Project: Tomcat
Bug 21669 JNDIRealm roleBase pattern enahncement
Reported: 2003-07-16 22:59:24 | Status: resolved fixed

Currently the roleBase attribute must be a fxed location in the directory. A simple change would allow the role base to be specified relative to the user DN. My enhancement suggestion would change the roleBase definition as follows: roleBase - the base entry for the role search. If not specified, the search base is the top level directory context. If specified it may optionally include pattern replacements "{0}".."{n}" corrosponding to the name parts of the user's distinguished name (as returned by javax.naming.Name.get()). For example, in the <Realm> defintion in server.xml you could specify the roleBase as: roleBase="ou=Groups,{1},{0}" The majority of the code to accomplish this would be in JNDIRealm.getRoles() and could look like this: String base = null; if ( roleBaseFormat != null ) { NameParser np = context.getNameParser(""); Name name = np.parse(dn); String nameParts[] = new String[name.size()]; for ( int idx = 0 ; idx < name.size() ; idx++ ) nameParts[idx] = name.get(idx); base = roleBaseFormat.format(nameParts); } // Perform the configured search and process the results if (debug >= 3) { log(" Searching role base '" + base + "' for attribute '" + roleName + "'"); log(" With filter expression '" + filter + "'"); } NamingEnumeration results = context.search(base, filter, controls); Thank You, Art

Files changed in fix:
java/org/apache/catalina/realm/JNDIRealm.java