[jboss-cvs] JBossAS SVN: r114539 - projects/security/security-negotiation/trunk/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation.

[jboss-cvs-commits at lists.jboss.org]

Author: darran.lofthouse at jboss.com
Date: 2013-10-23 13:40:14 -0400 (Wed, 23 Oct 2013)
New Revision: 114539

Modified:
   projects/security/security-negotiation/trunk/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java
Log:
[SECURITY-735] Correct the point where the distinguished name needs to be quoted, i.e. just before being used in a getAttributes() call.

Modified: projects/security/security-negotiation/trunk/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java
===================================================================
--- projects/security/security-negotiation/trunk/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java	2013-10-23 17:39:58 UTC (rev 114538)
+++ projects/security/security-negotiation/trunk/jboss-negotiation-extras/src/main/java/org/jboss/security/negotiation/AdvancedLdapLoginModule.java	2013-10-23 17:40:14 UTC (rev 114539)
@@ -533,6 +533,9 @@
 
    protected void rolesSearch(LdapContext searchContext, String dn) throws LoginException
    {
+      /*
+       * The distinguished name passed into this method is expected to be unquoted.
+       */
       Object[] filterArgs =
       {getIdentity().getName(), dn};
 
@@ -564,6 +567,10 @@
                      {
                         resultDN = sr.getNameInNamespace();
                      }
+                     /*
+                      * By this point if the distinguished name needs to be quoted for attribute
+                      * searches it will have been already.
+                      */
                      obtainRole(searchContext, resultDN, sr);
                   }
                   referralsExist = false;
@@ -576,7 +583,11 @@
          }
          else
          {
-            obtainRole(searchContext, dn, null);
+            /*
+             * As there was no search based on the distinguished name it would not have been
+             * auto-quoted - do that here to be safe.
+             */
+            obtainRole(searchContext, quoted(dn), null);
          }
       }
       catch (NamingException e)
@@ -602,6 +613,16 @@
 
    }
 
+   private String quoted(final String dn) {
+       String temp = dn.trim();
+
+       if (temp.startsWith("\"") && temp.endsWith("\"")) {
+           return temp;
+       }
+
+       return "\"" + temp + "\"";
+   }
+
    protected void obtainRole(LdapContext searchContext, String dn, SearchResult sr) throws NamingException, LoginException
    {
       if (trace) {