Page Edited : DIRxSRVx11 : 2.4. Writing a custom authenticator<= /a>

2.4. Writing a custom authenticator has been edited by Emmanuel L=C3=83=C2=A9charny (Nov 19, 2008).

=20

Content:

<= colgroup>=

= Work in progress

This site is in the process of being reviewed and updated.

Warning

This page is out of date

<= /a>Using custom authenticators

Authenticator SPI provides a way to implement your own authentication me= chanism, for instance simple mechanism using password encryption such as MD= 5 or SHA1, or SASL mechanism. See the following example:

import javax.n=
aming.NamingException;

import org.apache.directory.server.core=
.authn.AbstractAuthenticator;
import org.apache.directory.server.core=
.authn.LdapPrincipal;
import org.apache.directory.server.core=
.jndi.ServerContext;
import org.apache.directory.shared.ldap=
.aci.AuthenticationLevel;
import org.apache.directory.shared.ldap=
.name.LdapDN;

public class CustomAuthenticator extends AbstractAuthenticator {
=09public CustomAuthenticator() {
=09=09// create authenticator that will handle=
 "simple" authentication mechanism
=09=09super("simple");
=09}

=09public void init() throws NamingException {
=09=09// ...
=09}

=09public LdapPrincipal authenticate(Ld=
apDN bindDn, ServerContext ctx) throws =
NamingException {
=09=09// ...

=09=09LdapPrincipal principal =3D AbstractAuthenticator.createLdapPrincipal=
(bindDn.toNormName(), AuthenticationLevel.SIMPLE);
=09=09// ..
=09=09return principal;

=09}
}

The authenticator class has to extend the org.apache.directory.server.co= re.authn.AbstractAuthenticator. This class needs to have a no-argument cons= tructor that calls the super() constructor with parameter the authenticatio= n mechanism it is going to handle. In the above example, MyAuthenticator cl= ass is going to handle the simple authentication mechanism.

You can optionally implement the init() method to initialize your authen= ticator class. This will be called when the authenticator is loaded by Apac= heDS during start-up.

When a client performs an authentication, ApacheDS will call the authent= icate() method. You can get the client authentication info from the server = context. After you authenticate the client, you need to return the authoriz= ation id. If the authentication fails, you should throw an LdapNoPermission= Exception.

When there are multiple authenticators registered with the same authenti= cation type, ApacheDS will try to use them in the order it was registered. = If one fails it will use the next one, until it finds one that successfully= authenticates the client.

To tell ApacheDS to load your custom authenticators, you need to specify= it in the server.xml. You can also optionally specify the location of a .p= roperties file containing the initialization parameters. See the following = example:

EXAMPLE BELOW IS NO LONGER VALID WITH XML CONFIGURATION

server.authenticators=3Dmyauthenticator yourauthenticator

server.authenticator.class.myauthenticator=3Dcom.mycompany.MyAuthenticator
server.authenticator.properties.myauthenticator=3Dmyauthenticator.propertie=
s

server.authenticator.class.yourauthenticator=3Dcom.yourcompany.YourAuthenti=
cator
server.authenticator.properties.yourauthenticator=3Dyourauthenticator.prope=
rties