Minor code cleanup
* remove unused methods
* remove extra whitespace
* convert tabs to spaces.
| | |
| | | Copyright 2016 ForgeRock AS. |
| | | ! --> |
| | | <adm:managed-object name="rest2ldap-endpoint" |
| | | plural-name="rest2ldap-endpoints" extends="http-endpoint" |
| | | package="org.forgerock.opendj.server.config" xmlns:adm="http://opendj.forgerock.org/admin" |
| | | xmlns:ldap="http://opendj.forgerock.org/admin-ldap"> |
| | | plural-name="rest2ldap-endpoints" extends="http-endpoint" |
| | | package="org.forgerock.opendj.server.config" xmlns:adm="http://opendj.forgerock.org/admin" |
| | | xmlns:ldap="http://opendj.forgerock.org/admin-ldap"> |
| | | |
| | | <adm:synopsis> |
| | | The <adm:user-friendly-name /> provides RESTful access to LDAP application data using a set of |
| | | customizable data transformations. |
| | | </adm:synopsis> |
| | | <adm:profile name="ldap"> |
| | | <ldap:object-class> |
| | | <ldap:name>ds-cfg-rest2ldap-endpoint</ldap:name> |
| | | <ldap:superior>ds-cfg-http-endpoint</ldap:superior> |
| | | </ldap:object-class> |
| | | </adm:profile> |
| | | <adm:property-override name="java-class" |
| | | advanced="true"> |
| | | <adm:default-behavior> |
| | | <adm:defined> |
| | | <adm:value> |
| | | org.opends.server.protocols.http.rest2ldap.Rest2LdapEndpoint |
| | | </adm:value> |
| | | </adm:defined> |
| | | </adm:default-behavior> |
| | | </adm:property-override> |
| | | <adm:property name="config-url" mandatory="true"> |
| | | <adm:synopsis> |
| | | URL of the REST2LDAP configuration file. |
| | | </adm:synopsis> |
| | | <adm:syntax> |
| | | <adm:pattern> |
| | | <adm:regex>.*</adm:regex> |
| | | <adm:usage>URL</adm:usage> |
| | | <adm:synopsis> |
| | | An URL to an existing file that is readable by the server. |
| | | </adm:synopsis> |
| | | </adm:pattern> |
| | | </adm:syntax> |
| | | <adm:profile name="ldap"> |
| | | <ldap:attribute> |
| | | <ldap:name>ds-cfg-config-url</ldap:name> |
| | | </ldap:attribute> |
| | | </adm:profile> |
| | | </adm:property> |
| | | <adm:synopsis> |
| | | The <adm:user-friendly-name /> provides RESTful access to LDAP application data using a set of |
| | | customizable data transformations. |
| | | </adm:synopsis> |
| | | <adm:profile name="ldap"> |
| | | <ldap:object-class> |
| | | <ldap:name>ds-cfg-rest2ldap-endpoint</ldap:name> |
| | | <ldap:superior>ds-cfg-http-endpoint</ldap:superior> |
| | | </ldap:object-class> |
| | | </adm:profile> |
| | | <adm:property-override name="java-class" |
| | | advanced="true"> |
| | | <adm:default-behavior> |
| | | <adm:defined> |
| | | <adm:value> |
| | | org.opends.server.protocols.http.rest2ldap.Rest2LdapEndpoint |
| | | </adm:value> |
| | | </adm:defined> |
| | | </adm:default-behavior> |
| | | </adm:property-override> |
| | | <adm:property name="config-url" mandatory="true"> |
| | | <adm:synopsis> |
| | | URL of the REST2LDAP configuration file. |
| | | </adm:synopsis> |
| | | <adm:syntax> |
| | | <adm:string> |
| | | <adm:pattern> |
| | | <adm:regex>.*</adm:regex> |
| | | <adm:usage>URL</adm:usage> |
| | | <adm:synopsis> |
| | | A URL to an existing file that is readable by the server. |
| | | </adm:synopsis> |
| | | </adm:pattern> |
| | | </adm:string> |
| | | </adm:syntax> |
| | | <adm:profile name="ldap"> |
| | | <ldap:attribute> |
| | | <ldap:name>ds-cfg-config-url</ldap:name> |
| | | </ldap:attribute> |
| | | </adm:profile> |
| | | </adm:managed-object> |
| | |
| | | // |
| | | "connectionSecurity": "none", |
| | | |
| | | // This alias points at an existing certificate that is used for SSL authentication for secure |
| | | // This alias points at an existing certificate that is used for SSL authentication for secure |
| | | // communication between this gateway and the remote LDAP server. |
| | | "sslCertAlias": "client-cert", |
| | | |
| | |
| | | // The authorization policies to use. Supported policies are "anonymous", "basic" and "oauth2". |
| | | "policies": [ "basic" ], |
| | | |
| | | // Perform all operations using a pre-authorization connection. |
| | | // Perform all operations using a pre-authorized connection. |
| | | "anonymous": { |
| | | // Specify the connection factory to use to perform LDAP operations. |
| | | // If missing, the "root" factory will be used. |
| | |
| | | "authzIdTemplate": "u:{username}" |
| | | }, |
| | | |
| | | // Bind to the LDAP server using the resulting DN of a search request. |
| | | // Bind to the LDAP server using the resulting DN of a search request. |
| | | "search": { |
| | | // Connection factory used to perform the search operation. |
| | | // If missing, "root" factory will be used. |
| | |
| | | // This attribute is required and must have a string syntax. |
| | | "endpointURL": "http://openam.example.com:8080/openam/oauth2/tokeninfo", |
| | | |
| | | // This alias points at an existing certificate that is used for SSL authentication for secure |
| | | // This alias points at an existing certificate that is used for SSL authentication for secure |
| | | // communication between this gateway and the OpenAM access-token resolver. |
| | | "sslCertAlias": "client-cert", |
| | | |
| | |
| | | // This attribute is required and must have a string syntax. |
| | | "endpointURL": "http://openam.example.com:8080/openam/oauth2/myrealm/introspect", |
| | | |
| | | // This alias points at an existing certificate that is used for SSL authentication for secure |
| | | // This alias points at an existing certificate that is used for SSL authentication for secure |
| | | // communication between this gateway and the introspection access-token resolver. |
| | | "sslCertAlias": "client-cert", |
| | | |
| | |
| | | */ |
| | | package org.forgerock.opendj.rest2ldap; |
| | | |
| | | import static org.forgerock.opendj.rest2ldap.Utils.*; |
| | | import static org.forgerock.util.Reject.checkNotNull; |
| | | |
| | | import org.forgerock.opendj.ldap.Connection; |
| | | import org.forgerock.services.context.AbstractContext; |
| | |
| | | * re-used for subsequent LDAP operations. |
| | | */ |
| | | public AuthenticatedConnectionContext(final Context parent, final Connection connection) { |
| | | super(ensureNotNull(parent), "authenticated connection"); |
| | | this.connection = connection; |
| | | } |
| | | |
| | | /** |
| | | * Creates a new pre-authenticated cached LDAP connection context having the |
| | | * provided ID and parent. |
| | | * |
| | | * @param id |
| | | * The context ID. |
| | | * @param parent |
| | | * The parent context. |
| | | * @param connection |
| | | * The cached pre-authenticated LDAP connection which should be |
| | | * re-used for subsequent LDAP operations. |
| | | */ |
| | | AuthenticatedConnectionContext(final String id, final Context parent, |
| | | final Connection connection) { |
| | | super(id, "authenticated connection", ensureNotNull(parent)); |
| | | super(checkNotNull(parent), "authenticated connection"); |
| | | this.connection = connection; |
| | | } |
| | | |
| | |
| | | import static org.forgerock.opendj.ldap.LdapException.newLdapException; |
| | | import static org.forgerock.opendj.ldap.requests.Requests.newSearchRequest; |
| | | import static org.forgerock.opendj.rest2ldap.Rest2LDAP.asResourceException; |
| | | import static org.forgerock.opendj.rest2ldap.Utils.ensureNotNull; |
| | | import static org.forgerock.opendj.rest2ldap.Utils.newBadRequestException; |
| | | import static org.forgerock.util.Reject.checkNotNull; |
| | | |
| | | import java.util.ArrayList; |
| | | import java.util.LinkedHashSet; |
| | |
| | | import org.forgerock.opendj.ldap.schema.Schema; |
| | | import org.forgerock.util.AsyncFunction; |
| | | import org.forgerock.util.Function; |
| | | import org.forgerock.util.Reject; |
| | | import org.forgerock.util.promise.ExceptionHandler; |
| | | import org.forgerock.util.promise.Promise; |
| | | import org.forgerock.util.promise.PromiseImpl; |
| | |
| | | * @return This attribute mapper. |
| | | */ |
| | | public ReferenceAttributeMapper searchFilter(final Filter filter) { |
| | | this.filter = ensureNotNull(filter); |
| | | this.filter = checkNotNull(filter); |
| | | return this; |
| | | } |
| | | |
| | |
| | | * @return This attribute mapper. |
| | | */ |
| | | public ReferenceAttributeMapper searchScope(final SearchScope scope) { |
| | | this.scope = ensureNotNull(scope); |
| | | this.scope = checkNotNull(scope); |
| | | return this; |
| | | } |
| | | |
| | |
| | | import static org.forgerock.opendj.ldap.requests.Requests.newSearchRequest; |
| | | import static org.forgerock.opendj.ldap.schema.CoreSchema.getEntryUUIDAttributeType; |
| | | import static org.forgerock.opendj.rest2ldap.ReadOnUpdatePolicy.CONTROLS; |
| | | import static org.forgerock.opendj.rest2ldap.Utils.ensureNotNull; |
| | | import static org.forgerock.opendj.rest2ldap.Utils.newBadRequestException; |
| | | import static org.forgerock.opendj.rest2ldap.Utils.newLocalizedIllegalArgumentException; |
| | | import static org.forgerock.opendj.rest2ldap.Utils.newJsonValueException; |
| | | import static org.forgerock.util.Reject.checkNotNull; |
| | | import static org.forgerock.util.time.Duration.*; |
| | | import static org.forgerock.opendj.ldap.KeyManagers.useSingleCertificate; |
| | | |
| | |
| | | import org.forgerock.opendj.ldap.schema.AttributeType; |
| | | import org.forgerock.opendj.ldap.schema.Schema; |
| | | import org.forgerock.util.Options; |
| | | import org.forgerock.util.Reject; |
| | | import org.forgerock.util.time.Duration; |
| | | |
| | | /** Provides core factory methods and builders for constructing LDAP resource collections. */ |
| | |
| | | * @return A reference to this LDAP resource collection builder. |
| | | */ |
| | | public Builder baseDN(final DN dn) { |
| | | ensureNotNull(dn); |
| | | Reject.ifNull(dn); |
| | | this.baseDN = dn; |
| | | return this; |
| | | } |
| | |
| | | * @return The new LDAP resource collection. |
| | | */ |
| | | public CollectionResourceProvider build() { |
| | | ensureNotNull(baseDN); |
| | | Reject.ifNull(baseDN); |
| | | if (rootMapper == null) { |
| | | throw new IllegalStateException(ERR_CONFIG_NO_MAPPINGS_PROVIDED.get().toString()); |
| | | } |
| | |
| | | * @return A reference to this LDAP resource collection builder. |
| | | */ |
| | | public Builder readOnUpdatePolicy(final ReadOnUpdatePolicy policy) { |
| | | this.readOnUpdatePolicy = ensureNotNull(policy); |
| | | this.readOnUpdatePolicy = checkNotNull(policy); |
| | | return this; |
| | | } |
| | | |
| | |
| | | * @return A reference to this LDAP resource collection builder. |
| | | */ |
| | | public Builder schema(final Schema schema) { |
| | | this.schema = ensureNotNull(schema); |
| | | this.schema = checkNotNull(schema); |
| | | return this; |
| | | } |
| | | |
| | |
| | | if (this.dnAttribute.equals(idAttribute)) { |
| | | throw newLocalizedIllegalArgumentException(ERR_CONFIG_NAMING_STRATEGY_DN_AND_ID_NOT_DIFFERENT.get()); |
| | | } |
| | | this.idAttribute = ensureNotNull(idAttribute); |
| | | this.idAttribute = checkNotNull(idAttribute); |
| | | this.isServerProvided = isServerProvided; |
| | | } |
| | | |
| | |
| | | */ |
| | | package org.forgerock.opendj.rest2ldap; |
| | | |
| | | import static org.forgerock.opendj.rest2ldap.Rest2ldapMessages.*; |
| | | import static javax.xml.bind.DatatypeConverter.parseDateTime; |
| | | import static javax.xml.bind.DatatypeConverter.printDateTime; |
| | | import static org.forgerock.opendj.ldap.Filter.alwaysFalse; |
| | |
| | | import static org.forgerock.opendj.ldap.schema.CoreSchema.getBooleanSyntax; |
| | | import static org.forgerock.opendj.ldap.schema.CoreSchema.getGeneralizedTimeSyntax; |
| | | import static org.forgerock.opendj.ldap.schema.CoreSchema.getIntegerSyntax; |
| | | import static org.forgerock.opendj.rest2ldap.Rest2ldapMessages.ERR_UNRECOGNIZED_JSON_VALUE; |
| | | |
| | | import java.io.BufferedReader; |
| | | import java.io.File; |
| | |
| | | import java.util.ArrayList; |
| | | import java.util.Collection; |
| | | import java.util.Collections; |
| | | import java.util.List; |
| | | import java.util.Locale; |
| | | |
| | | import org.forgerock.i18n.LocalizableMessage; |
| | |
| | | } |
| | | } |
| | | |
| | | static Object attributeToJson(final Attribute a) { |
| | | final Function<ByteString, Object, NeverThrowsException> f = byteStringToJson(a.getAttributeDescription()); |
| | | final boolean isSingleValued = a.getAttributeDescription().getAttributeType().isSingleValue(); |
| | | return isSingleValued ? a.parse().as(f) : asList(a.parse().asSetOf(f)); |
| | | } |
| | | |
| | | static Function<Object, ByteString, NeverThrowsException> base64ToByteString() { |
| | | return BASE64_TO_BYTESTRING; |
| | | } |
| | |
| | | }; |
| | | } |
| | | |
| | | static <T> T ensureNotNull(final T object) { |
| | | if (object == null) { |
| | | throw new NullPointerException(); |
| | | } |
| | | return object; |
| | | } |
| | | |
| | | static <T> T ensureNotNull(final T object, final String message) { |
| | | if (object == null) { |
| | | throw new NullPointerException(message); |
| | | } |
| | | return object; |
| | | } |
| | | |
| | | static String getAttributeName(final Attribute a) { |
| | | return a.getAttributeDescription().withoutOption("binary").toString(); |
| | | } |
| | | |
| | | /** |
| | | * Stub formatter for i18n strings. |
| | | * |
| | |
| | | return String.format(format, args); |
| | | } |
| | | |
| | | static boolean isJSONPrimitive(final Object value) { |
| | | private static boolean isJSONPrimitive(final Object value) { |
| | | return value instanceof String || value instanceof Boolean || value instanceof Number; |
| | | } |
| | | |
| | |
| | | return v == null || v.isNull() || (v.isList() && v.size() == 0); |
| | | } |
| | | |
| | | static Attribute jsonToAttribute(final Object value, final AttributeDescription ad) { |
| | | return jsonToAttribute(value, ad, jsonToByteString(ad)); |
| | | } |
| | | |
| | | static Attribute jsonToAttribute(final Object value, final AttributeDescription ad, |
| | | final Function<Object, ByteString, NeverThrowsException> f) { |
| | | if (isJSONPrimitive(value)) { |
| | |
| | | return new BadRequestException(message.toString(), cause); |
| | | } |
| | | |
| | | private static <T> List<T> asList(final Collection<T> c) { |
| | | if (c instanceof List) { |
| | | return (List<T>) c; |
| | | } |
| | | return new ArrayList<>(c); |
| | | } |
| | | |
| | | /** Prevent instantiation. */ |
| | | private Utils() { |
| | | // No implementation required. |
| | |
| | | import org.forgerock.http.protocol.Response; |
| | | import org.forgerock.opendj.ldap.Connection; |
| | | import org.forgerock.opendj.ldap.ConnectionFactory; |
| | | import org.forgerock.opendj.ldap.LdapException; |
| | | import org.forgerock.opendj.rest2ldap.AuthenticatedConnectionContext; |
| | | import org.forgerock.services.context.Context; |
| | | import org.forgerock.util.AsyncFunction; |
| | |
| | | connectionHolder.set(connection); |
| | | return next.handle(new AuthenticatedConnectionContext(context, connection), request); |
| | | } |
| | | }, new AsyncFunction<LdapException, Response, NeverThrowsException>() { |
| | | @Override |
| | | public Promise<Response, NeverThrowsException> apply(LdapException exception) { |
| | | return asErrorResponse(exception); |
| | | } |
| | | }) |
| | | }, handleConnectionFailure()) |
| | | .thenFinally(close(connectionHolder)); |
| | | } |
| | | } |
| | |
| | | package org.forgerock.opendj.rest2ldap.authz; |
| | | |
| | | import static org.forgerock.opendj.ldap.controls.ProxiedAuthV2RequestControl.newControl; |
| | | import static org.forgerock.opendj.rest2ldap.authz.Utils.asErrorResponse; |
| | | import static org.forgerock.opendj.rest2ldap.authz.Utils.close; |
| | | import static org.forgerock.opendj.rest2ldap.authz.Utils.handleConnectionFailure; |
| | | import static org.forgerock.services.context.SecurityContext.AUTHZID_DN; |
| | | import static org.forgerock.services.context.SecurityContext.AUTHZID_ID; |
| | | import static org.forgerock.util.Reject.checkNotNull; |
| | |
| | | public Promise<Response, NeverThrowsException> apply(Connection connection) { |
| | | return next.handle(new AuthenticatedConnectionContext(context, connection), request); |
| | | } |
| | | }, new AsyncFunction<LdapException, Response, NeverThrowsException>() { |
| | | @Override |
| | | public Promise<Response, NeverThrowsException> apply(LdapException ldapException) { |
| | | return asErrorResponse(ldapException); |
| | | } |
| | | }) |
| | | }, handleConnectionFailure()) |
| | | .thenFinally(close(connectionHolder)); |
| | | } |
| | | |
| | |
| | | import org.forgerock.http.protocol.Status; |
| | | import org.forgerock.i18n.LocalizableMessage; |
| | | import org.forgerock.json.resource.ResourceException; |
| | | import org.forgerock.opendj.ldap.LdapException; |
| | | import org.forgerock.util.AsyncFunction; |
| | | import org.forgerock.util.promise.NeverThrowsException; |
| | | import org.forgerock.util.promise.Promise; |
| | | import org.forgerock.util.promise.Promises; |
| | |
| | | }; |
| | | } |
| | | |
| | | static AsyncFunction<LdapException, Response, NeverThrowsException> handleConnectionFailure() { |
| | | return new AsyncFunction<LdapException, Response, NeverThrowsException>() { |
| | | @Override |
| | | public Promise<Response, NeverThrowsException> apply(final LdapException exception) { |
| | | return asErrorResponse(exception); |
| | | } |
| | | }; |
| | | } |
| | | |
| | | static Promise<Response, NeverThrowsException> asErrorResponse(final Throwable t) { |
| | | final ResourceException e = asResourceException(t); |
| | | final Response response = new Response() |
| | |
| | | ds-cfg-java-class: org.opends.server.protocols.http.authz.HttpOAuth2TokenIntrospectionAuthorizationMechanism |
| | | ds-cfg-enabled: false |
| | | ds-cfg-oauth2-token-introspection-url: http://openam.example.com:8080/openam/oauth2/myrealm/introspect |
| | | ds-cfg-oauth2-token-introspection-client-id: directoryserver |
| | | ds-cfg-oauth2-token-introspection-client-id: directoryserver |
| | | ds-cfg-oauth2-token-introspection-client-secret: secret |
| | | ds-cfg-oauth2-authzid-json-pointer: sub |
| | | ds-cfg-identity-mapper: cn=Exact Match,cn=Identity Mappers,cn=config |
| | |
| | | NAME 'ds-cfg-rest2ldap-endpoint' |
| | | SUP ds-cfg-http-endpoint |
| | | STRUCTURAL |
| | | MUST ( ds-cfg-config-url ) |
| | | MUST ( ds-cfg-config-url $ ds-cfg-resource ) |
| | | X-ORIGIN 'OpenDJ Directory Server' ) |
| | | objectClasses: ( 1.3.6.1.4.1.36733.2.1.2.36 |
| | | NAME 'ds-cfg-http-authorization-mechanism' |