/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2016 ForgeRock AS.
|
* Portions Copyright 2026 3A Systems, LLC.
|
*/
|
package org.forgerock.opendj.rest2ldap.authz;
|
|
import static org.forgerock.opendj.rest2ldap.Rest2Ldap.asResourceException;
|
import static org.forgerock.util.Utils.closeSilently;
|
|
import java.io.Closeable;
|
import java.util.concurrent.atomic.AtomicReference;
|
|
import org.forgerock.http.oauth2.AccessTokenException;
|
import org.forgerock.http.protocol.Response;
|
import org.forgerock.http.protocol.Status;
|
import org.forgerock.i18n.LocalizableMessage;
|
import org.forgerock.i18n.LocalizedIllegalArgumentException;
|
import org.forgerock.json.resource.ResourceException;
|
import org.forgerock.opendj.ldap.DN;
|
import org.forgerock.opendj.ldap.LdapException;
|
import org.forgerock.opendj.ldap.ResultCode;
|
import org.forgerock.opendj.ldap.schema.Schema;
|
import org.forgerock.util.AsyncFunction;
|
import org.forgerock.util.promise.NeverThrowsException;
|
import org.forgerock.util.promise.Promise;
|
import org.forgerock.util.promise.Promises;
|
|
final class Utils {
|
private static final AsyncFunction<LdapException, Response, NeverThrowsException> HANDLE_CONNECTION_FAILURE =
|
new AsyncFunction<LdapException, Response, NeverThrowsException>() {
|
@Override
|
public Promise<Response, NeverThrowsException> apply(final LdapException exception) {
|
return asErrorResponse(exception);
|
}
|
};
|
|
private Utils() { }
|
|
static IllegalArgumentException newIllegalArgumentException(final LocalizableMessage message) {
|
return new IllegalArgumentException(message.toString());
|
}
|
|
static AccessTokenException newAccessTokenException(final LocalizableMessage message) {
|
return newAccessTokenException(message, null);
|
}
|
|
static AccessTokenException newAccessTokenException(final LocalizableMessage message, final Exception cause) {
|
return new AccessTokenException(message.toString(), cause);
|
}
|
|
/**
|
* Returns the DN which a bind DN template designates for a user name.
|
*
|
* @param dnTemplate
|
* The template, with {@code %s} in place of the user name. A template which is just {@code %s} takes the
|
* user name as the DN; otherwise the user name is escaped as an attribute value.
|
* @param schema
|
* The schema used to parse the DN.
|
* @param username
|
* The user name.
|
* @return The DN.
|
* @throws LdapException
|
* With {@link ResultCode#INVALID_CREDENTIALS} if the result is not a valid DN.
|
*/
|
static DN formatBindDn(final String dnTemplate, final Schema schema, final String username)
|
throws LdapException {
|
try {
|
return "%s".equals(dnTemplate)
|
? DN.valueOf(username, schema)
|
: DN.format(dnTemplate, schema, username);
|
} catch (final LocalizedIllegalArgumentException e) {
|
throw LdapException.newLdapException(ResultCode.INVALID_CREDENTIALS, e.getMessageObject(), e);
|
}
|
}
|
|
static Runnable close(final AtomicReference<? extends Closeable> holder) {
|
return new Runnable() {
|
@Override
|
public void run() {
|
closeSilently(holder.get());
|
}
|
};
|
}
|
|
static AsyncFunction<LdapException, Response, NeverThrowsException> handleConnectionFailure() {
|
return HANDLE_CONNECTION_FAILURE;
|
}
|
|
static Promise<Response, NeverThrowsException> asErrorResponse(final Throwable t) {
|
final ResourceException e = asResourceException(t);
|
final Response response = new Response(Status.valueOf(e.getCode())).setEntity(e.toJsonValue() .getObject());
|
if (response.getStatus() == Status.UNAUTHORIZED) {
|
response.getHeaders().put("WWW-Authenticate", "Basic");
|
}
|
return Promises.newResultPromise(response);
|
}
|
}
|
