com.atlassian.crowd.directory

Class MicrosoftActiveDirectory

java.lang.Object

com.atlassian.crowd.directory.SpringLDAPConnector

com.atlassian.crowd.directory.RFC4519Directory

com.atlassian.crowd.directory.MicrosoftActiveDirectory

All Implemented Interfaces:

LDAPDirectory, RemoteDirectory, Attributes

public class MicrosoftActiveDirectory
extends RFC4519Directory

Microsoft Active Directory connector.

Field Summary

Fields

Modifier and Type	Field and Description
static String	AD_DS_SERVICE_NAME
static String	AD_INVOCATION_ID
static PropertyImpl<String>	OBJECT_SID
static int	UF_ACCOUNTDISABLE

Fields inherited from class com.atlassian.crowd.directory.SpringLDAPConnector

attributes, contextSource, contextSourceTransactionManager, DEFAULT_PAGE_SIZE, eventPublisher, ldapPropertiesMapper, ldapQueryTranslater, ldapTemplate, nameConverter, searchDN

Constructor Summary

Constructors

Constructor and Description
MicrosoftActiveDirectory(ActiveDirectoryQueryTranslaterImpl activeDirectoryQueryTranslater, com.atlassian.event.api.EventPublisher eventPublisher, InstanceFactory instanceFactory, PasswordHelper passwordHelper)

Method Summary

Modifier and Type	Method and Description
void	addUserToGroup(String username, String groupName) Adds a user as a member of a group.
protected ContextMapperWithRequiredAttributes<AvatarReference.BlobAvatar>	avatarMapper() Return a JpegPhotoContextMapper; assume for now that all avatars are stored as JPEG files.
long	fetchHighestCommittedUSN()
String	fetchInvocationId()
List<LDAPGroupWithAttributes>	findAddedOrUpdatedGroupsSince(long usnChanged)
protected <T> List<T>	findAddedOrUpdatedObjectsSince(long usnChange, Name objectBaseDN, String objectFilter, ContextMapperWithRequiredAttributes<T> contextMapper)
List<LDAPUserWithAttributes>	findAddedOrUpdatedUsersSince(long usnChange)
protected Iterable<LdapName>	findAdditionalDirectMembers(LdapName groupDn, Supplier<Optional<LDAPGroupWithAttributes>> groupSupplier)
Set<String>	findAllGroupGuids()
Set<org.apache.commons.lang3.tuple.Pair<String,String>>	findAllGroupNamesAndGuids()
Set<String>	findAllUserGuids()
protected Iterable<String>	findGroupMembershipNames(MembershipQuery<String> query)
protected List<? extends LDAPGroupWithAttributes>	findGroupMemberships(MembershipQuery<? extends LDAPGroupWithAttributes> query)
protected List<Tombstone>	findTombstonesSince(long usnChange, Name objectBaseDN, String objectClass)
protected List<LDAPUserWithAttributes>	findUserMembersOfGroupViaMemberDN(String groupName, GroupType groupType, int startIndex, int maxResults)
protected Iterable<LDAPUserWithAttributes>	findUserMembersOfGroupViaMemberOf(String groupName, GroupType groupType, int startIndex, int maxResults)
List<Tombstone>	findUserTombstonesSince(long usnChange)
protected Map<String,Object>	getBaseEnvironmentProperties() Returns the properties used to set up the Ldap ContextSource.
protected LDAPCredentialEncoder	getCredentialEncoder()
protected List<AttributeMapper>	getCustomGroupAttributeMappers() As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).
protected List<AttributeMapper>	getCustomUserAttributeMappers(UserContextMapperConfig config)
String	getDescriptiveName() Returns a descriptive name for the type of directory.
protected String	getInitialGroupMemberDN() AD does not need a default container member.
protected List<AttributeMapper>	getMemberDnMappers()
protected void	getNewGroupDirectorySpecificAttributes(Group group, Attributes attributes) If we want to be able to nest groups, we need to create distribution groups rather than security groups.
protected void	getNewUserDirectorySpecificAttributes(User user, Attributes attributes) Active Directory needs a couple of additional attributes set - the sAMAccountName (which is the account name you use to log on to Windows), and the account disabled flag.
Optional<String>	getPrimaryGroupSIDOfUser(LDAPUserWithAttributes user) In AD, users have a primaryGroupId attribute that contains the RID (relative identifier) of their primary group.
protected List<AttributeMapper>	getRequiredCustomGroupAttributeMappers() Returns a set of attributes which are expected to be present in all cases (ie Active Directory's objectGUID) Due to performance reasons returning mappers for heavy attributes (such as memberships) should be avoided
static String	getStaticDirectoryType()
ContextMapperWithRequiredAttributes<LDAPUserWithAttributes>	getUserContextMapper(UserContextMapperConfig config) Returns a ContextMapper that can transform a Context into a User.
protected List<ModificationItem>	getUserModificationItems(User userTemplate, LDAPUserWithAttributes currentUser)
boolean	isGroupExternalIdConfigured() Checks if the 'Group Unique ID Attribute' is set.
boolean	isUserDirectGroupMember(String username, String groupName) Determines if a user is a direct member of a group.
boolean	isUsersExternalIdConfigured() Checks if the 'User Unique ID Attribute' is set.
protected List<LDAPGroupWithAttributes>	postprocessGroups(List<LDAPGroupWithAttributes> groups) Perform any post-processing on groups.
void	removeGroup(String name) Removes the group that matches the supplied name.
void	removeUserFromGroup(String username, String groupName) Removes a user as a member of a group.
Collection<LDAPGroupWithAttributes>	searchGroupsBySids(Set<String> groupSids)
protected void	setLdapPropertiesMapperAttributes(Map<String,String> attributes)
boolean	supportsInactiveAccounts() This connector supports inactive accounts while, in general, LDAP connector do not.

Methods inherited from class com.atlassian.crowd.directory.RFC4519Directory

addDnToGroup, addGroupToGroup, findDirectMembersOfGroup, findGroupMembershipsOfUserViaMemberOf, getMemberships, isDirectGroupMemberOf, isDnDirectGroupMember, isGroupDirectGroupMember, prepareOrFilterForGroupProperty, removeDnFromGroup, removeGroupFromGroup, searchGroupRelationshipsWithGroupTypeSpecified, searchGroupsByAttribute, searchGroupsByDns, toGenericIterable

Methods inherited from class com.atlassian.crowd.directory.SpringLDAPConnector

addDefaultSnToUserAttributes, addDefaultValueToUserAttributesForAttribute, addGroup, addUser, addUser, asLdapGroupName, asLdapName, asLdapUserName, authenticate, countDirectMembersOfGroup, createMinimalContextSource, createModificationItem, expireAllPasswords, findEntityByDN, findEntityByDN, findGroupByName, findGroupByNameAndType, findGroupWithAttributesByName, findUserByExternalId, findUserByName, findUserWithAttributesByName, getAttributeAsBoolean, getAttributeAsLong, getAuthoritativeDirectory, getContextSource, getDirectoryId, getGroupContextMapper, getKeys, getLdapPropertiesMapper, getNewGroupAttributes, getNewUserAttributes, getSearchControls, getSearchDN, getUserAvatarByName, getValue, getValues, initializeContextSource, initializeMinimalContextSource, isEmpty, isRolesDisabled, pageSearchResults, removeGroupAttributes, removeUser, removeUserAttributes, renameGroup, renameUser, searchEntities, searchEntitiesWithRequestControls, searchGroupObjects, searchGroupObjectsOfSpecifiedGroupType, searchGroupRelationships, searchGroups, searchUserObjects, searchUsers, setAttributes, setDirectoryId, storeGroupAttributes, storeUserAttributes, supportsNestedGroups, supportsPasswordExpiration, supportsSettingEncryptedCredential, testConnection, typedEntityNotFoundException, updateGroup, updateUser, updateUserCredential

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.atlassian.crowd.directory.RemoteDirectory

getLocallyFilteredGroupNames, updateUserFromRemoteDirectory, userAuthenticated

Field Detail

UF_ACCOUNTDISABLE

public static final int UF_ACCOUNTDISABLE

See Also:

Constant Field Values

OBJECT_SID

public static final PropertyImpl<String> OBJECT_SID

AD_DS_SERVICE_NAME

public static final String AD_DS_SERVICE_NAME

See Also:

Constant Field Values

AD_INVOCATION_ID

public static final String AD_INVOCATION_ID

See Also:

Constant Field Values

Constructor Detail

MicrosoftActiveDirectory

public MicrosoftActiveDirectory(ActiveDirectoryQueryTranslaterImpl activeDirectoryQueryTranslater,
                                com.atlassian.event.api.EventPublisher eventPublisher,
                                InstanceFactory instanceFactory,
                                PasswordHelper passwordHelper)

Parameters:

passwordHelper - password helper, which must not be null

Method Detail

getStaticDirectoryType

public static String getStaticDirectoryType()

getDescriptiveName

public String getDescriptiveName()

Description copied from interface: RemoteDirectory

Returns a descriptive name for the type of directory.

Returns:

descriptive name.

removeGroup

public void removeGroup(String name)
                 throws GroupNotFoundException,
                        OperationFailedException

Description copied from interface: RemoteDirectory

Removes the group that matches the supplied name.

Specified by:

removeGroup in interface RemoteDirectory

Overrides:

removeGroup in class SpringLDAPConnector

Parameters:

name - The name of the group.

Throws:

GroupNotFoundException - The group does not exist.

OperationFailedException - underlying directory implementation failed to execute the operation.

isUserDirectGroupMember

public boolean isUserDirectGroupMember(String username,
                                       String groupName)
                                throws OperationFailedException

Description copied from interface: RemoteDirectory

Determines if a user is a direct member of a group. The directory is NOT expected to resolve any transitive group relationships.

Specified by:

isUserDirectGroupMember in interface RemoteDirectory

Overrides:

isUserDirectGroupMember in class RFC4519Directory

Parameters:

username - name of user.

groupName - name of group.

Returns:

true iff the user is a direct member of the group.

Throws:

OperationFailedException - underlying directory implementation failed to execute the operation.

addUserToGroup

public void addUserToGroup(String username,
                           String groupName)
                    throws GroupNotFoundException,
                           OperationFailedException,
                           UserNotFoundException,
                           MembershipAlreadyExistsException

Description copied from interface: RemoteDirectory

Adds a user as a member of a group. This means that all user members of childGroup will appear as members of parentGroup to querying applications.

Specified by:

addUserToGroup in interface RemoteDirectory

Overrides:

addUserToGroup in class RFC4519Directory

Parameters:

username - The user that will become a member of groupName

groupName - The group that will gain a new member.

Throws:

GroupNotFoundException - If the group cannot be found.

OperationFailedException - underlying directory implementation failed to execute the operation.

UserNotFoundException - If the user cannot be found.

MembershipAlreadyExistsException - if the user is already a member of the group

removeUserFromGroup

public void removeUserFromGroup(String username,
                                String groupName)
                         throws UserNotFoundException,
                                GroupNotFoundException,
                                MembershipNotFoundException,
                                OperationFailedException

Description copied from interface: RemoteDirectory

Removes a user as a member of a group.

Specified by:

removeUserFromGroup in interface RemoteDirectory

Overrides:

removeUserFromGroup in class RFC4519Directory

Parameters:

username - The user that will be removed from parentGroup

groupName - The group that will lose the member.

Throws:

UserNotFoundException - If the user cannot be found.

GroupNotFoundException - If the group cannot be found.

MembershipNotFoundException - if the user is not a direct member of the group.

OperationFailedException - underlying directory implementation failed to execute the operation.

searchGroupsBySids

public Collection<LDAPGroupWithAttributes> searchGroupsBySids(Set<String> groupSids)
                                                       throws OperationFailedException

Throws:

OperationFailedException

findGroupMemberships

protected List<? extends LDAPGroupWithAttributes> findGroupMemberships(MembershipQuery<? extends LDAPGroupWithAttributes> query)
                                                                throws OperationFailedException

Overrides:

findGroupMemberships in class RFC4519Directory

Throws:

OperationFailedException

findGroupMembershipNames

protected Iterable<String> findGroupMembershipNames(MembershipQuery<String> query)
                                             throws OperationFailedException

Overrides:

findGroupMembershipNames in class RFC4519Directory

Throws:

OperationFailedException

findUserMembersOfGroupViaMemberDN

protected List<LDAPUserWithAttributes> findUserMembersOfGroupViaMemberDN(String groupName,
                                                                         GroupType groupType,
                                                                         int startIndex,
                                                                         int maxResults)
                                                                  throws OperationFailedException

Overrides:

findUserMembersOfGroupViaMemberDN in class RFC4519Directory

Throws:

OperationFailedException

findUserMembersOfGroupViaMemberOf

protected Iterable<LDAPUserWithAttributes> findUserMembersOfGroupViaMemberOf(String groupName,
                                                                             GroupType groupType,
                                                                             int startIndex,
                                                                             int maxResults)
                                                                      throws OperationFailedException

Overrides:

findUserMembersOfGroupViaMemberOf in class RFC4519Directory

Throws:

OperationFailedException

findAdditionalDirectMembers

protected Iterable<LdapName> findAdditionalDirectMembers(LdapName groupDn,
                                                         Supplier<Optional<LDAPGroupWithAttributes>> groupSupplier)
                                                  throws OperationFailedException

Overrides:

findAdditionalDirectMembers in class RFC4519Directory

Throws:

OperationFailedException

getPrimaryGroupSIDOfUser

public Optional<String> getPrimaryGroupSIDOfUser(LDAPUserWithAttributes user)

In AD, users have a primaryGroupId attribute that contains the RID (relative identifier) of their primary group. The SID of the primary group is obtained by resolving the RID with respect to the SID of the user.

Parameters:

user - the use whose primary group's SID will be resolved

Returns:

an Optional containing the String representation of the user's primary group SID if present

getInitialGroupMemberDN

protected String getInitialGroupMemberDN()

AD does not need a default container member.

Overrides:

getInitialGroupMemberDN in class SpringLDAPConnector

Returns:

null.

getCredentialEncoder

protected LDAPCredentialEncoder getCredentialEncoder()

Specified by:

getCredentialEncoder in class SpringLDAPConnector

Returns:

the credential encoder to use with this directory; must not be null.

getNewUserDirectorySpecificAttributes

protected void getNewUserDirectorySpecificAttributes(User user,
                                                     Attributes attributes)

Active Directory needs a couple of additional attributes set - the sAMAccountName (which is the account name you use to log on to Windows), and the account disabled flag.

Overrides:

getNewUserDirectorySpecificAttributes in class SpringLDAPConnector

Parameters:

user - (potential) source of information that needs to be added.

attributes - attributes to add directory-specific information to.

getNewGroupDirectorySpecificAttributes

protected void getNewGroupDirectorySpecificAttributes(Group group,
                                                      Attributes attributes)

If we want to be able to nest groups, we need to create distribution groups rather than security groups. To do this we need to set groupType to 2.

Overrides:

getNewGroupDirectorySpecificAttributes in class SpringLDAPConnector

Parameters:

group - (potential) source of information that needs to be added.

attributes - attributes to add directory-specific information to.

getCustomUserAttributeMappers

protected List<AttributeMapper> getCustomUserAttributeMappers(UserContextMapperConfig config)

Overrides:

getCustomUserAttributeMappers in class RFC4519Directory

Returns:

a collection of custom attribute mappers. By default just return an empty list.

getCustomGroupAttributeMappers

protected List<AttributeMapper> getCustomGroupAttributeMappers()

Description copied from class: SpringLDAPConnector

As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).

Overrides:

getCustomGroupAttributeMappers in class RFC4519Directory

Returns:

collection of custom attribute mappers (cannot be null but can be an empty list).

getRequiredCustomGroupAttributeMappers

protected List<AttributeMapper> getRequiredCustomGroupAttributeMappers()

Description copied from class: SpringLDAPConnector

Returns a set of attributes which are expected to be present in all cases (ie Active Directory's objectGUID) Due to performance reasons returning mappers for heavy attributes (such as memberships) should be avoided

Overrides:

getRequiredCustomGroupAttributeMappers in class SpringLDAPConnector

Returns:

a list of mappers for attributes required to be present in all cases

getMemberDnMappers

protected List<AttributeMapper> getMemberDnMappers()

Overrides:

getMemberDnMappers in class RFC4519Directory

postprocessGroups

protected List<LDAPGroupWithAttributes> postprocessGroups(List<LDAPGroupWithAttributes> groups)
                                                   throws OperationFailedException

Description copied from class: SpringLDAPConnector

Perform any post-processing on groups.

Overrides:

postprocessGroups in class SpringLDAPConnector

Parameters:

groups - to post-process

Returns:

list of groups that have been processed if required

Throws:

OperationFailedException - if processing encounters a problem with the underlying directory

getBaseEnvironmentProperties

protected Map<String,Object> getBaseEnvironmentProperties()

Description copied from class: SpringLDAPConnector

Returns the properties used to set up the Ldap ContextSource.

Overrides:

getBaseEnvironmentProperties in class SpringLDAPConnector

Returns:

the properties used to set up the Ldap ContextSource.

fetchInvocationId

public String fetchInvocationId()
                         throws OperationFailedException

Throws:

OperationFailedException

fetchHighestCommittedUSN

public long fetchHighestCommittedUSN()
                              throws OperationFailedException

Throws:

OperationFailedException

findAddedOrUpdatedUsersSince

public List<LDAPUserWithAttributes> findAddedOrUpdatedUsersSince(long usnChange)
                                                          throws OperationFailedException

Throws:

OperationFailedException

findAddedOrUpdatedGroupsSince

public List<LDAPGroupWithAttributes> findAddedOrUpdatedGroupsSince(long usnChanged)
                                                            throws OperationFailedException

Throws:

OperationFailedException

findUserTombstonesSince

public List<Tombstone> findUserTombstonesSince(long usnChange)
                                        throws OperationFailedException

Throws:

OperationFailedException

findAllUserGuids

public Set<String> findAllUserGuids()
                             throws OperationFailedException

Throws:

OperationFailedException

findAllGroupGuids

public Set<String> findAllGroupGuids()
                              throws OperationFailedException

Throws:

OperationFailedException

findAllGroupNamesAndGuids

public Set<org.apache.commons.lang3.tuple.Pair<String,String>> findAllGroupNamesAndGuids()
                                                                                  throws OperationFailedException

Throws:

OperationFailedException

findAddedOrUpdatedObjectsSince

protected <T> List<T> findAddedOrUpdatedObjectsSince(long usnChange,
                                                     Name objectBaseDN,
                                                     String objectFilter,
                                                     ContextMapperWithRequiredAttributes<T> contextMapper)
                                              throws OperationFailedException

Throws:

OperationFailedException

findTombstonesSince

protected List<Tombstone> findTombstonesSince(long usnChange,
                                              Name objectBaseDN,
                                              String objectClass)
                                       throws OperationFailedException

Throws:

OperationFailedException

getUserContextMapper

public ContextMapperWithRequiredAttributes<LDAPUserWithAttributes> getUserContextMapper(UserContextMapperConfig config)

Description copied from class: SpringLDAPConnector

Returns a ContextMapper that can transform a Context into a User.

Parameters:

config - determines which additional attribute mappers should be included. Some directories may include additional attributes, which are expected to be present in all cases

Returns:

a ContextMapper that can transform a Context into a User.

isUsersExternalIdConfigured

public boolean isUsersExternalIdConfigured()

Checks if the 'User Unique ID Attribute' is set.

Returns:

true if the property value is a non empty string

isGroupExternalIdConfigured

public boolean isGroupExternalIdConfigured()

Checks if the 'Group Unique ID Attribute' is set.

Returns:

true if the property value is a non empty string

getUserModificationItems

protected List<ModificationItem> getUserModificationItems(User userTemplate,
                                                          LDAPUserWithAttributes currentUser)

Overrides:

getUserModificationItems in class SpringLDAPConnector

supportsInactiveAccounts

public boolean supportsInactiveAccounts()

This connector supports inactive accounts while, in general, LDAP connector do not.

Specified by:

supportsInactiveAccounts in interface RemoteDirectory

Overrides:

supportsInactiveAccounts in class SpringLDAPConnector

Returns:

true

avatarMapper

protected ContextMapperWithRequiredAttributes<AvatarReference.BlobAvatar> avatarMapper()

Return a JpegPhotoContextMapper; assume for now that all avatars are stored as JPEG files.

Overrides:

avatarMapper in class SpringLDAPConnector

setLdapPropertiesMapperAttributes

protected void setLdapPropertiesMapperAttributes(Map<String,String> attributes)

Overrides:

setLdapPropertiesMapperAttributes in class SpringLDAPConnector