steinarb commented on code in PR #2854:
URL: https://github.com/apache/shiro/pull/2854#discussion_r3781312270
##########
core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java:
##########
@@ -235,6 +236,43 @@ protected Collection<String>
getRoleNamesForGroups(Collection<String> groupNames
return roleNames;
}
+ /**
+ * Returns the username to use for authentication.
+ * If {@link #principalSuffix} is configured, the sanitized username with
appended suffix will be returned.
+ * If {@link #principalSuffix} is not configured, the method will check if
the username is a valid LDAP DN.
+ * If it is a valid LDAP DN, the username will be returned as-is,
+ * otherwise the sanitized username with appended suffix will be returned.
+ *
+ * @param username input to check and sanitize
+ * @return the sanitized username with optional suffix to use for
authentication
+ */
+ protected String getUsernameWithSuffixOrFullDN(String username) {
+ if (!StringUtils.hasText(principalSuffix)) {
+ try {
+ LdapName ldapName = new LdapName(username);
+ // Full LDAP DN needs to have more than one RDN, so we can
return the username as-is
+ if (ldapName.size() > 1) {
+ return username;
+ }
+ } catch (javax.naming.InvalidNameException e) {
+ // Not a valid LDAP DN, so treat it as a regular username.
+ }
+ }
+
+ return getUsernameWithSuffix(username);
+ }
+
+ /**
+ * Returns the sanitized username with appended suffix if {@link
#principalSuffix} is configured
+ * and the username does not already end with it.
+ * If {@link #principalSuffix} is not configured, the sanitized username
will be returned
+ * <p>
+ * NOTE: {@link #getUsernameWithSuffixOrFullDN(String)} should be used
instead of this method
+ * to handle full LDAP DNs correctly.
Review Comment:
@lprimak Out of curiousity: why keep getUsernameWithSuffix as a non-private
method with javadoc if getUsernameWithSuffixOrFullDN is the one that should be
used? Is getUsernameWithSuffix used elsewhere?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
