001 /*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements. See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership. The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License. You may obtain a copy of the License at
009 *
010 * http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied. See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 *
019 */
020 package org.apache.directory.server.kerberos.shared.store.operations;
021
022
023 import java.io.IOException;
024 import java.text.ParseException;
025 import java.util.Map;
026
027 import javax.naming.NamingException;
028 import javax.naming.directory.InvalidAttributeValueException;
029 import javax.security.auth.kerberos.KerberosPrincipal;
030
031 import org.apache.directory.server.core.CoreSession;
032 import org.apache.directory.server.core.entry.ServerEntry;
033 import org.apache.directory.server.kerberos.shared.crypto.encryption.EncryptionType;
034 import org.apache.directory.server.kerberos.shared.messages.value.EncryptionKey;
035 import org.apache.directory.server.kerberos.shared.messages.value.KerberosTime;
036 import org.apache.directory.server.kerberos.shared.messages.value.SamType;
037 import org.apache.directory.server.kerberos.shared.store.KerberosAttribute;
038 import org.apache.directory.server.kerberos.shared.store.PrincipalStoreEntry;
039 import org.apache.directory.server.kerberos.shared.store.PrincipalStoreEntryModifier;
040 import org.apache.directory.server.protocol.shared.store.DirectoryServiceOperation;
041 import org.apache.directory.shared.ldap.entry.EntryAttribute;
042 import org.apache.directory.shared.ldap.name.LdapDN;
043
044
045 /**
046 * Encapsulates the action of looking up a principal in an embedded ApacheDS DIT.
047 *
048 * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
049 * @version $Rev: 682235 $, $Date: 2008-08-04 03:43:52 +0300 (Mon, 04 Aug 2008) $
050 */
051 public class GetPrincipal implements DirectoryServiceOperation
052 {
053 private static final long serialVersionUID = 4598007518413451945L;
054
055 /** The name of the principal to get. */
056 private final KerberosPrincipal principal;
057
058
059 /**
060 * Creates the action to be used against the embedded ApacheDS DIT.
061 *
062 * @param principal The principal to search for in the directory.
063 */
064 public GetPrincipal( KerberosPrincipal principal )
065 {
066 this.principal = principal;
067 }
068
069
070 /**
071 * Note that the base is a relative path from the existing context.
072 * It is not a DN.
073 */
074 public Object execute( CoreSession session, LdapDN base ) throws Exception
075 {
076 if ( principal == null )
077 {
078 return null;
079 }
080
081 return getEntry( StoreUtils.findPrincipalEntry( session, base, principal.getName() ) );
082 }
083
084
085 /**
086 * Marshals an a PrincipalStoreEntry from an Attributes object.
087 *
088 * @param dn the distinguished name of the Kerberos principal
089 * @param attrs the attributes of the Kerberos principal
090 * @return the entry for the principal
091 * @throws NamingException if there are any access problems
092 */
093 private PrincipalStoreEntry getEntry( ServerEntry entry ) throws Exception
094 {
095 PrincipalStoreEntryModifier modifier = new PrincipalStoreEntryModifier();
096
097 modifier.setDistinguishedName( entry.getDn().getUpName() );
098
099 String principal = entry.get( KerberosAttribute.KRB5_PRINCIPAL_NAME_AT ).getString();
100 modifier.setPrincipal( new KerberosPrincipal( principal ) );
101
102 String keyVersionNumber = entry.get( KerberosAttribute.KRB5_KEY_VERSION_NUMBER_AT ).getString();
103 modifier.setKeyVersionNumber( Integer.parseInt( keyVersionNumber ) );
104
105 if ( entry.get( KerberosAttribute.KRB5_ACCOUNT_DISABLED_AT ) != null )
106 {
107 String val = entry.get( KerberosAttribute.KRB5_ACCOUNT_DISABLED_AT ).getString();
108 modifier.setDisabled( "true".equalsIgnoreCase( val ) );
109 }
110
111 if ( entry.get( KerberosAttribute.KRB5_ACCOUNT_LOCKEDOUT_AT ) != null )
112 {
113 String val = entry.get( KerberosAttribute.KRB5_ACCOUNT_LOCKEDOUT_AT ).getString();
114 modifier.setLockedOut( "true".equalsIgnoreCase( val ) );
115 }
116
117 if ( entry.get( KerberosAttribute.KRB5_ACCOUNT_EXPIRATION_TIME_AT ) != null )
118 {
119 String val = entry.get( KerberosAttribute.KRB5_ACCOUNT_EXPIRATION_TIME_AT ).getString();
120 try
121 {
122 modifier.setExpiration( KerberosTime.getTime( val ) );
123 }
124 catch ( ParseException e )
125 {
126 throw new InvalidAttributeValueException( "Account expiration attribute "
127 + KerberosAttribute.KRB5_ACCOUNT_EXPIRATION_TIME_AT + " contained an invalid value for generalizedTime: "
128 + val );
129 }
130 }
131
132 if ( entry.get( KerberosAttribute.APACHE_SAM_TYPE_AT ) != null )
133 {
134 String samType = entry.get( KerberosAttribute.APACHE_SAM_TYPE_AT ).getString();
135 modifier.setSamType( SamType.getTypeByOrdinal( Integer.parseInt( samType ) ) );
136 }
137
138 if ( entry.get( KerberosAttribute.KRB5_KEY_AT ) != null )
139 {
140 EntryAttribute krb5key = entry.get( KerberosAttribute.KRB5_KEY_AT );
141
142 try
143 {
144 Map<EncryptionType, EncryptionKey> keyMap = modifier.reconstituteKeyMap( krb5key );
145 modifier.setKeyMap( keyMap );
146 }
147 catch ( IOException ioe )
148 {
149 throw new InvalidAttributeValueException( "Account Kerberos key attribute '" + KerberosAttribute.KRB5_KEY_AT
150 + "' contained an invalid value for krb5key." );
151 }
152 }
153
154 return modifier.getEntry();
155 }
156 }