diff --git a/kafka-manager-common/src/main/java/com/xiaojukeji/kafka/manager/common/utils/SplitUtils.java b/kafka-manager-common/src/main/java/com/xiaojukeji/kafka/manager/common/utils/SplitUtils.java new file mode 100644 index 00000000..d3692d96 --- /dev/null +++ b/kafka-manager-common/src/main/java/com/xiaojukeji/kafka/manager/common/utils/SplitUtils.java @@ -0,0 +1,14 @@ +package com.xiaojukeji.kafka.manager.common.utils; + +/** + * @className: SplitUtils + * @description: Split string of type keyValue + * @author: Hu.Yue + * @date: 2021/8/4 + **/ +public class SplitUtils { + + public static String keyValueSplit(String keyValue){ + return keyValue.split(":\\s+")[1]; + } +} diff --git a/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/ldap/LdapAuthentication.java b/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/ldap/LdapAuthentication.java index f456c916..4dde4083 100644 --- a/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/ldap/LdapAuthentication.java +++ b/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/ldap/LdapAuthentication.java @@ -1,5 +1,6 @@ package com.xiaojukeji.kafka.manager.account.component.ldap; +import com.xiaojukeji.kafka.manager.common.utils.SplitUtils; import com.xiaojukeji.kafka.manager.common.utils.ValidateUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -14,7 +15,9 @@ import javax.naming.directory.SearchControls; import javax.naming.directory.SearchResult; import javax.naming.ldap.InitialLdapContext; import javax.naming.ldap.LdapContext; +import java.util.HashMap; import java.util.Hashtable; +import java.util.Map; @Component public class LdapAuthentication { @@ -60,8 +63,11 @@ public class LdapAuthentication { return null; } - private String getUserDN(String account, LdapContext ctx) { + private Map getLdapAttrsInfo(String account, LdapContext ctx) { + //存储更多的LDAP元信息 + Map ldapAttrsInfo = new HashMap<>(); String userDN = ""; + ldapAttrsInfo.clear(); try { SearchControls constraints = new SearchControls(); constraints.setSearchScope(SearchControls.SUBTREE_SCOPE); @@ -69,7 +75,7 @@ public class LdapAuthentication { NamingEnumeration en = ctx.search("", filter, constraints); if (en == null || !en.hasMoreElements()) { - return ""; + return null; } // maybe more than one element while (en.hasMoreElements()) { @@ -78,13 +84,25 @@ public class LdapAuthentication { SearchResult si = (SearchResult) obj; userDN += si.getName(); userDN += "," + ldapBasedn; + //携带LDAP更多元信息以填充用户元信息 + ldapAttrsInfo.put("userDN", userDN); + ldapAttrsInfo.put("sAMAccountName", + SplitUtils.keyValueSplit(si.getAttributes().get("samaccountname").toString())); + ldapAttrsInfo.put("department", + SplitUtils.keyValueSplit(si.getAttributes().get("department").toString())); + ldapAttrsInfo.put("company", + SplitUtils.keyValueSplit(si.getAttributes().get("company").toString())); + ldapAttrsInfo.put("displayName", + SplitUtils.keyValueSplit(si.getAttributes().get("displayname").toString())); + ldapAttrsInfo.put("mail", + SplitUtils.keyValueSplit(si.getAttributes().get("mail").toString())); break; } } } catch (Exception e) { LOGGER.error("class=LdapAuthentication||method=getUserDN||account={}||errMsg={}", account, e); } - return userDN; + return ldapAttrsInfo; } /** @@ -93,23 +111,23 @@ public class LdapAuthentication { * @param password * @return */ - public boolean authenticate(String account, String password) { + public Map authenticate(String account, String password) { LdapContext ctx = getLdapContext(); if (ValidateUtils.isNull(ctx)) { - return false; + return null; } try { - String userDN = getUserDN(account, ctx); - if(ValidateUtils.isBlank(userDN)){ - return false; + Map ldapAttrsInfo = getLdapAttrsInfo(account, ctx); + if(ValidateUtils.isNull(ldapAttrsInfo)){ + return null; } - ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDN); + ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, ldapAttrsInfo.get("userDN").toString()); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password); ctx.reconnect(null); - return true; + return ldapAttrsInfo; } catch (AuthenticationException e) { LOGGER.warn("class=LdapAuthentication||method=authenticate||account={}||errMsg={}", account, e); } catch (NamingException e) { @@ -125,6 +143,6 @@ public class LdapAuthentication { } } } - return false; + return null; } } diff --git a/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/sso/BaseSessionSignOn.java b/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/sso/BaseSessionSignOn.java index bf2d29dc..bb5f415c 100644 --- a/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/sso/BaseSessionSignOn.java +++ b/kafka-manager-extends/kafka-manager-account/src/main/java/com/xiaojukeji/kafka/manager/account/component/sso/BaseSessionSignOn.java @@ -17,6 +17,7 @@ import org.springframework.stereotype.Service; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import java.util.Map; /** * @author zengqiao @@ -52,15 +53,17 @@ public class BaseSessionSignOn extends AbstractSingleSignOn { //判断是否激活了LDAP验证, 若激活则也可使用ldap进行认证 if(!ValidateUtils.isNull(accountLdapEnabled) && accountLdapEnabled){ - //基于LDAP的登陆用户忽略大小写账户,统一做大写处理 - dto.setUsername(dto.getUsername().toUpperCase()); //去LDAP验证账密 - if(!ldapAuthentication.authenticate(dto.getUsername(),dto.getPassword())){ + Map ldapAttrsInfo; + ldapAttrsInfo = ldapAuthentication.authenticate(dto.getUsername(),dto.getPassword()); + if(ValidateUtils.isNull(ldapAttrsInfo)){ return Result.buildFrom(ResultStatus.LDAP_AUTHENTICATION_FAILED); } if((ValidateUtils.isNull(accountResult) || ValidateUtils.isNull(accountResult.getData())) && authUserRegistration){ //自动注册 + //使用Ldap:sAMAccountName替换用户输入的值 + dto.setUsername(ldapAttrsInfo.get("sAMAccountName").toString()); AccountDO accountDO = new AccountDO(); accountDO.setUsername(dto.getUsername()); accountDO.setRole(AccountRoleEnum.getUserRoleEnum(authUserRegistrationRole).getRole());