Return-Path: 
 <shiro-dev-return-3516-apmail-incubator-shiro-dev-archive=incubator.apache.org@incubator.apache.org>
Delivered-To: apmail-incubator-shiro-dev-archive@www.apache.org
Received: (qmail 37126 invoked from network); 22 Jul 2010 22:54:15 -0000
Received: from unknown (HELO mail.apache.org) (140.211.11.3)
  by 140.211.11.9 with SMTP; 22 Jul 2010 22:54:15 -0000
Received: (qmail 81956 invoked by uid 500); 22 Jul 2010 22:54:15 -0000
Delivered-To: apmail-incubator-shiro-dev-archive@incubator.apache.org
Received: (qmail 81691 invoked by uid 500); 22 Jul 2010 22:54:14 -0000
Mailing-List: contact shiro-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:shiro-dev-help@incubator.apache.org>
List-Unsubscribe: <mailto:shiro-dev-unsubscribe@incubator.apache.org>
List-Post: <mailto:shiro-dev@incubator.apache.org>
List-Id: <shiro-dev.incubator.apache.org>
Reply-To: shiro-dev@incubator.apache.org
Delivered-To: mailing list shiro-dev@incubator.apache.org
Received: (qmail 81683 invoked by uid 99); 22 Jul 2010 22:54:14 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 22 Jul 2010 22:54:14 +0000
X-ASF-Spam-Status: No, hits=-2000.0 required=10.0
	tests=ALL_TRUSTED
X-Spam-Check-By: apache.org
Received: from [140.211.11.22] (HELO thor.apache.org) (140.211.11.22)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 22 Jul 2010 22:54:11 +0000
Received: from thor (localhost [127.0.0.1])
	by thor.apache.org (8.13.8+Sun/8.13.8) with ESMTP id o6MMroPU005224
	for <shiro-dev@incubator.apache.org>; Thu, 22 Jul 2010 22:53:50 GMT
Message-ID: <17319725.528401279839230127.JavaMail.jira@thor>
Date: Thu, 22 Jul 2010 18:53:50 -0400 (EDT)
From: "Emmanuel Lecharny (JIRA)" <jira@apache.org>
To: shiro-dev@incubator.apache.org
Subject: [jira] Commented: (SHIRO-127) Improvements to Shiro's LDAP support
In-Reply-To: <1555482601.115241262928415894.JavaMail.jira@brutus.apache.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394
X-Virus-Checked: Checked by ClamAV on apache.org


    [ https://issues.apache.org/jira/browse/SHIRO-127?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12891380#action_12891380 ] 

Emmanuel Lecharny commented on SHIRO-127:
-----------------------------------------

Checking the code at ActiveDirectoryRealm.java, it's *very* likely that you'll have a lot of troubles if you don't take care of some few points :

- code like (line 190) :
    ...
    if (attr.getID().equals("memberOf")) {
    ...
won't work if the attr stores the ID in uper case, or all in lower case. attr.getID() may return one of those values :
* memberof
* MEMBEROF
* MemberOf
* MeMbErOf
* the OID (I don't know what is the memberOf's OID, but be ready to deal with things like 2.5.4.11...)

- when creating a NamingEnumeration, *always* close it, otherwise you'll get some nasty errors (like very long delay if you are using a Ldap connection pool). Good luck to find the origin of those delays if you don't know that NE must be closed ...

so 
try {
  <use a NamingEnumeration>
} finally {
  <close the NamingEnumeration>
}
 
- filters like (line 171) :
String searchFilter = "(&(objectClass=*)(userPrincipalName={0}))";
is strictly equivalent to 
String searchFilter = "(userPrincipalName={0})";

Of course, check that the userPrincipalName is indexed, otherwise a search using this filter will do a full scan...

- be *very* careful when manipulation a DN. For the same reason than in point #1, a DN may have multiple forms. Using the DN as a String is likely to carry some strange errors too (like you don't find a match with a given DN). Comparing 2 DNs is *not* something simple, you won't be able to whip it in less than one week, trust me on that.

If you want a way to identify an entry by an invariant value, don't use the DN, use the entryUUID attribute. It's unique, it's invariant, it's case non sensitive.



> Improvements to Shiro's LDAP support
> ------------------------------------
>
>                 Key: SHIRO-127
>                 URL: https://issues.apache.org/jira/browse/SHIRO-127
>             Project: Shiro
>          Issue Type: Improvement
>          Components: Realms 
>            Reporter: Philippe Laflamme
>         Attachments: shiro-127.patch
>
>
> Following this mailing list discussion: http://n2.nabble.com/Confusion-with-the-LDAP-Realm-tp4268254p4268254.html

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.