| The default strategy for obtaining user role information from the directory.
It obtains roles by performing a search for "groups" the user is a member of.
A typical group search scenario would be where each group/role is specified using the groupOfNames
(or groupOfUniqueNames) LDAP objectClass and the user's DN is listed in the member (or
uniqueMember) attribute to indicate that they should be assigned that role. The following LDIF sample has
the groups stored under the DN ou=groups,dc=acegisecurity,dc=org and a group called "developers" with
"ben" and "marissa" as members:
dn: ou=groups,dc=acegisecurity,dc=orgobjectClass: top
objectClass: organizationalUnitou: groupsdn: cn=developers,ou=groups,dc=acegisecurity,dc=org
objectClass: groupOfNamesobjectClass: topcn: developersdescription: Acegi Security Developers
member: uid=ben,ou=people,dc=acegisecurity,dc=orgmember: uid=marissa,ou=people,dc=acegisecurity,dc=orgou: developer
The group search is performed within a DN specified by the groupSearchBase property, which should
be relative to the root DN of its InitialDirContextFactory. If the search base is null, group searching is
disabled. The filter used in the search is defined by the groupSearchFilter property, with the filter
argument {0} being the full DN of the user. You can also optionally use the parameter {1}, which will be substituted
with the username. You can also specify which attribute defines the role name by setting
the groupRoleAttribute property (the default is "cn").
The configuration below shows how the group search might be performed with the above schema.
<bean id="ldapAuthoritiesPopulator"
class="org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator">
<constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
<constructor-arg><value>ou=groups</value></constructor-arg>
<property name="groupRoleAttribute"><value>ou</value></property>
<!-- the following properties are shown with their default values -->
<property name="searchSubTree"><value>false</value></property>
<property name="rolePrefix"><value>ROLE_</value></property>
<property name="convertToUpperCase"><value>true</value></property>
</bean>
A search for roles for user "uid=ben,ou=people,dc=acegisecurity,dc=org" would return the single granted authority
"ROLE_DEVELOPER".
The single-level search is performed by default. Setting the searchSubTree property to true will enable
a search of the entire subtree under groupSearchBase.
author:
Luke Taylor
version:
$Id: DefaultLdapAuthoritiesPopulator.java 1996 2007-08-30 21:15:14Z luke_t $ |
