Return-Path: X-Original-To: apmail-shiro-user-archive@www.apache.org Delivered-To: apmail-shiro-user-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 3D43BE26F for ; Tue, 8 Jan 2013 17:57:54 +0000 (UTC) Received: (qmail 58377 invoked by uid 500); 8 Jan 2013 17:57:54 -0000 Delivered-To: apmail-shiro-user-archive@shiro.apache.org Received: (qmail 58332 invoked by uid 500); 8 Jan 2013 17:57:54 -0000 Mailing-List: contact user-help@shiro.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@shiro.apache.org Delivered-To: mailing list user@shiro.apache.org Received: (qmail 58321 invoked by uid 99); 8 Jan 2013 17:57:53 -0000 Received: from minotaur.apache.org (HELO minotaur.apache.org) (140.211.11.9) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 08 Jan 2013 17:57:53 +0000 Received: from localhost (HELO mail-ia0-f174.google.com) (127.0.0.1) (smtp-auth username lhazlewood, mechanism plain) by minotaur.apache.org (qpsmtpd/0.29) with ESMTP; Tue, 08 Jan 2013 17:57:53 +0000 Received: by mail-ia0-f174.google.com with SMTP id y25so600784iay.5 for ; Tue, 08 Jan 2013 09:57:52 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:x-gm-message-state; bh=a1rT8g7Nf9xio6GrgURk8pEnw6pYaN+5PyMTQY6kMN0=; b=N92ZPex+NLYI+RVWCLXZdfyWEn61FyOFKx2B8U9uuYcgHdh7fq2SKeEh4G9PFDYzlS mBnN6zNwIPq+RsbTUca4SFSbMmnOy1Y5499Ro3ST81uBR3HAuVf9H6O+dCF2EzbpLQXa tHT9tWrUa/gzMU/Msn2VJqOC/bdT6qjpl+sEzRMgXOaWLzYTxlPXAbGwSpCBjRp8S4LZ 4lxIFx6wy8yaEgyIoHua+k5ghgxiGRiuGyzpWYJX8mj3KeB0ziicrdXqnSipuXsEA9Re oI5qJTmtWiLT4ENRdV8J8/6u6NmVc/qoHTPBWsSauFvAYLkz/mKchVVNlre4eQTu9nzh 6m2g== MIME-Version: 1.0 Received: by 10.50.108.235 with SMTP id hn11mr9660665igb.100.1357667872823; Tue, 08 Jan 2013 09:57:52 -0800 (PST) Received: by 10.50.77.136 with HTTP; Tue, 8 Jan 2013 09:57:52 -0800 (PST) In-Reply-To: References: Date: Tue, 8 Jan 2013 09:57:52 -0800 Message-ID: Subject: Re: ActiveDirectoryRealm hasRole? From: Les Hazlewood To: user@shiro.apache.org Content-Type: multipart/alternative; boundary=f46d0402aeef48590c04d2caaf2b X-Gm-Message-State: ALoCoQn42bj3dnORHx8TyQIINPavdEvsSjXT6udKmHo0OT3scpdPj34FH4jQxtWULJSxq/mmHZYc --f46d0402aeef48590c04d2caaf2b Content-Type: text/plain; charset=ISO-8859-1 Hi John, I'm surprised to hear of this since I'm unaware of it failing for others (but maybe others subclass it often and this isn't a problem - who knows). Can you please provide a patch to fix it? We can incorporate a patch asap. Best, -- Les Hazlewood | @lhazlewood CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282 Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk On Mon, Jan 7, 2013 at 9:33 PM, John Vines wrote: > Anyone have any idea on this one? This not working sorta defeats the > purpose of using LDAP as an authorization realm. > > > On Fri, Dec 21, 2012 at 2:46 PM, John Vines wrote: > >> So I was able to determine that subjectPrincipalName was not being set, >> so adding that actually got the ldap query on line 174 to return something. >> However, memberOf is not part of the result set. So it returns nothing. >> However, I was able to query is successfully using ldp and see the memberOf >> attribute ( http://i.imgur.com/yhN1t.png ). Any thoughts? >> >> >> On Thu, Dec 20, 2012 at 9:59 PM, Les Hazlewood wrote: >> >>> Hi John, >>> >>> Here's the part of code that does the ActiveDirectory role lookup: >>> >>> >>> http://shiro.apache.org/static/current/xref/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.html#136 >>> >>> It uses the 'memberOf' attribute to determine Roles. >>> >>> HTH! >>> >>> -- >>> Les Hazlewood | @lhazlewood >>> CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282 >>> Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk >>> >>> On Thu, Dec 20, 2012 at 4:57 PM, John Vines wrote: >>> > I will preface this with I am fairly green when it comes to LDAP and >>> AD. The >>> > ActiveDirectoryRealm.hasRole() call, does that work against a Role or a >>> > Group? If the former, is there a way to do checks against Group >>> membership >>> > from SecurityManager? I'm having issues having hasRole work against an >>> AD >>> > instance and I find myself to be a bit stuck due to lack of knowledge >>> of >>> > both AD/LDAP and Shiro's role/permission support. >>> > >>> > Thanks >>> > John >>> >> >> > --f46d0402aeef48590c04d2caaf2b Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi John,

I'm surprised to hear of this since I'm= unaware of it failing for others (but maybe others subclass it often and t= his isn't a problem - who knows). =A0Can you please provide a patch to = fix it? =A0We can incorporate a patch asap.

Best,

--
Les Hazlewood |= @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
Stormpat= h wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk


On Mon, Jan 7, 2013 at 9:33 PM, John Vin= es <vines@apache.org> wrote:
Anyone have any idea on this one? This not working sorta d= efeats the purpose of using LDAP as an authorization realm.


On Fri, Dec 21, 2012 at 2:46 PM, John Vines <vines@apache.org> wrote:
So I was able to determine = that subjectPrincipalName was not being set, so adding that actually got th= e ldap query on line 174 to return something. However, memberOf is not part= of the result set. So it returns nothing. However, I was able to query is = successfully using ldp and see the memberOf attribute ( http://i.imgur.com/yhN1t.png ).= Any thoughts?


On Thu, Dec = 20, 2012 at 9:59 PM, Les Hazlewood <lhazlewood@apache.org> wrote:
Hi John,

Here's the part of code that does the ActiveDirectory role lookup:

http://= shiro.apache.org/static/current/xref/org/apache/shiro/realm/activedirectory= /ActiveDirectoryRealm.html#136

It uses the 'memberOf' attribute to determine Roles.

HTH!

--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://= stormpath.com | @goStormpath | 888.391.5282
Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk

On Thu, Dec 20, 2012 at 4:57 PM, John Vines <vines@apache.org> wrote:
> I will preface this with I am fairly green when it comes to LDAP and A= D. The
> ActiveDirectoryRealm.hasRole() call, does that work against a Role or = a
> Group? If the former, is there a way to do checks against Group member= ship
> from SecurityManager? I'm having issues having hasRole work agains= t an AD
> instance and I find myself to be a bit stuck due to lack of knowledge = of
> both AD/LDAP and Shiro's role/permission support.
>
> Thanks
> John



--f46d0402aeef48590c04d2caaf2b--