lprimak commented on code in PR #2854:
URL: https://github.com/apache/shiro/pull/2854#discussion_r3781325413
##########
core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java:
##########
@@ -235,6 +236,43 @@ protected Collection<String>
getRoleNamesForGroups(Collection<String> groupNames
return roleNames;
}
+ /**
+ * Returns the username to use for authentication.
+ * If {@link #principalSuffix} is configured, the sanitized username with
appended suffix will be returned.
+ * If {@link #principalSuffix} is not configured, the method will check if
the username is a valid LDAP DN.
+ * If it is a valid LDAP DN, the username will be returned as-is,
+ * otherwise the sanitized username with appended suffix will be returned.
+ *
+ * @param username input to check and sanitize
+ * @return the sanitized username with optional suffix to use for
authentication
+ */
+ protected String getUsernameWithSuffixOrFullDN(String username) {
+ if (!StringUtils.hasText(principalSuffix)) {
+ try {
+ LdapName ldapName = new LdapName(username);
+ // Full LDAP DN needs to have more than one RDN, so we can
return the username as-is
+ if (ldapName.size() > 1) {
+ return username;
+ }
+ } catch (javax.naming.InvalidNameException e) {
+ // Not a valid LDAP DN, so treat it as a regular username.
+ }
+ }
+
+ return getUsernameWithSuffix(username);
+ }
+
+ /**
+ * Returns the sanitized username with appended suffix if {@link
#principalSuffix} is configured
+ * and the username does not already end with it.
+ * If {@link #principalSuffix} is not configured, the sanitized username
will be returned
+ * <p>
+ * NOTE: {@link #getUsernameWithSuffixOrFullDN(String)} should be used
instead of this method
+ * to handle full LDAP DNs correctly.
Review Comment:
Simply because it was part of the API for a long time. Who knows how users
are using it?
In order to remove an API, we would have to deprecated it for one major
release at least,
and then remove it in another (today, it would be 5.0) so it better be worth
it :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
