|
| 1 | +package org.keycloak.storage.ldap; |
| 2 | + |
| 3 | +import java.util.Hashtable; |
| 4 | +import java.util.List; |
| 5 | +import javax.naming.CommunicationException; |
| 6 | +import javax.naming.Context; |
| 7 | +import javax.naming.Name; |
| 8 | +import javax.naming.NamingException; |
| 9 | +import javax.naming.RefAddr; |
| 10 | +import javax.naming.Reference; |
| 11 | +import javax.naming.ldap.LdapContext; |
| 12 | +import javax.naming.spi.NamingManager; |
| 13 | +import javax.naming.spi.ObjectFactory; |
| 14 | + |
| 15 | +import org.jboss.logging.Logger; |
| 16 | +import org.keycloak.storage.ldap.idm.store.ldap.SessionBoundInitialLdapContext; |
| 17 | +import org.keycloak.utils.KeycloakSessionUtil; |
| 18 | + |
| 19 | +/** |
| 20 | + * <p>A {@link javax.naming.spi.ObjectFactoryBuilder} implementation to filter out referral references if they do not |
| 21 | + * point to an LDAP URL. |
| 22 | + * |
| 23 | + * <p>When the LDAP provider encounters a referral, it tries to create an {@link ObjectFactory} from this builder. |
| 24 | + * If the referral reference contains an LDAP URL, a {@link DirContextObjectFactory} is created to handle the referral. |
| 25 | + * Otherwise, a {@link CommunicationException} is thrown to indicate that the referral cannot be processed. |
| 26 | + */ |
| 27 | +final class ObjectFactoryBuilder implements javax.naming.spi.ObjectFactoryBuilder, ObjectFactory { |
| 28 | + |
| 29 | + private static final Logger logger = Logger.getLogger(ObjectFactoryBuilder.class); |
| 30 | + private static final String IS_KC_OBJECT_FACTORY_BUILDER = "kc.jndi.object.factory.builder"; |
| 31 | + |
| 32 | + static boolean isSet() { |
| 33 | + Hashtable<Object, Object> env = new Hashtable<>(); |
| 34 | + |
| 35 | + env.put(ObjectFactoryBuilder.IS_KC_OBJECT_FACTORY_BUILDER, Boolean.TRUE); |
| 36 | + |
| 37 | + try { |
| 38 | + Object instance = NamingManager.getObjectInstance(null, null, null, env); |
| 39 | + |
| 40 | + if (instance != null && instance.getClass().getName().equals(ObjectFactoryBuilder.class.getName())) { |
| 41 | + return true; |
| 42 | + } |
| 43 | + } catch (Exception e) { |
| 44 | + throw new RuntimeException("Failed to determine if ObjectFactoryBuilder is set", e); |
| 45 | + } |
| 46 | + |
| 47 | + return false; |
| 48 | + } |
| 49 | + |
| 50 | + @Override |
| 51 | + public ObjectFactory createObjectFactory(Object obj, Hashtable<?, ?> environment) throws NamingException { |
| 52 | + if (logger.isTraceEnabled()) { |
| 53 | + logger.tracef("Creating ObjectFactory for object: %s", obj); |
| 54 | + } |
| 55 | + |
| 56 | + if (obj instanceof Reference ref) { |
| 57 | + String factoryClassName = ref.getFactoryClassName(); |
| 58 | + |
| 59 | + if (factoryClassName != null) { |
| 60 | + logger.warnf("Referral refence contains an object factory %s but it will be ignored", factoryClassName); |
| 61 | + } |
| 62 | + |
| 63 | + String ldapUrl = getLdapUrl(ref); |
| 64 | + |
| 65 | + if (ldapUrl != null) { |
| 66 | + return new DirContextObjectFactory(ldapUrl); |
| 67 | + } |
| 68 | + } else { |
| 69 | + logger.debugf("Unsupported reference object of type %s: ", obj); |
| 70 | + return this; |
| 71 | + } |
| 72 | + |
| 73 | + throw new CommunicationException("Referral reference does not contain an LDAP URL: " + obj); |
| 74 | + } |
| 75 | + |
| 76 | + @Override |
| 77 | + public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> env) { |
| 78 | + if (env != null && env.containsKey(IS_KC_OBJECT_FACTORY_BUILDER)) { |
| 79 | + return this; |
| 80 | + } |
| 81 | + return obj; |
| 82 | + } |
| 83 | + |
| 84 | + private String getLdapUrl(Reference ref) { |
| 85 | + for (int i = 0; i < ref.size(); i++) { |
| 86 | + RefAddr addr = ref.get(i); |
| 87 | + String addrType = addr.getType(); |
| 88 | + |
| 89 | + if ("URL".equalsIgnoreCase(addrType)) { |
| 90 | + Object content = addr.getContent(); |
| 91 | + |
| 92 | + if (content == null) { |
| 93 | + return null; |
| 94 | + } |
| 95 | + |
| 96 | + String rawUrl = content.toString(); |
| 97 | + |
| 98 | + for (String url : List.of(rawUrl.split(" "))) { |
| 99 | + if (!url.toLowerCase().startsWith("ldap")) { |
| 100 | + logger.warnf("Unsupported scheme from reference URL %s. Ignoring reference.", url); |
| 101 | + return null; |
| 102 | + } |
| 103 | + } |
| 104 | + |
| 105 | + return rawUrl; |
| 106 | + } else { |
| 107 | + logger.warnf("Ignoring address of type '%s' from referral reference", addrType); |
| 108 | + } |
| 109 | + } |
| 110 | + |
| 111 | + return null; |
| 112 | + } |
| 113 | + |
| 114 | + private record DirContextObjectFactory(String ldapUrl) implements ObjectFactory { |
| 115 | + |
| 116 | + @Override |
| 117 | + public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> env) throws Exception { |
| 118 | + @SuppressWarnings("unchecked") |
| 119 | + Hashtable<Object, Object> newEnv = (Hashtable<Object, Object>) env.clone(); |
| 120 | + newEnv.put(LdapContext.PROVIDER_URL, ldapUrl); |
| 121 | + return new SessionBoundInitialLdapContext(KeycloakSessionUtil.getKeycloakSession(), newEnv, null); |
| 122 | + } |
| 123 | + } |
| 124 | +} |
0 commit comments