com.atlassian.crowd.directory

Class MicrosoftActiveDirectory

java.lang.Object

com.atlassian.crowd.directory.SpringLDAPConnector

com.atlassian.crowd.directory.RFC4519Directory

com.atlassian.crowd.directory.MicrosoftActiveDirectory

All Implemented Interfaces:

LDAPDirectory, RemoteDirectory, Attributes

public class MicrosoftActiveDirectory
extends RFC4519Directory

Microsoft Active Directory connector.

Field Summary

Fields

Modifier and Type	Field and Description
static PropertyImpl<String>	OBJECT_SID
static int	UF_ACCOUNTDISABLE

Fields inherited from class com.atlassian.crowd.directory.SpringLDAPConnector

attributes, contextSource, contextSourceTransactionManager, DEFAULT_PAGE_SIZE, eventPublisher, ldapPropertiesMapper, ldapQueryTranslater, ldapTemplate, nameConverter, searchDN

Constructor Summary

Constructors

Constructor and Description
MicrosoftActiveDirectory(ActiveDirectoryQueryTranslaterImpl activeDirectoryQueryTranslater, com.atlassian.event.api.EventPublisher eventPublisher, InstanceFactory instanceFactory, PasswordHelper passwordHelper)

Method Summary

Modifier and Type	Method and Description
void	addUserToGroup(String username, String groupName)
protected ContextMapperWithRequiredAttributes<AvatarReference.BlobAvatar>	avatarMapper() Return a JpegPhotoContextMapper; assume for now that all avatars are stored as JPEG files.
long	fetchHighestCommittedUSN()
List<LDAPGroupWithAttributes>	findAddedOrUpdatedGroupsSince(long usnChanged)
protected <T> List<T>	findAddedOrUpdatedObjectsSince(long usnChange, Name objectBaseDN, String objectFilter, ContextMapperWithRequiredAttributes<T> contextMapper)
List<LDAPUserWithAttributes>	findAddedOrUpdatedUsersSince(long usnChange)
Set<String>	findAllUserGuids()
Iterable<LdapName>	findDirectMembersOfGroup(LdapName groupDn) This method is not part of RemoteDirectory's contract.
protected Iterable<String>	findGroupMembershipNames(MembershipQuery<String> query)
protected List<? extends LDAPGroupWithAttributes>	findGroupMemberships(MembershipQuery<? extends LDAPGroupWithAttributes> query)
List<Tombstone>	findGroupTombstonesSince(long usnChange)
protected List<Tombstone>	findTombstonesSince(long usnChange, Name objectBaseDN, String objectClass)
protected List<LDAPUserWithAttributes>	findUserMembersOfGroupViaMemberDN(String groupName, GroupType groupType, int startIndex, int maxResults)
protected Iterable<LDAPUserWithAttributes>	findUserMembersOfGroupViaMemberOf(String groupName, GroupType groupType, int startIndex, int maxResults)
List<Tombstone>	findUserTombstonesSince(long usnChange)
protected Map<String,Object>	getBaseEnvironmentProperties() Returns the properties used to set up the Ldap ContextSource.
protected LDAPCredentialEncoder	getCredentialEncoder()
protected List<AttributeMapper>	getCustomGroupAttributeMappers() As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).
protected List<AttributeMapper>	getCustomUserAttributeMappers()
String	getDescriptiveName()
protected String	getInitialGroupMemberDN() AD does not need a default container member.
protected List<AttributeMapper>	getMemberDnMappers()
protected void	getNewGroupDirectorySpecificAttributes(Group group, Attributes attributes) If we want to be able to nest groups, we need to create distribution groups rather than security groups.
protected void	getNewUserDirectorySpecificAttributes(User user, Attributes attributes) Active Directory needs a couple of additional attributes set - the sAMAccountName (which is the account name you use to log on to Windows), and the account disabled flag.
static String	getStaticDirectoryType()
ContextMapperWithRequiredAttributes<LDAPUserWithAttributes>	getUserContextMapper() Returns a ContextMapper that can transform a Context into a User.
protected List<ModificationItem>	getUserModificationItems(User userTemplate, LDAPUserWithAttributes currentUser)
boolean	isExternalIdConfigured() Checks if the 'User Unique ID Attribute' is set.
boolean	isUserDirectGroupMember(String username, String groupName)
protected List<LDAPGroupWithAttributes>	postprocessGroups(List<LDAPGroupWithAttributes> groups) Perform any post-processing on groups.
void	removeGroup(String name)
void	removeUserFromGroup(String username, String groupName)
boolean	supportsInactiveAccounts() This connector supports inactive accounts while, in general, LDAP connector do not.

Methods inherited from class com.atlassian.crowd.directory.RFC4519Directory

addDnToGroup, addGroupToGroup, findGroupMembershipsOfUserViaMemberOf, getLdapName, getMemberships, isDirectGroupMemberOf, isDnDirectGroupMember, isGroupDirectGroupMember, removeDnFromGroup, removeGroupFromGroup, searchGroupRelationshipsWithGroupTypeSpecified, toGenericIterable

Methods inherited from class com.atlassian.crowd.directory.SpringLDAPConnector

addDefaultSnToUserAttributes, addDefaultValueToUserAttributesForAttribute, addGroup, addUser, addUser, asLdapGroupName, asLdapName, asLdapUserName, authenticate, countDirectMembersOfGroup, createModificationItem, expireAllPasswords, findEntityByDN, findEntityByDN, findGroupByName, findGroupByNameAndType, findGroupWithAttributesByName, findUserByExternalId, findUserByName, findUserWithAttributesByName, getAttributeAsBoolean, getAttributeAsLong, getAuthoritativeDirectory, getContextSource, getDirectoryId, getGroupContextMapper, getKeys, getLdapPropertiesMapper, getNewGroupAttributes, getNewUserAttributes, getSearchDN, getSubTreeSearchControls, getUserAvatarByName, getValue, getValues, isEmpty, isRolesDisabled, pageSearchResults, removeGroupAttributes, removeUser, removeUserAttributes, renameGroup, renameUser, searchEntities, searchEntitiesWithRequestControls, searchGroupObjects, searchGroupObjectsOfSpecifiedGroupType, searchGroupRelationships, searchGroups, searchUserObjects, searchUsers, setAttributes, setDirectoryId, storeGroupAttributes, storeUserAttributes, supportsNestedGroups, supportsPasswordExpiration, supportsSettingEncryptedCredential, testConnection, typedEntityNotFoundException, updateGroup, updateUser, updateUserCredential

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.atlassian.crowd.directory.RemoteDirectory

updateUserFromRemoteDirectory, userAuthenticated

Field Detail

UF_ACCOUNTDISABLE

public static final int UF_ACCOUNTDISABLE

See Also:

Constant Field Values

OBJECT_SID

public static final PropertyImpl<String> OBJECT_SID

Constructor Detail

MicrosoftActiveDirectory

public MicrosoftActiveDirectory(ActiveDirectoryQueryTranslaterImpl activeDirectoryQueryTranslater,
                                com.atlassian.event.api.EventPublisher eventPublisher,
                                InstanceFactory instanceFactory,
                                PasswordHelper passwordHelper)

Parameters:

passwordHelper - password helper, which must not be null

Method Detail

getStaticDirectoryType

public static String getStaticDirectoryType()

getDescriptiveName

public String getDescriptiveName()

removeGroup

public void removeGroup(String name)
                 throws GroupNotFoundException,
                        OperationFailedException

Specified by:

removeGroup in interface RemoteDirectory

Overrides:

removeGroup in class SpringLDAPConnector

Throws:

GroupNotFoundException

OperationFailedException

isUserDirectGroupMember

public boolean isUserDirectGroupMember(String username,
                                       String groupName)
                                throws OperationFailedException

Specified by:

isUserDirectGroupMember in interface RemoteDirectory

Overrides:

isUserDirectGroupMember in class RFC4519Directory

Throws:

OperationFailedException

addUserToGroup

public void addUserToGroup(String username,
                           String groupName)
                    throws GroupNotFoundException,
                           OperationFailedException,
                           UserNotFoundException,
                           MembershipAlreadyExistsException

Specified by:

addUserToGroup in interface RemoteDirectory

Overrides:

addUserToGroup in class RFC4519Directory

Throws:

GroupNotFoundException

OperationFailedException

UserNotFoundException

MembershipAlreadyExistsException

removeUserFromGroup

public void removeUserFromGroup(String username,
                                String groupName)
                         throws UserNotFoundException,
                                GroupNotFoundException,
                                MembershipNotFoundException,
                                OperationFailedException

Specified by:

removeUserFromGroup in interface RemoteDirectory

Overrides:

removeUserFromGroup in class RFC4519Directory

Throws:

UserNotFoundException

GroupNotFoundException

MembershipNotFoundException

OperationFailedException

findGroupMemberships

protected List<? extends LDAPGroupWithAttributes> findGroupMemberships(MembershipQuery<? extends LDAPGroupWithAttributes> query)
                                                                throws OperationFailedException

Overrides:

findGroupMemberships in class RFC4519Directory

Throws:

OperationFailedException

findGroupMembershipNames

protected Iterable<String> findGroupMembershipNames(MembershipQuery<String> query)
                                             throws OperationFailedException

Overrides:

findGroupMembershipNames in class RFC4519Directory

Throws:

OperationFailedException

findUserMembersOfGroupViaMemberDN

protected List<LDAPUserWithAttributes> findUserMembersOfGroupViaMemberDN(String groupName,
                                                                         GroupType groupType,
                                                                         int startIndex,
                                                                         int maxResults)
                                                                  throws OperationFailedException

Overrides:

findUserMembersOfGroupViaMemberDN in class RFC4519Directory

Throws:

OperationFailedException

findUserMembersOfGroupViaMemberOf

protected Iterable<LDAPUserWithAttributes> findUserMembersOfGroupViaMemberOf(String groupName,
                                                                             GroupType groupType,
                                                                             int startIndex,
                                                                             int maxResults)
                                                                      throws OperationFailedException

Overrides:

findUserMembersOfGroupViaMemberOf in class RFC4519Directory

Throws:

OperationFailedException

findDirectMembersOfGroup

public Iterable<LdapName> findDirectMembersOfGroup(LdapName groupDn)
                                            throws OperationFailedException

Description copied from class: RFC4519Directory

This method is not part of RemoteDirectory's contract. It is introduced by RFC4519Directory to support RFC4519DirectoryMembershipsIterable.

Overrides:

findDirectMembersOfGroup in class RFC4519Directory

Parameters:

groupDn - LDAP name of a group

Returns:

the LDAP names of the direct members (users and groups) of the given group

Throws:

OperationFailedException - if the operation fails for any reason

getInitialGroupMemberDN

protected String getInitialGroupMemberDN()

AD does not need a default container member.

Overrides:

getInitialGroupMemberDN in class SpringLDAPConnector

Returns:

null.

getCredentialEncoder

protected LDAPCredentialEncoder getCredentialEncoder()

Specified by:

getCredentialEncoder in class SpringLDAPConnector

Returns:

the credential encoder to use with this directory; must not be null.

getNewUserDirectorySpecificAttributes

protected void getNewUserDirectorySpecificAttributes(User user,
                                                     Attributes attributes)

Active Directory needs a couple of additional attributes set - the sAMAccountName (which is the account name you use to log on to Windows), and the account disabled flag.

Overrides:

getNewUserDirectorySpecificAttributes in class SpringLDAPConnector

Parameters:

user - (potential) source of information that needs to be added.

attributes - attributes to add directory-specific information to.

getNewGroupDirectorySpecificAttributes

protected void getNewGroupDirectorySpecificAttributes(Group group,
                                                      Attributes attributes)

If we want to be able to nest groups, we need to create distribution groups rather than security groups. To do this we need to set groupType to 2.

Overrides:

getNewGroupDirectorySpecificAttributes in class SpringLDAPConnector

Parameters:

group - (potential) source of information that needs to be added.

attributes - attributes to add directory-specific information to.

getCustomUserAttributeMappers

protected List<AttributeMapper> getCustomUserAttributeMappers()

Overrides:

getCustomUserAttributeMappers in class RFC4519Directory

Returns:

a collection of custom attribute mappers. By default just return an empty list.

getCustomGroupAttributeMappers

protected List<AttributeMapper> getCustomGroupAttributeMappers()

Description copied from class: SpringLDAPConnector

As a minimum, this SHOULD provide an attribute mapper that maps the group members attribute (if available).

Overrides:

getCustomGroupAttributeMappers in class RFC4519Directory

Returns:

collection of custom attribute mappers (cannot be null but can be an empty list).

getMemberDnMappers

protected List<AttributeMapper> getMemberDnMappers()

Overrides:

getMemberDnMappers in class RFC4519Directory

postprocessGroups

protected List<LDAPGroupWithAttributes> postprocessGroups(List<LDAPGroupWithAttributes> groups)
                                                   throws OperationFailedException

Description copied from class: SpringLDAPConnector

Perform any post-processing on groups.

Overrides:

postprocessGroups in class SpringLDAPConnector

Parameters:

groups - to post-process

Returns:

list of groups that have been processed if required

Throws:

OperationFailedException - if processing encounters a problem with the underlying directory

getBaseEnvironmentProperties

protected Map<String,Object> getBaseEnvironmentProperties()

Description copied from class: SpringLDAPConnector

Returns the properties used to set up the Ldap ContextSource.

Overrides:

getBaseEnvironmentProperties in class SpringLDAPConnector

Returns:

the properties used to set up the Ldap ContextSource.

fetchHighestCommittedUSN

public long fetchHighestCommittedUSN()
                              throws OperationFailedException

Throws:

OperationFailedException

findAddedOrUpdatedUsersSince

public List<LDAPUserWithAttributes> findAddedOrUpdatedUsersSince(long usnChange)
                                                          throws OperationFailedException

Throws:

OperationFailedException

findAddedOrUpdatedGroupsSince

public List<LDAPGroupWithAttributes> findAddedOrUpdatedGroupsSince(long usnChanged)
                                                            throws OperationFailedException

Throws:

OperationFailedException

findUserTombstonesSince

public List<Tombstone> findUserTombstonesSince(long usnChange)
                                        throws OperationFailedException

Throws:

OperationFailedException

findAllUserGuids

public Set<String> findAllUserGuids()
                             throws OperationFailedException

Throws:

OperationFailedException

findGroupTombstonesSince

public List<Tombstone> findGroupTombstonesSince(long usnChange)
                                         throws OperationFailedException

Throws:

OperationFailedException

findAddedOrUpdatedObjectsSince

protected <T> List<T> findAddedOrUpdatedObjectsSince(long usnChange,
                                                     Name objectBaseDN,
                                                     String objectFilter,
                                                     ContextMapperWithRequiredAttributes<T> contextMapper)
                                              throws OperationFailedException

Throws:

OperationFailedException

findTombstonesSince

protected List<Tombstone> findTombstonesSince(long usnChange,
                                              Name objectBaseDN,
                                              String objectClass)
                                       throws OperationFailedException

Throws:

OperationFailedException

getUserContextMapper

public ContextMapperWithRequiredAttributes<LDAPUserWithAttributes> getUserContextMapper()

Description copied from class: SpringLDAPConnector

Returns a ContextMapper that can transform a Context into a User.

Overrides:

getUserContextMapper in class SpringLDAPConnector

Returns:

a ContextMapper that can transform a Context into a User.

isExternalIdConfigured

public boolean isExternalIdConfigured()

Checks if the 'User Unique ID Attribute' is set.

Returns:

true if the property value is a non empty string

getUserModificationItems

protected List<ModificationItem> getUserModificationItems(User userTemplate,
                                                          LDAPUserWithAttributes currentUser)

Overrides:

getUserModificationItems in class SpringLDAPConnector

supportsInactiveAccounts

public boolean supportsInactiveAccounts()

This connector supports inactive accounts while, in general, LDAP connector do not.

Specified by:

supportsInactiveAccounts in interface RemoteDirectory

Overrides:

supportsInactiveAccounts in class SpringLDAPConnector

Returns:

true

avatarMapper

protected ContextMapperWithRequiredAttributes<AvatarReference.BlobAvatar> avatarMapper()

Return a JpegPhotoContextMapper; assume for now that all avatars are stored as JPEG files.

Overrides:

avatarMapper in class SpringLDAPConnector