如何獲取彈簧安全中的所有LDAP組

Question

如何獲取所有Active Directory組（不僅與當前用戶有關）？我正在使用spring security ldap。你能提供一些例子嗎？

Answer 1

檢查這個接口： http://static.springsource.org/spring-security/site/docs/3.1.x/apidocs/org/springframework/security/ldap/userdetails/LdapAuthoritiesPopulator.html

這個類默認：

http://static.springsource.org/spring-security/site/docs/3.1.x/apidocs/org/springframework/security/ldap/userdetails/DefaultLdapAuthoritiesPopulator.html

它可以幫助

Answer 2

你可以做的是寫LdapAuthoritiesPopulator實現了DefaultLdapAuthoritiesPopulator匹配實現一個額外的方法來檢索所有角色。

public class ExtendedLdapAuthoritiesPopulator 
     implements LdapAuthoritiesPopulator { 

    // Copy implementation of DefaultLdapAuthoritiesPopulator (omitted). 

    private String allAuthorityFilter 
     = "(&(objectClass=group)(objectCategory=group))"; 
    public void setAllAuthorityFilter(String allAuthorityFilter) { 
     Assert.notNull(allAuthorityFilter, 
         "allAuthorityFilter must not be null"); 
     this.allAuthorityFilter = allAuthorityFilter; 
    } 

    public final Collection<GrantedAuthority> getAllAuthorities() { 
     if (groupSearchBase == null) { 
      return new HashSet<>(); 
     } 
     Set<GrantedAuthority> authorities = new HashSet<>(); 
     if (logger.isDebugEnabled()) { 
      logger.debug("Searching for all roles with filter '" 
         + allAuthorityFilter + "' in search base '" 
         + groupSearchBase + "'"); 
     } 
     Set<String> roles = ldapTemplate.searchForSingleAttributeValues(
       groupSearchBase, 
       allAuthorityFilter, 
       new String[0], 
       groupRoleAttribute); 
     if (logger.isDebugEnabled()) { 
      logger.debug("Roles from search: " + roles); 
     } 
     for (String role : roles) { 
      if (convertToUpperCase) { 
       role = role.toUpperCase(); 
      } 
      authorities.add(new SimpleGrantedAuthority(rolePrefix + role)); 
     } 
     return authorities; 
    } 

} 

在您的spring安全配置中，將DefaultLdapAuthoritiesPopulator更改爲您的新實現。

一個附加屬性可以設置AllAuthorityFilter哪些過濾哪些組將被返回。

您可能更喜歡您的實現只檢索基於String的角色名稱而不是GrantedAuthority實例。