@Retention(value=RUNTIME) @Target(value=TYPE) public @interface LdapIdentityStoreDefinition
IdentityStore
that stores
caller credentials and identity attributes (together caller identities) in an
LDAP store, and make that implementation available as an enabled CDI bean.
The container-provided IdentityStore
must support validating UsernamePasswordCredential
,
and may support validating other credential types.
Modifier and Type | Optional Element and Description |
---|---|
String |
bindDn
Distinguished name for the application or administrative user that will be used to
make the initial connection to the LDAP and to perform searches and lookups.
|
String |
bindDnPassword
Password for the application/admin user defined by the bindDn member.
|
String |
callerBaseDn
Base distinguished name for callers in the LDAP store
(e.g., "
ou=caller,dc=jsr375,dc=net "). |
String |
callerNameAttribute
Name of the attribute that contains the callers name in the person object
(e.g., "
uid "). |
String |
callerSearchBase
Search base for looking up callers
(e.g., "
ou=caller,dc=jsr375,dc=net "). |
String |
callerSearchFilter
Search filter to find callers when callerSearchBase is set.
|
LdapIdentityStoreDefinition.LdapSearchScope |
callerSearchScope
Search scope for caller searches: determines depth
of the search in the LDAP tree.
|
String |
callerSearchScopeExpression
Allow callerSearchScope to be specified as an EL expression.
|
String |
groupMemberAttribute
Name of the attribute in a group object that identifies the
members of the group
(e.g., "
member "). |
String |
groupMemberOfAttribute
Name of the attribute in a person object that identifies the groups
the caller belongs to
(e.g., "
memberOf "). |
String |
groupNameAttribute
Name of the attribute of a group object that represents the group name
(e.g., "
cn ") |
String |
groupSearchBase
Search base for looking up groups
(e.g., "
ou=group,dc=jsr375,dc=net "). |
String |
groupSearchFilter
Search filter to find groups when groupSearchBase is set.
|
LdapIdentityStoreDefinition.LdapSearchScope |
groupSearchScope
Search scope for group searches, determines depth
of the search in the LDAP tree.
|
String |
groupSearchScopeExpression
Allow groupSearchScope to be specified as an EL expression.
|
int |
maxResults
Set the maximum number of results (objects) the server should
return in response to a search.
|
String |
maxResultsExpression
Allow maxResults to be specified as an EL expression.
|
int |
priority
Determines the order in case multiple IdentityStores are found.
|
String |
priorityExpression
Allow priority to be specified as an EL expression.
|
int |
readTimeout
Set the timeout value that should be used when waiting for
the LDAP server to return results.
|
String |
readTimeoutExpression
Allow readTimeout to be specified as an EL expression.
|
String |
url
URL where the LDAP server can be reached.
|
IdentityStore.ValidationType[] |
useFor
Determines what the identity store is used for
|
String |
useForExpression
Allow useFor to be specified as an EL expression.
|
public abstract String url
E.g.: ldap://localhost:33389
public abstract String bindDn
This value is needed if caller or group lookup will be done. It is not needed if the store will be used only to authenticate callers using direct binding (see callerBaseDn).
This user needs search permission in the LDAP for persons and/or groups.
E.g.: uid=ldap,ou=apps,dc=jsr375,dc=net
public abstract String bindDnPassword
public abstract String callerBaseDn
ou=caller,dc=jsr375,dc=net
").
When this member value is specified, and callerSearchBase is not, direct binding is attempted.
The callerNameAttribute must be specified along with this attribute so that the runtime can create the "leaf" RDN needed to concatenate with the base DN to create the full DN of the caller.
public abstract String callerNameAttribute
uid
").
This attribute will be used, with callerBaseDn, to construct caller DNs for direct binding. It is also used to retrieve the caller's name when the caller object is instead looked up using search.
The value of this attribute is returned as the caller principal name for a successful credential validation.
The following gives an example in ldif format:
dn: uid=peter,ou=caller,dc=jsr375,dc=net
objectclass: top
objectclass: uidObject
objectclass: person
uid: peter
cn: Peter Smith
sn: Peter
userPassword: secret1
public abstract String callerSearchBase
ou=caller,dc=jsr375,dc=net
").
Overrides callerBaseDn, if configured, causing caller search to be used instead of direct binding. Requires that the bindDn member be filled in.
public abstract String callerSearchFilter
public abstract LdapIdentityStoreDefinition.LdapSearchScope callerSearchScope
public abstract String callerSearchScopeExpression
public abstract String groupSearchBase
ou=group,dc=jsr375,dc=net
").
Needed only for a store that performs group lookup. Requires that the bindDn member be filled in.
public abstract String groupSearchFilter
public abstract LdapIdentityStoreDefinition.LdapSearchScope groupSearchScope
public abstract String groupSearchScopeExpression
public abstract String groupNameAttribute
cn
")public abstract String groupMemberAttribute
member
").
The value of this attribute must be the full DN of the caller. The following gives an example entry in ldif format:
dn: cn=foo,ou=group,dc=jsr375,dc=net
objectclass: top
objectclass: groupOfNames
cn: foo
member: uid=pete,ou=caller,dc=jsr375,dc=net
member: uid=john,ou=caller,dc=jsr375,dc=net
public abstract String groupMemberOfAttribute
memberOf
").
This attribute is used only if: a) group search is not configured
(i.e., no groupSearchBase and groupSearchFilter configured); and,
b) the caller's DN is available, either because groups are being returned
during the credential validation phase by an identity store that performs
both validation and group lookup, or because the DN is available in the
CredentialValidationResult
passed to the
IdentityStore.getCallerGroups(CredentialValidationResult)
method.
The value of this attribute must be the full DN of the group. The following gives an example entry in ldif format:
dn: uid=peter,ou=caller,dc=jsr375,dc=net
objectclass: top
objectclass: uidObject
objectclass: person
uid: peter
cn: Peter Smith
memberOf: cn=foo,ou=group,dc=jsr375,dc=net
memberOf: cn=bar,ou=group,dc=jsr375,dc=net
public abstract int readTimeout
The default value of 0 means wait forever (assuming the connection itself does not time out).
public abstract String readTimeoutExpression
public abstract int maxResults
The default value is set to 1000, which corresponds to the maximum number of results most LDAP servers will return for in a single response. Most LDAP servers support paging through result sets larger than 1000, but doing so should rarely be necessary for normal validation and group lookup use cases. Implementations of the built-in LDAP IdentityStore MAY support paging through larger result sets, but are NOT REQUIRED to.
public abstract String maxResultsExpression
public abstract int priority
public abstract String priorityExpression
public abstract IdentityStore.ValidationType[] useFor
public abstract String useForExpression
Copyright © 1996-2017, Oracle and/or its affiliates. All Rights Reserved. Use is subject to license terms.