel;
028import org.apache.directory.api.ldap.model.entry.Attribute;
029import org.apache.directory.api.ldap.model.message.BindRequest;
030import org.apache.directory.api.ldap.model.name.Dn;
031import org.apache.directory.api.util.Strings;
032import org.apache.directory.server.core.api.CoreSession;
033import org.apache.directory.server.core.api.LdapPrincipal;
034import org.apache.directory.server.kerberos.shared.store.PrincipalStoreEntry;
035import org.apache.directory.server.protocol.shared.kerberos.GetPrincipal;
036import org.apache.directory.server.ldap.LdapSession;
037import org.apache.directory.server.ldap.handlers.sasl.AbstractSaslCallbackHandler;
038import org.apache.directory.server.ldap.handlers.sasl.SaslConstants;
039import org.slf4j.Logger;
040import org.slf4j.LoggerFactory;
041
042
043/**
044 * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
045 */
046public class GssapiCallbackHandler extends AbstractSaslCallbackHandler
047{
048    private static final Logger LOG = LoggerFactory.getLogger( GssapiCallbackHandler.class );
049
050
051    /**
052     * Creates a new instance of GssapiCallbackHandler.
053     *
054     * @param ldapSession the mina IO session
055     * @param adminSession the admin session
056     * @param bindRequest the bind message
057     */
058    public GssapiCallbackHandler( LdapSession ldapSession, CoreSession adminSession, BindRequest bindRequest )
059    {
060        super( adminSession.getDirectoryService(), bindRequest );
061        this.ldapSession = ldapSession;
062        this.adminSession = adminSession;
063    }
064
065
066    protected Attribute lookupPassword( String username, String password )
067    {
068        // do nothing, password not used by GSSAPI
069        return null;
070    }
071
072
073    protected void authorize( AuthorizeCallback authorizeCB ) throws Exception
074    {
075        LOG.debug( "Processing conversion of principal name to Dn." );
076
077        String username = authorizeCB.getAuthorizationID();
078
079        // find the user's entry
080        GetPrincipal getPrincipal = new GetPrincipal( new KerberosPrincipal( username ) );
081        PrincipalStoreEntry entry = ( PrincipalStoreEntry ) getPrincipal.execute( adminSession, new Dn( ldapSession
082            .getLdapServer().getSearchBaseDn() ) );
083        String bindDn = entry.getDistinguishedName();
084
085        LOG.debug( "Converted username {} to Dn {}.", username, bindDn );
086
087        LdapPrincipal ldapPrincipal = new LdapPrincipal( adminSession.getDirectoryService().getSchemaManager(),
088            new Dn( entry.getDistinguishedName() ),
089            AuthenticationLevel.STRONG, Strings.EMPTY_BYTES );
090        ldapSession.putSaslProperty( SaslConstants.SASL_AUTHENT_USER, ldapPrincipal );
091        ldapSession.putSaslProperty( Context.SECURITY_PRINCIPAL, bindDn );
092
093        authorizeCB.setAuthorizedID( bindDn );
094        authorizeCB.setAuthorized( true );
095    }
096}