如何將LDAP用戶與Spring Security在Grails中創建的PERSON表集成？

Question

我們正在創建一個grails應用程序，我們希望用戶使用他們的Active Directory憑據登錄。此外，我們希望賦予此應用程序的業主擁有控制訪問某些鏈接（操作）的權限的能力。正因爲如此，我們正在使用我們的Grails應用程序的插件如下：

1. Spring Security的核心
2. Spring Security的LDAP
3. Spring Security的UI

因爲我們要賦予企業用戶在必要時創建具有特定權限（動作）的定製角色，我們認爲最好的Spring Security配置是基於請求映射數據庫的方法

到目前爲止，我們已經完成如下：

• 我們能夠對Active Directory身份驗證成功。
• 我們還能夠通過彈簧安全的UI插件的UI界面來創建不同的角色（ROLE_XXX）不同的請求映射

問題/問題

彈簧安全-core插件創建以下表：

• PERSON
• AUTHORITY
• PERSON_AUTHORITY
• REQUESTMAP

這些是支持創建角色，網址進行角色分配表。然而，作爲約定名稱的Person_Authoritity表意味着它是PERSON和AUTHORITY（ROLE）之間的多對多關係，因爲一個人可能具有多個角色。我的問題是我沒有Person，因爲這個人已經存在於Active Directory（外部源）中，並且它沒有在應用程序中創建。

有沒有辦法讓認證用戶成爲PERSON？彈簧安全解決方案要求使用Person行或對象，但是您更願意引用它。

我也張貼了問題在這裏：

http://grails.1312388.n4.nabble.com/Issues-integrating-LDAP-Authentication-with-Requestmap-to-Secure-URLs-td4644040.html

感謝，

Answer 1

所以，你需要基本映射AD用戶到某個人。

以下是您在src/groovy中需要的3個類。顯然根據需要修改它們：

package yourpackagename 

    import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUser 
    import org.springframework.security.core.GrantedAuthority 

    class CustomUserDetails extends GrailsUser{ 
     final String firstName 
     final String lastName 

     CustomUserDetails(String username, String password, boolean enabled, 
          boolean accountNonExpired, boolean credentialsNonExpired, 
          boolean accountNonLocked, 
          Collection<GrantedAuthority> authorities, 
          long id, String firstName, String lastName) { 
      super(username, password, enabled, accountNonExpired, 
        credentialsNonExpired, accountNonLocked, authorities, id) 

      this.firstName = firstName 
      this.lastName = lastName 
     } 
    } 

package yourpackagenamehere 

import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUserDetailsService 
import org.springframework.security.core.authority.GrantedAuthorityImpl 
import org.springframework.security.core.userdetails.UserDetails 
import org.springframework.security.core.userdetails.UsernameNotFoundException 
import org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils 

class CustomUserDetailsService implements GrailsUserDetailsService { 

    /** 
    * Some Spring Security classes (e.g. RoleHierarchyVoter) expect at least one role, so 
    * we give a user with no granted roles this one which gets past that restriction but 
    * doesn't grant anything. 
    */ 
    static final List NO_ROLES = [new GrantedAuthorityImpl(SpringSecurityUtils.NO_ROLE)] 

    UserDetails loadUserByUsername(String username, boolean loadRoles) 
    throws UsernameNotFoundException { 
     return loadUserByUsername(username) 
    } 

    UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { 

     User.withTransaction { status -> 

      User user = User.findByUsername(username) 
      if (!user) throw new UsernameNotFoundException('User not found', username) 

      def authorities = user.authorities.collect {new GrantedAuthorityImpl(it.authority)} 

      return new CustomUserDetails(user.username, user.password, user.enabled, 
        !user.accountExpired, !user.passwordExpired, 
        !user.accountLocked, authorities ?: NO_ROLES, user.id, 
        user.firstName, user.lastName) 
     } as UserDetails 
    } 
} 

package yourpackagenamehere 

import groovy.sql.Sql 

import org.springframework.ldap.core.DirContextAdapter 
import org.springframework.ldap.core.DirContextOperations 
import org.springframework.security.core.userdetails.UserDetails 
import org.springframework.security.ldap.userdetails.UserDetailsContextMapper 
import org.springframework.security.core.authority.GrantedAuthorityImpl 
import org.springframework.security.core.GrantedAuthority 
import org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils 

import org.springframework.security.core.userdetails.UsernameNotFoundException 
import org.springframework.security.authentication.DisabledException 

class CustomUserDetailsContextMapper implements UserDetailsContextMapper { 

    private static final List NO_ROLES = [new GrantedAuthorityImpl(SpringSecurityUtils.NO_ROLE)] 

    def dataSource 

    @Override 
    public CustomUserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection<GrantedAuthority> authority) { 

     username = username.toLowerCase() 

     User user = User.findByUsername(username) 

     String firstName = ctx.originalAttrs.attrs['givenname'].values[0] 
     String lastName = ctx.originalAttrs.attrs['sn'].values[0] 


     def roles 

     User.withTransaction { 

      if(!user){ 
       user = new User(username: username, enabled: true, firstName: firstName, lastName: lastName) 
       user.save(flush: true) 
      } 
      else { 
       user = User.findByUsername(username) 
       user.firstName = firstName 
       user.lastName = lastName 
       user.save(flush: true) 
      } 

      roles = user.getAuthorities() 
     } 

     if (!user.enabled) 
      throw new DisabledException("User is disabled", username) 


     def authorities = roles.collect { new GrantedAuthorityImpl(it.authority) } 
     authorities.addAll(authority) 
     def userDetails = new CustomUserDetails(username, user.password, user.enabled, false, false, false, authorities, user.id, user.firstName, user.lastName) 

     return userDetails 
    } 

    @Override 
    public void mapUserToContext(UserDetails arg0, DirContextAdapter arg1) { 
    } 
} 

在spring/resources中的配置下。常規：

import yourpackagenamehere.CustomUserDetailsService 
import yourpackagenamehere.CustomUserDetailsContextMapper 
beans = { 
    userDetailsService(CustomUserDetailsService) 

    ldapUserDetailsMapper(CustomUserDetailsContextMapper) { 
     dataSource = ref("dataSource") 
    } 
} 

在Config.groovy中，這裏是我的設置：

grails.plugins.springsecurity.ldap.context.managerDn = 'CN=username,OU=People,DC=foo,DC=com' 
grails.plugins.springsecurity.ldap.context.managerPassword = 'password' 
grails.plugins.springsecurity.ldap.context.server = 'ldap://foo.com:389/' 
grails.plugins.springsecurity.ldap.authorities.ignorePartialResultException = true 
grails.plugins.springsecurity.ldap.search.base = 'ou=People,dc=foo,dc=com' 
grails.plugins.springsecurity.ldap.search.filter="sAMAccountName={0}" 
grails.plugins.springsecurity.ldap.search.searchSubtree = true 
grails.plugins.springsecurity.ldap.auth.hideUserNotFoundExceptions = false 
grails.plugins.springsecurity.ldap.search.attributesToReturn = null 
grails.plugins.springsecurity.providerNames = ['ldapAuthProvider', 'anonymousAuthenticationProvider'] 
grails.plugins.springsecurity.ldap.mapper.userDetailsClass = 'CustomUserDetails' 

grails.plugins.springsecurity.ldap.authorities.retrieveGroupRoles = true 
grails.plugins.springsecurity.ldap.authorities.retrieveDatabaseRoles = true 
grails.plugins.springsecurity.ldap.authorities.groupSearchBase ='dc=foo,dc=com' 
grails.plugins.springsecurity.ldap.authorities.groupSearchFilter = 'member={0}'