container-common/src/main/java/com/streamsets/datacollector/http/LdapLoginModule.java
@Override
  public boolean login() throws LoginException
  {
    try
    {
      if (getCallbackHandler() == null)
      {
        throw new LoginException("No callback handler");
      }
      if (conn == null){
        return false;
      }

      Callback[] callbacks = configureCallbacks();
      getCallbackHandler().handle(callbacks);

      String webUserName = ((NameCallback) callbacks[0]).getName();
      Object webCredential = ((ObjectCallback) callbacks[1]).getObject();

      if (webUserName == null || webCredential == null)
      {
        setAuthenticated(false);
        return isAuthenticated();
      }

      // Please see the following stackoverflow article
      // http://security.stackexchange.com/questions/6713/ldap-security-problems
      // Some LDAP implementation "MAY" accept empty password as a sign of anonymous connection and thus
      // return "true" for the authentication request.
      if((webCredential instanceof String) && ((String)webCredential).isEmpty()) {
        LOG.info("Ignoring login request for user {} as the password is empty.", webUserName);
        setAuthenticated(false);
        return isAuthenticated();
      }
      if (_forceBindingLogin)
      {
        return bindingLogin(webUserName, webCredential);
      }

      // This sets read and the credential
      UserInfo userInfo = getUserInfo(webUserName);

      if (userInfo == null)
      {
        setAuthenticated(false);
        return false;
      }

      JAASUserInfo jaasUserInfo = new JAASUserInfo(userInfo);
      jaasUserInfo.fetchRoles();
      setCurrentUser(jaasUserInfo);

      if (webCredential instanceof String)
      {
        return credentialLogin(Credential.getCredential((String) webCredential));
      }

      return credentialLogin(webCredential);
    }
    catch (UnsupportedCallbackException e)
    {
      throw new LoginException("Error obtaining callback information.");
    }
    catch (IOException e)
    {
      LOG.error("IO Error performing login", e);
    }
    catch (Exception e)
    {
      LOG.error("IO Error performing login", e);
    }
    return false;
  }
@Override
  public boolean login() throws LoginException
  {
    try
    {
      if (getCallbackHandler() == null)
      {
        throw new LoginException("No callback handler");
      }
      if (conn == null){
        return false;
      }

      Callback[] callbacks = configureCallbacks();
      getCallbackHandler().handle(callbacks);

      String webUserName = ((NameCallback) callbacks[0]).getName();
      Object webCredential = ((ObjectCallback) callbacks[1]).getObject();

      if (webUserName == null || webCredential == null)
      {
        setAuthenticated(false);
        return isAuthenticated();
      }

      // Please see the following stackoverflow article
      // http://security.stackexchange.com/questions/6713/ldap-security-problems
      // Some LDAP implementation "MAY" accept empty password as a sign of anonymous connection and thus
      // return "true" for the authentication request.
      if((webCredential instanceof String) && ((String)webCredential).isEmpty()) {
        LOG.info("Ignoring login request for user {} as the password is empty.", webUserName);
        setAuthenticated(false);
        return isAuthenticated();
      }
      if (_forceBindingLogin)
      {
        return bindingLogin(webUserName, webCredential);
      }

      // This sets read and the credential
      UserInfo userInfo = getUserInfo(webUserName);

      if (userInfo == null)
      {
        setAuthenticated(false);
        return false;
      }

      JAASUserInfo jaasUserInfo = new JAASUserInfo(userInfo);
      jaasUserInfo.fetchRoles();
      setCurrentUser(jaasUserInfo);

      if (webCredential instanceof String)
      {
        return credentialLogin(Credential.getCredential((String) webCredential));
      }

      return credentialLogin(webCredential);
    }
    catch (UnsupportedCallbackException e)
    {
      throw new LoginException("Error obtaining callback information.");
    }
    catch (IOException e)
    {
      LOG.error("IO Error performing login", e);
    }
    catch (Exception e)
    {
      LOG.error("IO Error performing login", e);
    }
    return false;
  }
@ Override public boolean login ( ) throws LoginException { try { if ( getCallbackHandler ( ) == null ) { throw new LoginException ( "No callback handler" ) ; } if ( conn == null ) { return false ; } Callback [ ] callbacks = configureCallbacks ( ) ; getCallbackHandler ( ) . handle ( callbacks ) ; String webUserName = ( ( NameCallback ) callbacks [ 0 ] ) . getName ( ) ; Object webCredential = ( ( ObjectCallback ) callbacks [ 1 ] ) . getObject ( ) ; if ( webUserName == null || webCredential == null ) { setAuthenticated ( false ) ; return isAuthenticated ( ) ; } // Please see the following stackoverflow article // http://security.stackexchange.com/questions/6713/ldap-security-problems // Some LDAP implementation "MAY" accept empty password as a sign of anonymous connection and thus // return "true" for the authentication request. if ( ( webCredential instanceof String ) && ( ( String ) webCredential ) . isEmpty ( ) ) { LOG . info ( "Ignoring login request for user {} as the password is empty." , webUserName ) ; setAuthenticated ( false ) ; return isAuthenticated ( ) ; } if ( _forceBindingLogin ) { return bindingLogin ( webUserName , webCredential ) ; } // This sets read and the credential UserInfo userInfo = getUserInfo ( webUserName ) ; if ( userInfo == null ) { setAuthenticated ( false ) ; return false ; } JAASUserInfo jaasUserInfo = new JAASUserInfo ( userInfo ) ; jaasUserInfo . fetchRoles ( ) ; setCurrentUser ( jaasUserInfo ) ; if ( webCredential instanceof String ) { return credentialLogin ( Credential . getCredential ( ( String ) webCredential ) ) ; } return credentialLogin ( webCredential ) ; } catch ( UnsupportedCallbackException e ) { throw new LoginException ( "Error obtaining callback information." ) ; } catch ( IOException e ) { LOG . error ( "IO Error performing login" , e ) ; } catch ( Exception e ) { LOG . error ( "IO Error performing login" , e ) ; } return false ; }
since ldap uses a context bind for valid authentication checking, we override login()
<p/>
if credentials are not available from the users context or if we are forcing the binding check
then we try a binding authentication check, otherwise if we have the users encoded password then
we can try authentication via that mechanic

@return true if authenticated, false otherwise
@throws LoginException
since ldap uses a context bind for valid authentication checking we override login () <p / > if credentials are not available from the users context or if we are forcing the binding check then we try a binding authentication check otherwise if we have the users encoded password then we can try authentication via that mechanic