Skip to content

Commit 734da87

Browse files
tarzanektarzanek
authored
Merge pull request #3205 from vladak/ldap_plugins_logging
add debug logging to LDAP authorization plugins
2 parents 7d5cdd4 + 487fa86 commit 734da87

File tree

5 files changed

+74
-36
lines changed

5 files changed

+74
-36
lines changed

‎plugins/src/main/java/opengrok/auth/plugin/LdapAttrPlugin.java

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
*/
1919

2020
/*
21-
* Copyright (c) 2016, 2018 Oracle and/or its affiliates. All rights reserved.
21+
* Copyright (c) 2016, 2020 Oracle and/or its affiliates. All rights reserved.
2222
*/
2323
package opengrok.auth.plugin;
2424

@@ -70,6 +70,7 @@ public class LdapAttrPlugin extends AbstractLdapPlugin {
7070
private String ldapAttr;
7171
private final Set<String> whitelist = new TreeSet<>();
7272
private Integer ldapUserInstance;
73+
private String filePath;
7374

7475
public LdapAttrPlugin() {
7576
sessionAllowed += "-" + nextId++;
@@ -94,7 +95,6 @@ private void init(Map<String, Object> parameters) {
9495
throw new NullPointerException("Missing param [" + ATTR_PARAM + "] in the setup");
9596
}
9697

97-
String filePath;
9898
if ((filePath = (String) parameters.get(FILE_PARAM)) == null) {
9999
throw new NullPointerException("Missing param [" + FILE_PARAM + "] in the setup");
100100
}
@@ -142,38 +142,41 @@ public void fillSession(HttpServletRequest req, User user) {
142142
// Check attributes cached in LDAP user object first, then query LDAP server
143143
// (and if found, cache the result in the LDAP user object).
144144
attributeValues = ldapUser.getAttribute(ldapAttr);
145-
if (attributeValues != null) {
146-
sessionAllowed = attributeValues.stream().anyMatch(whitelist::contains);
147-
} else {
145+
if (attributeValues == null) {
146+
AbstractLdapProvider ldapProvider = getLdapProvider();
148147
try {
149148
String dn = ldapUser.getDn();
150149
if (dn != null) {
151-
LOGGER.log(Level.FINEST, "searching with dn={0}", dn);
150+
LOGGER.log(Level.FINEST, "searching with dn={0} on {1}",
151+
new Object[]{dn, ldapProvider});
152152
AbstractLdapProvider.LdapSearchResult<Map<String, Set<String>>> res;
153-
if ((res = getLdapProvider().lookupLdapContent(dn, new String[]{ldapAttr})) == null) {
154-
LOGGER.log(Level.WARNING, "cannot lookup attributes {0} for user {1} (LDAP provider: {2})",
155-
new Object[]{ldapAttr, user, getLdapProvider()});
153+
if ((res = ldapProvider.lookupLdapContent(dn, new String[]{ldapAttr})) == null) {
154+
LOGGER.log(Level.WARNING, "cannot lookup attributes {0} for user {1} on {2})",
155+
new Object[]{ldapAttr, user, ldapProvider});
156156
return;
157157
}
158158

159159
records = res.getAttrs();
160160
} else {
161-
LOGGER.log(Level.FINE, "no DN for user {0}", user);
161+
LOGGER.log(Level.FINE, "no DN for user {0} on {1}",
162+
new Object[]{user, ldapProvider});
162163
}
163164
} catch (LdapException ex) {
164165
throw new AuthorizationException(ex);
165166
}
166167

167168
if (records == null || records.isEmpty() || (attributeValues = records.get(ldapAttr)) == null) {
168-
LOGGER.log(Level.WARNING, "empty records or attribute values {0} for user {1}",
169-
new Object[]{ldapAttr, user});
169+
LOGGER.log(Level.WARNING, "empty records or attribute values {0} for user {1} on {2}",
170+
new Object[]{ldapAttr, user, ldapProvider});
170171
return;
171172
}
172173

173174
ldapUser.setAttribute(ldapAttr, attributeValues);
174-
sessionAllowed = attributeValues.stream().anyMatch(whitelist::contains);
175175
}
176176

177+
sessionAllowed = attributeValues.stream().anyMatch(whitelist::contains);
178+
LOGGER.log(Level.FINEST, "LDAP user {0} {1} against {2}",
179+
new Object[]{ldapUser, sessionAllowed ? "allowed" : "denied", filePath});
177180
updateSession(req, sessionAllowed);
178181
}
179182

‎plugins/src/main/java/opengrok/auth/plugin/LdapFilterPlugin.java

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
*/
1919

2020
/*
21-
* Copyright (c) 2016, 2019 Oracle and/or its affiliates. All rights reserved.
21+
* Copyright (c) 2016, 2020 Oracle and/or its affiliates. All rights reserved.
2222
*/
2323
package opengrok.auth.plugin;
2424

@@ -32,6 +32,7 @@
3232
import javax.servlet.http.HttpServletRequest;
3333
import opengrok.auth.entity.LdapUser;
3434
import opengrok.auth.plugin.entity.User;
35+
import opengrok.auth.plugin.ldap.AbstractLdapProvider;
3536
import opengrok.auth.plugin.ldap.LdapException;
3637
import opengrok.auth.plugin.util.FilterUtil;
3738
import org.opengrok.indexer.authorization.AuthorizationException;
@@ -122,22 +123,28 @@ public void fillSession(HttpServletRequest req, User user) {
122123
updateSession(req, false);
123124

124125
if ((ldapUser = (LdapUser) req.getSession().getAttribute(getSessionAttr())) == null) {
125-
LOGGER.log(Level.FINER, "failed to get LDAP attribute " + LdapUserPlugin.SESSION_ATTR);
126+
LOGGER.log(Level.WARNING, "failed to get LDAP attribute ''{0}'' from session for user {1}",
127+
new Object[]{LdapUserPlugin.SESSION_ATTR, user});
126128
return;
127129
}
128130

129131
String expandedFilter = expandFilter(ldapFilter, ldapUser, user);
130-
LOGGER.log(Level.FINER, "expanded filter for user {0} and LDAP user {1} into ''{2}''",
132+
LOGGER.log(Level.FINEST, "expanded filter for user {0} and LDAP user {1} into ''{2}''",
131133
new Object[]{user, ldapUser, expandedFilter});
134+
AbstractLdapProvider ldapProvider = getLdapProvider();
132135
try {
133-
if ((getLdapProvider().lookupLdapContent(null, expandedFilter)) == null) {
134-
LOGGER.log(Level.FINER, "failed to get content for user from LDAP server");
136+
if ((ldapProvider.lookupLdapContent(null, expandedFilter)) == null) {
137+
LOGGER.log(Level.WARNING,
138+
"failed to get content for LDAP user {0} with filter {1} on {2}",
139+
new Object[]{ldapUser, expandedFilter, ldapProvider});
135140
return;
136141
}
137142
} catch (LdapException ex) {
138143
throw new AuthorizationException(ex);
139144
}
140145

146+
LOGGER.log(Level.FINEST, "LDAP user {0} allowed on {2}",
147+
new Object[]{ldapUser, ldapProvider});
141148
updateSession(req, true);
142149
}
143150

‎plugins/src/main/java/opengrok/auth/plugin/LdapUserPlugin.java

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
*/
1919

2020
/*
21-
* Copyright (c) 2016, 2019 Oracle and/or its affiliates. All rights reserved.
21+
* Copyright (c) 2016, 2020 Oracle and/or its affiliates. All rights reserved.
2222
*/
2323
package opengrok.auth.plugin;
2424

@@ -153,17 +153,24 @@ public void fillSession(HttpServletRequest req, User user) {
153153
return;
154154
}
155155

156-
String expandedFilter = null;
157156
String dn = null;
158157
if (useDN) {
159158
dn = user.getUsername();
159+
LOGGER.log(Level.FINEST, "using DN ''{0}'' for user {1}",
160+
new Object[]{dn, user});
160161
}
162+
163+
String expandedFilter = null;
161164
if (ldapFilter != null) {
162165
expandedFilter = expandFilter(user);
166+
LOGGER.log(Level.FINEST, "expanded filter for user {0} into ''{1}''",
167+
new Object[]{user, expandedFilter});
163168
}
169+
170+
AbstractLdapProvider ldapProvider = getLdapProvider();
164171
try {
165172
AbstractLdapProvider.LdapSearchResult<Map<String, Set<String>>> res;
166-
if ((res = getLdapProvider().lookupLdapContent(dn, expandedFilter,
173+
if ((res = ldapProvider.lookupLdapContent(dn, expandedFilter,
167174
attributes.toArray(new String[0]))) == null) {
168175
LOGGER.log(Level.WARNING, "failed to get LDAP attributes ''{2}'' for user {0} " +
169176
"with filter ''{1}'' from LDAP provider {3}",
@@ -174,21 +181,23 @@ public void fillSession(HttpServletRequest req, User user) {
174181
records = res.getAttrs();
175182
if (!useDN) {
176183
dn = res.getDN();
184+
LOGGER.log(Level.FINEST, "got DN ''{0}'' for user {1} on {2}",
185+
new Object[]{dn, user});
177186
}
178187
} catch (LdapException ex) {
179188
throw new AuthorizationException(ex);
180189
}
181190

182191
if (records.isEmpty()) {
183-
LOGGER.log(Level.WARNING, "LDAP records for user {0} are empty",
184-
user);
192+
LOGGER.log(Level.WARNING, "LDAP records for user {0} are empty on {1}",
193+
new Object[]{user, ldapProvider});
185194
return;
186195
}
187196

188197
for (String attrName : attributes) {
189198
if (!records.containsKey(attrName) || records.get(attrName) == null || records.get(attrName).isEmpty()) {
190-
LOGGER.log(Level.WARNING, "''{0}'' record for user {1} is not present or empty (LDAP provider: {2})",
191-
new Object[]{attrName, user, getLdapProvider()});
199+
LOGGER.log(Level.WARNING, "''{0}'' record for user {1} is not present or empty on {2}",
200+
new Object[]{attrName, user, ldapProvider});
192201
}
193202
}
194203

@@ -197,7 +206,8 @@ public void fillSession(HttpServletRequest req, User user) {
197206
attrSet.put(attrName, records.get(attrName));
198207
}
199208

200-
LOGGER.log(Level.FINEST, "DN for user {0}: {1}", new Object[]{user, dn});
209+
LOGGER.log(Level.FINEST, "DN for user {0} is ''{1}'' on {2}",
210+
new Object[]{user, dn, ldapProvider});
201211
updateSession(req, new LdapUser(dn, attrSet));
202212
}
203213

‎plugins/src/main/java/opengrok/auth/plugin/ldap/LdapFacade.java

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
*/
1919

2020
/*
21-
* Copyright (c) 2016, 2019, Oracle and/or its affiliates. All rights reserved.
21+
* Copyright (c) 2016, 2020, Oracle and/or its affiliates. All rights reserved.
2222
*/
2323
package opengrok.auth.plugin.ldap;
2424

@@ -30,7 +30,6 @@
3030
import java.util.TreeSet;
3131
import java.util.logging.Level;
3232
import java.util.logging.Logger;
33-
import java.util.stream.Collectors;
3433
import javax.naming.CommunicationException;
3534
import javax.naming.NameNotFoundException;
3635
import javax.naming.NamingEnumeration;
@@ -431,8 +430,7 @@ private <T> T processResult(SearchResult result, AttributeMapper<T> mapper) thro
431430
}
432431

433432
public String toString() {
434-
return "{servers=" + String.join(",",
435-
getServers().stream().map(LdapServer::getUrl).collect(Collectors.toList())) +
433+
return "{server=" + (actualServer != -1 ? servers.get(actualServer) : "no active server") +
436434
", searchBase=" + getSearchBase() + "}";
437435
}
438436
}

‎plugins/src/test/java/opengrok/auth/plugin/ldap/LdapFacadeTest.java

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
import org.mockito.Mockito;
88

99
import javax.naming.directory.SearchControls;
10+
import javax.naming.ldap.LdapContext;
1011

1112
import java.net.InetAddress;
1213
import java.net.UnknownHostException;
@@ -45,16 +46,35 @@ public void testConnectTimeoutInheritance() {
4546
}
4647

4748
@Test
48-
public void testToString() {
49+
public void testToStringNegative() throws UnknownHostException {
4950
Configuration config = new Configuration();
50-
config.setServers(Arrays.asList(new LdapServer("http://foo.foo"),
51-
new LdapServer("http://bar.bar",
52-
"cn=FOOBAR,l=amer,dc=example,dc=com", "MySecretPassword")));
51+
LdapServer server1 = new LdapServer("ldap://foo.com");
52+
LdapServer serverSpy1 = Mockito.spy(server1);
53+
Mockito.when(serverSpy1.getAddresses(any())).thenReturn(new InetAddress[]{InetAddress.getLocalHost()});
54+
Mockito.when(serverSpy1.isReachable()).thenReturn(false);
55+
56+
config.setServers(Collections.singletonList(serverSpy1));
5357
config.setSearchBase("dc=foo,dc=com");
54-
int timeoutValue = 42;
58+
int timeoutValue = 3;
59+
config.setConnectTimeout(timeoutValue);
60+
LdapFacade facade = new LdapFacade(config);
61+
assertEquals("{server=no active server, searchBase=dc=foo,dc=com}",
62+
facade.toString());
63+
}
64+
65+
@Test
66+
public void testToStringPositive() throws UnknownHostException {
67+
Configuration config = new Configuration();
68+
LdapServer server1 = new LdapServer("ldap://foo.com");
69+
LdapServer serverSpy1 = Mockito.spy(server1);
70+
Mockito.doReturn(true).when(serverSpy1).isWorking();
71+
72+
config.setServers(Collections.singletonList(serverSpy1));
73+
config.setSearchBase("dc=foo,dc=com");
74+
int timeoutValue = 3;
5575
config.setConnectTimeout(timeoutValue);
5676
LdapFacade facade = new LdapFacade(config);
57-
assertEquals("{servers=http://foo.foo,http://bar.bar, searchBase=dc=foo,dc=com}",
77+
assertEquals("{server=ldap://foo.com timeout: 3, searchBase=dc=foo,dc=com}",
5878
facade.toString());
5979
}
6080

0 commit comments

Comments
 (0)