[jboss-jira] [JBoss JIRA] Created: (JBPORTAL-2282) LDAP Role Retrieval Fails When Role Stored in Operational Attribute (LDAPStaticRoleMembershipModuleImpl)
LDAP Role Retrieval Fails When Role Stored in Operational Attribute
(LDAPStaticRoleMembershipModuleImpl)
--------------------------------------------------------------------------------------------------------
Key: JBPORTAL-2282
URL: https://jira.jboss.org/jira/browse/JBPORTAL-2282
Project: JBoss Portal
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Portal Identity
Affects Versions: 2.7.0 Final, 2.6.7 Final, 2.7.2 Final
Environment: Linux Kernel 2.6.9
JDK 1.6u11
JBoss Portal 2.7.2
JBoss AS 4.2.3GA (bundled with Portal)
OpenSSO 8
SunDS 6.3 (with OpenSSO schema)
Reporter: Greg Wittel
I was working on OpenSSO integration / getting LDAP Roles working (i.e. role stored in
LDAP User Attribute) and found a bug that causes the role retrieval to not work with
certain LDAP directory structures.
The module org.jboss.portal.identity.ldap.LDAPStaticRoleMembershipModuleImpl has a bug
where it only retrieves regular attributes and not those defined as "Operational
Attributes" by javax.naming.directory.DirContext. This means that in cases where
the 'memberOfAttributeId' is stored in an operational attribute, the role will
never be retrieved, and getRoles() incorrectly returns an empty role list. An example of
an attribute that is treated as operational is: nsRoleDN. nsRoleDN is used by OpenSSO as
the default attribute under which user roles are stored.
The problem section:
See: Rev 9064 LDAPStaticRoleMembershipModuleImpl.java
(http://fisheye.jboss.org/browse/Portal/modules/identity/trunk/identity/sr...)
101 Attributes attrs = ldapContext.getAttributes(ldapUser.getDn());
102
103 //log.debug("User attributes: " + attrs);
104 if (attrs == null )
105 {
106 throw new IdentityException("Cannot find User with DN: " +
ldapUser.getDn());
107 }
108
109 Attribute memberOfAttribute = attrs.get(getMemberAttributeID());
110
111 //if there are no members
112 if (memberOfAttribute == null)
On line 101, the getAttributes() function only returns regular attributes and not
operational attributes. It will only return operational attributes when you request them
by name. In the case where the role is stored in an operational attribute, line 109 will
return null, resulting in an empty role hash to be returned.
Since an empty Role hash is returned unless MemberAttributeID is set, it makes sense to
request the role attribute directly, rather than indirectly. You can do this via changing
the ldapContext.getAttributes line:
String[] memberAttrs = { getMemberAttributeID() };
Attributes attrs = ldapContext.getAttributes(ldapUser.getDn(), memberAttrs);
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira