Repository: gravitee-io/graviteeio-access-management
Pull request #615 (2019-07-05 11:32:31)

fix(idp-ldap): allow complex search filters
fix gravitee-io/issues#2428


Patch:
diff --git a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/main/java/io/gravitee/am/identityprovider/ldap/authentication/LdapAuthenticationProvider.java b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/main/java/io/gravitee/am/identityprovider/ldap/authentication/LdapAuthenticationProvider.java
index 585086e0f0..afc612d8ce 100644
--- a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/main/java/io/gravitee/am/identityprovider/ldap/authentication/LdapAuthenticationProvider.java
+++ b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/main/java/io/gravitee/am/identityprovider/ldap/authentication/LdapAuthenticationProvider.java
@@ -88,7 +88,7 @@ public class LdapAuthenticationProvider implements AuthenticationProvider, Initi
         if (searchFilter != null) {
             // Search filter can be uid={0} or mail={0}
             try {
-                identifierAttribute = searchFilter.replaceAll("[()]", "").split("=")[0];
+                identifierAttribute = io.gravitee.am.identityprovider.ldap.utils.LdapUtils.extractAttribute(searchFilter);
             } catch (Exception e) {
                 LOGGER.debug("Fail to set identifierAttribute from searchFilter : {}", searchFilter);
             }
diff --git a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/main/java/io/gravitee/am/identityprovider/ldap/utils/LdapUtils.java b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/main/java/io/gravitee/am/identityprovider/ldap/utils/LdapUtils.java
new file mode 100644
index 0000000000..c6a253f793
--- /dev/null
+++ b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/main/java/io/gravitee/am/identityprovider/ldap/utils/LdapUtils.java
@@ -0,0 +1,58 @@
+/**
+ * Copyright (C) 2015 The Gravitee team (http://gravitee.io)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package io.gravitee.am.identityprovider.ldap.utils;
+
+/**
+ * @author David BRASSELY (david.brassely at graviteesource.com)
+ * @author GraviteeSource Team
+ */
+public final class LdapUtils {
+
+    private final static String FILTER_VARIABLE = "={0}";
+    private final static String PROTECTED_FILTER_VARIABLE = "=\\{0\\}";
+
+    /**
+     *  Filter can be uid={0} or mail={0} or may be even more complex like
+     *  (&(objectClass=Person)(uid={0})(&(ou=People)(ou=Payroll)))
+     *
+     * @param filter
+     * @return
+     */
+    public static String extractAttribute(String filter) {
+        if (filter == null) {
+            return null;
+        }
+
+        String [] parts = filter.split(PROTECTED_FILTER_VARIABLE);
+        if (parts.length > 1 || (parts.length == 1 && filter.endsWith(FILTER_VARIABLE))) {
+            String attribute = parts[0];
+            int idxSep = Math.max(attribute.lastIndexOf(','),
+                    attribute.lastIndexOf('('));
+
+            int idx = (idxSep == -1) ? 0 : idxSep + 1;
+            return attribute.substring(idx);
+        }
+
+        return null;
+    }
+
+    public static String addWhitespaceWildcards(String str) {
+        if (str == null) {
+            return null;
+        }
+        return str.replaceAll(" ", "*");
+    }
+}
diff --git a/gravitee-am-ui/package-lock.json b/gravitee-am-ui/package-lock.json
index 523cd9e4a8..940fb45748 100644
--- a/gravitee-am-ui/package-lock.json
+++ b/gravitee-am-ui/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "gravitee-am-webui",
-  "version": "2.7.0",
+  "version": "2.8.0-SNAPSHOT",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {


Test patch:
diff --git a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapBindAuthenticationProviderTest.java b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapBindAuthenticationProviderTest.java
index 218d11966e..f564bfb7a5 100644
--- a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapBindAuthenticationProviderTest.java
+++ b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapBindAuthenticationProviderTest.java
@@ -82,7 +82,7 @@ public class LdapBindAuthenticationProviderTest extends LdapAuthenticationProvid
             configuration.setContextSourceUrl("ldap://localhost:61000");
 
             configuration.setUserSearchBase("ou=people");
-            configuration.setUserSearchFilter("uid={user}");
+            configuration.setUserSearchFilter("(|(uid={0})(sn={0}))");
 
             configuration.setGroupSearchBase("ou=GRAVITEE,ou=company,ou=applications");
             configuration.setGroupSearchFilter("member={0}");
diff --git a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordAuthenticationProviderTest.java b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordAuthenticationProviderTest.java
index 0b7ca9d768..21b232106c 100644
--- a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordAuthenticationProviderTest.java
+++ b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordAuthenticationProviderTest.java
@@ -82,7 +82,7 @@ public class LdapComparePasswordAuthenticationProviderTest extends LdapAuthentic
             configuration.setContextSourceUrl("ldap://localhost:61000");
 
             configuration.setUserSearchBase("ou=people");
-            configuration.setUserSearchFilter("uid={user}");
+            configuration.setUserSearchFilter("uid={0}");
 
             configuration.setGroupSearchBase("ou=GRAVITEE,ou=company,ou=applications");
             configuration.setGroupSearchFilter("member={0}");
diff --git a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordShaMd5AuthenticationProviderTest.java b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordShaMd5AuthenticationProviderTest.java
index eb959a23a5..8758285e4c 100644
--- a/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordShaMd5AuthenticationProviderTest.java
+++ b/gravitee-am-identityprovider/gravitee-am-identityprovider-ldap/src/test/java/io/gravitee/am/identityprovider/ldap/authentication/LdapComparePasswordShaMd5AuthenticationProviderTest.java
@@ -82,7 +82,7 @@ public class LdapComparePasswordShaMd5AuthenticationProviderTest extends LdapAut
             configuration.setContextSourceUrl("ldap://localhost:61000");
 
             configuration.setUserSearchBase("ou=people");
-            configuration.setUserSearchFilter("uid={user}");
+            configuration.setUserSearchFilter("uid={0}");
 
             configuration.setGroupSearchBase("ou=GRAVITEE,ou=company,ou=applications");
             configuration.setGroupSearchFilter("member={0}");