From eb1264b0944cfc0ac951c62239cc5a85428088e0 Mon Sep 17 00:00:00 2001 From: Alfred Schmid Date: Fri, 31 Jan 2014 12:29:55 +0100 Subject: [PATCH] Basic implementation of feature for ldap user synchronization as background service. Introduced configuration property to configure the synchronization period. --- src/main/distrib/data/gitblit.properties | 10 +++ .../com/gitblit/auth/LdapAuthProvider.java | 31 ++++++++- .../com/gitblit/service/LdapSyncService.java | 64 +++++++++++++++++++ src/test/config/test-users.conf | 5 ++ .../gitblit/tests/LdapAuthenticationTest.java | 43 ++++++++++++- src/test/resources/ldap/adduser.ldif | 11 ++++ src/test/resources/ldap/users.conf | 19 +++++- 7 files changed, 177 insertions(+), 6 deletions(-) create mode 100644 src/main/java/com/gitblit/service/LdapSyncService.java create mode 100644 src/test/resources/ldap/adduser.ldif diff --git a/src/main/distrib/data/gitblit.properties b/src/main/distrib/data/gitblit.properties index 482a8353..d1b0e4bd 100644 --- a/src/main/distrib/data/gitblit.properties +++ b/src/main/distrib/data/gitblit.properties @@ -1508,6 +1508,16 @@ realm.ldap.ldapCachePeriod = 2 MINUTES # If left blank, false is assumed realm.ldap.synchronizeUsers.enable = false +# Defines the period to be used when synchronizing users from ldap. This is currently +# only used for LDAP user synchronization. +# +# Must be of the form ' ' where is one of 'MILLISECONDS', 'SECONDS', 'MINUTES', 'HOURS', 'DAYS' +# is at least 5 Minutes if lower values are given the default is used. +# default: 5 MINUTES +# +# RESTART REQUIRED +realm.ldap.synchronizeUsers.ldapSyncPeriod = 5 MINUTES + # Defines whether to delete non-existent LDAP users from the backing user service # during synchronization. depends on realm.ldap.synchronizeUsers.enable = true # diff --git a/src/main/java/com/gitblit/auth/LdapAuthProvider.java b/src/main/java/com/gitblit/auth/LdapAuthProvider.java index 8fef620d..58fb8219 100644 --- a/src/main/java/com/gitblit/auth/LdapAuthProvider.java +++ b/src/main/java/com/gitblit/auth/LdapAuthProvider.java @@ -23,6 +23,8 @@ import java.util.Arrays; import java.util.HashMap; import java.util.List; import java.util.Map; +import java.util.concurrent.Executors; +import java.util.concurrent.ScheduledExecutorService; import java.util.concurrent.TimeUnit; import java.util.concurrent.atomic.AtomicLong; @@ -32,8 +34,10 @@ import com.gitblit.Keys; import com.gitblit.auth.AuthenticationProvider.UsernamePasswordAuthenticationProvider; import com.gitblit.models.TeamModel; import com.gitblit.models.UserModel; +import com.gitblit.service.LdapSyncService; import com.gitblit.utils.ArrayUtils; import com.gitblit.utils.StringUtils; +import com.gitblit.utils.TimeUtils; import com.unboundid.ldap.sdk.Attribute; import com.unboundid.ldap.sdk.DereferencePolicy; import com.unboundid.ldap.sdk.ExtendedResult; @@ -57,7 +61,7 @@ import com.unboundid.util.ssl.TrustAllTrustManager; */ public class LdapAuthProvider extends UsernamePasswordAuthenticationProvider { - private AtomicLong lastLdapUserSync = new AtomicLong(0L); + private final AtomicLong lastLdapUserSync = new AtomicLong(0L); public LdapAuthProvider() { super("ldap"); @@ -78,6 +82,11 @@ public class LdapAuthProvider extends UsernamePasswordAuthenticationProvider { @Override public void setup() { synchronizeLdapUsers(); + configureLdapSyncService(); + } + + public void synchronizeWithLdapService() { + synchronizeLdapUsers(); } protected synchronized void synchronizeLdapUsers() { @@ -519,4 +528,24 @@ public class LdapAuthProvider extends UsernamePasswordAuthenticationProvider { } return sb.toString(); } + + private void configureLdapSyncService() { + logger.info("Start configuring ldap sync service"); + LdapSyncService ldapSyncService = new LdapSyncService(settings, this); + if (ldapSyncService.isReady()) { + int mins = TimeUtils.convertFrequencyToMinutes(settings.getString(Keys.realm.ldap.synchronizeUsers.ldapSyncPeriod, "5 mins")); + if (mins < 5) { + mins = 5; + } + int delay = 1; + ScheduledExecutorService scheduledExecutorService = Executors.newSingleThreadScheduledExecutor(); + scheduledExecutorService.scheduleAtFixedRate(ldapSyncService, delay, mins, TimeUnit.MINUTES); + logger.info("Ldap sync service will update user and groups every {} minutes.", mins); + logger.info("Next scheduled ldap sync is in {} minutes", delay); + } else { + logger.info("Ldap sync service is disabled."); + } + logger.info("Finished configuring ldap sync service"); + } + } diff --git a/src/main/java/com/gitblit/service/LdapSyncService.java b/src/main/java/com/gitblit/service/LdapSyncService.java new file mode 100644 index 00000000..84d478aa --- /dev/null +++ b/src/main/java/com/gitblit/service/LdapSyncService.java @@ -0,0 +1,64 @@ +/* + * Copyright 2013 gitblit.com. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package com.gitblit.service; + +import java.util.concurrent.atomic.AtomicBoolean; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import com.gitblit.IStoredSettings; +import com.gitblit.Keys; +import com.gitblit.auth.LdapAuthProvider; + +/** + * @author Alfred Schmid + * + */ +public final class LdapSyncService implements Runnable { + + private final Logger logger = LoggerFactory.getLogger(LdapSyncService.class); + + private final IStoredSettings settings; + + private final LdapAuthProvider ldapAuthProvider; + + private final AtomicBoolean running = new AtomicBoolean(false); + + public LdapSyncService(IStoredSettings settings, LdapAuthProvider ldapAuthProvider) { + this.settings = settings; + this.ldapAuthProvider = ldapAuthProvider; + } + + /** + * + * @see java.lang.Runnable#run() + */ + @Override + public void run() { + logger.info("Starting user and group sync with ldap service"); + if (!running.getAndSet(true)) { + ldapAuthProvider.synchronizeWithLdapService(); + running.getAndSet(false); + } + logger.info("Finished user and group sync with ldap service"); + } + + public boolean isReady() { + return settings.getBoolean(Keys.realm.ldap.synchronizeUsers.enable, false); + } + +} diff --git a/src/test/config/test-users.conf b/src/test/config/test-users.conf index 59b6df49..1d01f846 100644 --- a/src/test/config/test-users.conf +++ b/src/test/config/test-users.conf @@ -4,6 +4,11 @@ accountType = LOCAL role = "#admin" role = "#notfederated" +[user "sampleuser"] + password = sampleuser + cookie = 6e07ed42149fc166206319faffdfba2e2ec82e43 + accountType = LOCAL + role = "#none" [team "admins"] role = "#none" accountType = LOCAL diff --git a/src/test/java/com/gitblit/tests/LdapAuthenticationTest.java b/src/test/java/com/gitblit/tests/LdapAuthenticationTest.java index 3cd2dc72..4c78643d 100644 --- a/src/test/java/com/gitblit/tests/LdapAuthenticationTest.java +++ b/src/test/java/com/gitblit/tests/LdapAuthenticationTest.java @@ -24,8 +24,10 @@ import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; +import com.gitblit.Constants.AccountType; import com.gitblit.IStoredSettings; import com.gitblit.auth.LdapAuthProvider; +import com.gitblit.manager.IUserManager; import com.gitblit.manager.RuntimeManager; import com.gitblit.manager.UserManager; import com.gitblit.models.UserModel; @@ -33,6 +35,8 @@ import com.gitblit.tests.mock.MemorySettings; import com.unboundid.ldap.listener.InMemoryDirectoryServer; import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig; import com.unboundid.ldap.listener.InMemoryListenerConfig; +import com.unboundid.ldap.sdk.SearchResult; +import com.unboundid.ldap.sdk.SearchScope; import com.unboundid.ldif.LDIFReader; /** @@ -50,6 +54,10 @@ public class LdapAuthenticationTest extends GitblitUnitTest { static int ldapPort = 1389; + private static InMemoryDirectoryServer ds; + + private IUserManager userManager; + @BeforeClass public static void createInMemoryLdapServer() throws Exception { InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig("dc=MyDomain"); @@ -57,7 +65,7 @@ public class LdapAuthenticationTest extends GitblitUnitTest { config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("default", ldapPort)); config.setSchema(null); - InMemoryDirectoryServer ds = new InMemoryDirectoryServer(config); + ds = new InMemoryDirectoryServer(config); ds.importFromLDIF(true, new LDIFReader(new FileInputStream(RESOURCE_DIR + "sampledata.ldif"))); ds.startListening(); } @@ -69,9 +77,9 @@ public class LdapAuthenticationTest extends GitblitUnitTest { public LdapAuthProvider newLdapAuthentication(IStoredSettings settings) { RuntimeManager runtime = new RuntimeManager(settings, GitBlitSuite.BASEFOLDER).start(); - UserManager users = new UserManager(runtime).start(); + userManager = new UserManager(runtime).start(); LdapAuthProvider ldap = new LdapAuthProvider(); - ldap.setup(runtime, users); + ldap.setup(runtime, userManager); return ldap; } @@ -91,6 +99,9 @@ public class LdapAuthenticationTest extends GitblitUnitTest { backingMap.put("realm.ldap.admins", "UserThree @Git_Admins \"@Git Admins\""); backingMap.put("realm.ldap.displayName", "displayName"); backingMap.put("realm.ldap.email", "email"); + backingMap.put("realm.ldap.synchronizeUsers.enable", "true"); + backingMap.put("realm.ldap.uid", "sAMAccountName"); + backingMap.put("realm.ldap.ldapCachePeriod", "0 MINUTES"); MemorySettings ms = new MemorySettings(backingMap); return ms; @@ -162,4 +173,30 @@ public class LdapAuthenticationTest extends GitblitUnitTest { assertNull(userOneModel); } + @Test + public void checkIfSevenUsersLoadedFromLdap() throws Exception { + SearchResult searchResult = ds.search("OU=Users,OU=UserControl,OU=MyOrganization,DC=MyDomain", SearchScope.SUB, "objectClass=person"); + assertEquals("Number of ldap users in gitblit user model", searchResult.getEntryCount(), countLdapUsersInUserManager()); + } + + @Test + public void addingUserInLdapShouldUpdateGitBlitUsersAndGroups() throws Exception { + ds.addEntries(LDIFReader.readEntries(RESOURCE_DIR + "adduser.ldif")); + for(String user : userManager.getAllUsernames()) { + System.out.println(user); + } + ldap.synchronizeWithLdapService(); + assertEquals("Number of ldap users in gitblit user model", 5, countLdapUsersInUserManager()); + } + + private int countLdapUsersInUserManager() { + int ldapAccountCount = 0; + for (UserModel userModel : userManager.getAllUsers()) { + if (AccountType.LDAP.equals(userModel.accountType)) { + ldapAccountCount++; + } + } + return ldapAccountCount; + } + } diff --git a/src/test/resources/ldap/adduser.ldif b/src/test/resources/ldap/adduser.ldif new file mode 100644 index 00000000..e7e3520b --- /dev/null +++ b/src/test/resources/ldap/adduser.ldif @@ -0,0 +1,11 @@ +dn: CN=UserFive,OU=Canada,OU=Users,OU=UserControl,OU=MyOrganization,DC=MyDomain +objectClass: user +objectClass: person +sAMAccountName: UserFive +userPassword: userFivePassword +displayName: User Five +givenName: User +surname: Five +personalTitle: Miss +email: userfive@gitblit.com +memberOf: CN=Git_Users,OU=Groups,OU=UserControl,OU=MyOrganization,DC=MyDomain \ No newline at end of file diff --git a/src/test/resources/ldap/users.conf b/src/test/resources/ldap/users.conf index b4b4a6ea..7d1e3197 100644 --- a/src/test/resources/ldap/users.conf +++ b/src/test/resources/ldap/users.conf @@ -7,10 +7,17 @@ [user "userthree"] password = "#externalAccount" cookie = d7d3894fc517612aa6c595555b6e1ab8e147e597 - displayName = User Three + displayName = Mrs. User Three emailAddress = userthree@gitblit.com accountType = LDAP role = "#admin" +[user "userfive"] + password = "#externalAccount" + cookie = 220bafef069b8b399b2597644015b6b0f4667982 + displayName = Miss. User Five + emailAddress = userfive@gitblit.com + accountType = LDAP + role = "#none" [user "userone"] password = "#externalAccount" cookie = c97cd38e50858cd0b389ec61b18fb9a89b4da54c @@ -21,7 +28,7 @@ [user "usertwo"] password = "#externalAccount" cookie = 498ca9bd2841d39050fa45d1d737b9f9f767858d - displayName = User Two + displayName = Mr. User Two emailAddress = usertwo@gitblit.com accountType = LDAP role = "#admin" @@ -37,6 +44,13 @@ cookie = dd94709528bb1c83d08f3088d4043f4742891f4f accountType = LOCAL role = "#create" +[user "userfour"] + password = "#externalAccount" + cookie = d4fca47ebc70f0495947f8b6158ac6edb546e2fe + displayName = Miss. User Four + emailAddress = userfour@gitblit.com + accountType = LDAP + role = "#none" [team "Git_Admins"] role = "#none" accountType = LOCAL @@ -47,6 +61,7 @@ user = userone user = usertwo user = userthree + user = userfour [team "Git Admins"] role = "#none" accountType = LOCAL -- 2.39.5