path: root/src/main/java/com/gitblit/auth/LdapAuthProvider.java

/*
 * Copyright 2012 John Crygier
 * Copyright 2012 gitblit.com
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.gitblit.auth;

import java.net.URI;
import java.net.URISyntaxException;
import java.security.GeneralSecurityException;
import java.text.MessageFormat;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;

import com.gitblit.Constants;
import com.gitblit.Constants.AccountType;
import com.gitblit.Constants.Role;
import com.gitblit.Keys;
import com.gitblit.auth.AuthenticationProvider.UsernamePasswordAuthenticationProvider;
import com.gitblit.models.TeamModel;
import com.gitblit.models.UserModel;
import com.gitblit.service.LdapSyncService;
import com.gitblit.utils.ArrayUtils;
import com.gitblit.utils.StringUtils;
import com.unboundid.ldap.sdk.Attribute;
import com.unboundid.ldap.sdk.BindRequest;
import com.unboundid.ldap.sdk.BindResult;
import com.unboundid.ldap.sdk.DereferencePolicy;
import com.unboundid.ldap.sdk.ExtendedResult;
import com.unboundid.ldap.sdk.LDAPConnection;
import com.unboundid.ldap.sdk.LDAPException;
import com.unboundid.ldap.sdk.LDAPSearchException;
import com.unboundid.ldap.sdk.ResultCode;
import com.unboundid.ldap.sdk.SearchRequest;
import com.unboundid.ldap.sdk.SearchResult;
import com.unboundid.ldap.sdk.SearchResultEntry;
import com.unboundid.ldap.sdk.SearchScope;
import com.unboundid.ldap.sdk.SimpleBindRequest;
import com.unboundid.ldap.sdk.extensions.StartTLSExtendedRequest;
import com.unboundid.util.ssl.SSLUtil;
import com.unboundid.util.ssl.TrustAllTrustManager;

/**
 * Implementation of an LDAP user service.
 *
 * @author John Crygier
 */
public class LdapAuthProvider extends UsernamePasswordAuthenticationProvider {

	private final ScheduledExecutorService scheduledExecutorService;

	public LdapAuthProvider() {
		super("ldap");

		scheduledExecutorService = Executors.newSingleThreadScheduledExecutor();
	}

 	private long getSynchronizationPeriodInMilliseconds() {
 		String period = settings.getString(Keys.realm.ldap.syncPeriod, null);
 		if (StringUtils.isEmpty(period)) {
 	 		period = settings.getString("realm.ldap.ldapCachePeriod", null);
 	 		if (StringUtils.isEmpty(period)) {
 	 			period = "5 MINUTES";
 	 		} else {
 	 			logger.warn("realm.ldap.ldapCachePeriod is obsolete!");
 	 			logger.warn(MessageFormat.format("Please set {0}={1} in gitblit.properties!", Keys.realm.ldap.syncPeriod, period));
 	 			settings.overrideSetting(Keys.realm.ldap.syncPeriod, period);
 	 		}
 		}

        try {
            final String[] s = period.split(" ", 2);
            long duration = Math.abs(Long.parseLong(s[0]));
            TimeUnit timeUnit = TimeUnit.valueOf(s[1]);
            return timeUnit.toMillis(duration);
        } catch (RuntimeException ex) {
            throw new IllegalArgumentException(Keys.realm.ldap.syncPeriod + " must have format '<long> <TimeUnit>' where <TimeUnit> is one of 'MILLISECONDS', 'SECONDS', 'MINUTES', 'HOURS', 'DAYS'");
        }
    }

	@Override
	public void setup() {
		configureSyncService();
	}

	@Override
	public void stop() {
		scheduledExecutorService.shutdownNow();
	}

	public synchronized void sync() {
		final boolean enabled = settings.getBoolean(Keys.realm.ldap.synchronize, false);
		if (enabled) {
			logger.info("Synchronizing with LDAP @ " + settings.getRequiredString(Keys.realm.ldap.server));
			final boolean deleteRemovedLdapUsers = settings.getBoolean(Keys.realm.ldap.removeDeletedUsers, true);
			LdapConnection ldapConnection = new LdapConnection();
			if (ldapConnection.connect()) {
				if (ldapConnection.bind() == null) {
					ldapConnection.close();
					logger.error("Cannot synchronize with LDAP.");
					return;
				}

				try {
					String accountBase = settings.getString(Keys.realm.ldap.accountBase, "");
					String uidAttribute = settings.getString(Keys.realm.ldap.uid, "uid");
					String accountPattern = settings.getString(Keys.realm.ldap.accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");
					accountPattern = StringUtils.replace(accountPattern, "${username}", "*");

					SearchResult result = doSearch(ldapConnection, accountBase, accountPattern);
					if (result != null && result.getEntryCount() > 0) {
						final Map<String, UserModel> ldapUsers = new HashMap<String, UserModel>();

						for (SearchResultEntry loggingInUser : result.getSearchEntries()) {
							Attribute uid = loggingInUser.getAttribute(uidAttribute);
							if (uid == null) {
								logger.error("Can not synchronize with LDAP, missing \"{}\" attribute", uidAttribute);
								continue;
							}
							final String username = uid.getValue();
							logger.debug("LDAP synchronizing: " + username);

							UserModel user = userManager.getUserModel(username);
							if (user == null) {
								user = new UserModel(username);
							}

							if (!supportsTeamMembershipChanges()) {
								getTeamsFromLdap(ldapConnection, username, loggingInUser, user);
							}

							// Get User Attributes
							setUserAttributes(user, loggingInUser);

							// store in map
							ldapUsers.put(username.toLowerCase(), user);
						}

						if (deleteRemovedLdapUsers) {
							logger.debug("detecting removed LDAP users...");

							for (UserModel userModel : userManager.getAllUsers()) {
								if (AccountType.LDAP == userModel.accountType) {
									if (!ldapUsers.containsKey(userModel.username)) {
										logger.info("deleting removed LDAP user " + userModel.username + " from user service");
										userManager.deleteUser(userModel.username);
									}
								}
							}
						}

						userManager.updateUserModels(ldapUsers.values());

						if (!supportsTeamMembershipChanges()) {
							final Map<String, TeamModel> userTeams = new HashMap<String, TeamModel>();
							for (UserModel user : ldapUsers.values()) {
								for (TeamModel userTeam : user.teams) {
									// Is this an administrative team?
									setAdminAttribute(userTeam);
									userTeams.put(userTeam.name, userTeam);
								}
							}
							userManager.updateTeamModels(userTeams.values());
						}
					}
					if (!supportsTeamMembershipChanges()) {
						getEmptyTeamsFromLdap(ldapConnection);
					}
				} finally {
					ldapConnection.close();
				}
			}
		}
	}

	/**
	 * Credentials are defined in the LDAP server and can not be manipulated
	 * from Gitblit.
	 *
	 * @return false
	 * @since 1.0.0
	 */
	@Override
	public boolean supportsCredentialChanges() {
		return false;
	}

	/**
	 * If no displayName pattern is defined then Gitblit can manage the display name.
	 *
	 * @return true if Gitblit can manage the user display name
	 * @since 1.0.0
	 */
	@Override
	public boolean supportsDisplayNameChanges() {
		return StringUtils.isEmpty(settings.getString(Keys.realm.ldap.displayName, ""));
	}

	/**
	 * If no email pattern is defined then Gitblit can manage the email address.
	 *
	 * @return true if Gitblit can manage the user email address
	 * @since 1.0.0
	 */
	@Override
	public boolean supportsEmailAddressChanges() {
		return StringUtils.isEmpty(settings.getString(Keys.realm.ldap.email, ""));
	}

	/**
	 * If the LDAP server will maintain team memberships then LdapUserService
	 * will not allow team membership changes.  In this scenario all team
	 * changes must be made on the LDAP server by the LDAP administrator.
	 *
	 * @return true or false
	 * @since 1.0.0
	 */
	@Override
	public boolean supportsTeamMembershipChanges() {
		return !settings.getBoolean(Keys.realm.ldap.maintainTeams, false);
	}

    @Override
    public boolean supportsRoleChanges(UserModel user, Role role) {
    	if (Role.ADMIN == role) {
    		if (!supportsTeamMembershipChanges()) {
				return false;
    		}
    	}
        return true;
    }

	@Override
	public boolean supportsRoleChanges(TeamModel team, Role role) {
		if (Role.ADMIN == role) {
    		if (!supportsTeamMembershipChanges()) {
				return false;
    		}
    	}
		return true;
	}

	@Override
	public AccountType getAccountType() {
		 return AccountType.LDAP;
	}

	@Override
	public UserModel authenticate(String username, char[] password) {
		String simpleUsername = getSimpleUsername(username);

		LdapConnection ldapConnection = new LdapConnection();
		if (ldapConnection.connect()) {

			// Try to bind either to the "manager" account,
			// or directly to the DN of the user logging in, if realm.ldap.bindpattern is configured.
			String passwd = new String(password);
			BindResult bindResult = null;
			String bindPattern = settings.getString(Keys.realm.ldap.bindpattern, "");
			if (! StringUtils.isEmpty(bindPattern)) {
				bindResult = ldapConnection.bind(bindPattern, simpleUsername, passwd);
			} else {
				bindResult = ldapConnection.bind();
			}
			if (bindResult == null) {
				ldapConnection.close();
				return null;
			}


			try {
				// Find the logging in user's DN
				String accountBase = settings.getString(Keys.realm.ldap.accountBase, "");
				String accountPattern = settings.getString(Keys.realm.ldap.accountPattern, "(&(objectClass=person)(sAMAccountName=${username}))");
				accountPattern = StringUtils.replace(accountPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));

				SearchResult result = doSearch(ldapConnection, accountBase, accountPattern);
				if (result != null && result.getEntryCount() == 1) {
					SearchResultEntry loggingInUser = result.getSearchEntries().get(0);
					String loggingInUserDN = loggingInUser.getDN();

					if (ldapConnection.isAuthenticated(loggingInUserDN, passwd)) {
						logger.debug("LDAP authenticated: " + username);

						UserModel user = null;
						synchronized (this) {
							user = userManager.getUserModel(simpleUsername);
							if (user == null) {
								// create user object for new authenticated user
								user = new UserModel(simpleUsername);
							}

							// create a user cookie
							setCookie(user, password);

							if (!supportsTeamMembershipChanges()) {
								getTeamsFromLdap(ldapConnection, simpleUsername, loggingInUser, user);
							}

							// Get User Attributes
							setUserAttributes(user, loggingInUser);

							// Push the ldap looked up values to backing file
							updateUser(user);

							if (!supportsTeamMembershipChanges()) {
								for (TeamModel userTeam : user.teams) {
									// Is this an administrative team?
									setAdminAttribute(userTeam);
									updateTeam(userTeam);
								}
							}
						}

						return user;
					}
				}
			} finally {
				ldapConnection.close();
			}
		}
		return null;
	}

	/**
	 * Set the admin attribute from team memberships retrieved from LDAP.
	 * If we are not storing teams in LDAP and/or we have not defined any
	 * administrator teams, then do not change the admin flag.
	 *
	 * @param user
	 */
	private void setAdminAttribute(UserModel user) {
		if (!supportsTeamMembershipChanges()) {
			List<String> admins = settings.getStrings(Keys.realm.ldap.admins);
			// if we have defined administrative teams, then set admin flag
			// otherwise leave admin flag unchanged
			if (!ArrayUtils.isEmpty(admins)) {
				user.canAdmin = false;
				for (String admin : admins) {
					if (user.getName().equalsIgnoreCase(admin)) {
						// admin user
						user.canAdmin = true;
					}
				}
			}
		}
	}

	/**
	 * Set the canAdmin attribute for team retrieved from LDAP.
	 * If we are not storing teams in LDAP and/or we have not defined any
	 * administrator teams, then do not change the admin flag.
	 *
	 * @param team
	 */
	private void setAdminAttribute(TeamModel team) {
		if (!supportsTeamMembershipChanges()) {
			List<String> admins = settings.getStrings(Keys.realm.ldap.admins);
			// if we have defined administrative teams, then set admin flag
			// otherwise leave admin flag unchanged
			if (!ArrayUtils.isEmpty(admins)) {
				team.canAdmin = false;
				for (String admin : admins) {
					if (admin.startsWith("@") && team.name.equalsIgnoreCase(admin.substring(1))) {
						// admin team
						team.canAdmin = true;
					}
				}
			}
		}
	}

	private void setUserAttributes(UserModel user, SearchResultEntry userEntry) {
		// Is this user an admin?
		setAdminAttribute(user);

		// Don't want visibility into the real password, make up a dummy
		user.password = Constants.EXTERNAL_ACCOUNT;
		user.accountType = getAccountType();

		// Get full name Attribute
		String displayName = settings.getString(Keys.realm.ldap.displayName, "");
		if (!StringUtils.isEmpty(displayName)) {
			// Replace embedded ${} with attributes
			if (displayName.contains("${")) {
				for (Attribute userAttribute : userEntry.getAttributes()) {
					displayName = StringUtils.replace(displayName, "${" + userAttribute.getName() + "}", userAttribute.getValue());
				}
				user.displayName = displayName;
			} else {
				Attribute attribute = userEntry.getAttribute(displayName);
				if (attribute != null && attribute.hasValue()) {
					user.displayName = attribute.getValue();
				}
			}
		}

		// Get email address Attribute
		String email = settings.getString(Keys.realm.ldap.email, "");
		if (!StringUtils.isEmpty(email)) {
			if (email.contains("${")) {
				for (Attribute userAttribute : userEntry.getAttributes()) {
					email = StringUtils.replace(email, "${" + userAttribute.getName() + "}", userAttribute.getValue());
				}
				user.emailAddress = email;
			} else {
				Attribute attribute = userEntry.getAttribute(email);
				if (attribute != null && attribute.hasValue()) {
					user.emailAddress = attribute.getValue();
				} else {
					// issue-456/ticket-134
					// allow LDAP to delete an email address
					user.emailAddress = null;
				}
			}
		}
	}

	private void getTeamsFromLdap(LdapConnection ldapConnection, String simpleUsername, SearchResultEntry loggingInUser, UserModel user) {
		String loggingInUserDN = loggingInUser.getDN();

		// Clear the users team memberships - we're going to get them from LDAP
		user.teams.clear();

		String groupBase = settings.getString(Keys.realm.ldap.groupBase, "");
		String groupMemberPattern = settings.getString(Keys.realm.ldap.groupMemberPattern, "(&(objectClass=group)(member=${dn}))");

		groupMemberPattern = StringUtils.replace(groupMemberPattern, "${dn}", escapeLDAPSearchFilter(loggingInUserDN));
		groupMemberPattern = StringUtils.replace(groupMemberPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));

		// Fill in attributes into groupMemberPattern
		for (Attribute userAttribute : loggingInUser.getAttributes()) {
			groupMemberPattern = StringUtils.replace(groupMemberPattern, "${" + userAttribute.getName() + "}", escapeLDAPSearchFilter(userAttribute.getValue()));
		}

		SearchResult teamMembershipResult = searchTeamsInLdap(ldapConnection, groupBase, true, groupMemberPattern, Arrays.asList("cn"));
		if (teamMembershipResult != null && teamMembershipResult.getEntryCount() > 0) {
			for (int i = 0; i < teamMembershipResult.getEntryCount(); i++) {
				SearchResultEntry teamEntry = teamMembershipResult.getSearchEntries().get(i);
				String teamName = teamEntry.getAttribute("cn").getValue();

				TeamModel teamModel = userManager.getTeamModel(teamName);
				if (teamModel == null) {
					teamModel = createTeamFromLdap(teamEntry);
				}

				user.teams.add(teamModel);
				teamModel.addUser(user.getName());
			}
		}
	}

	private void getEmptyTeamsFromLdap(LdapConnection ldapConnection) {
		logger.info("Start fetching empty teams from ldap.");
		String groupBase = settings.getString(Keys.realm.ldap.groupBase, "");
		String groupMemberPattern = settings.getString(Keys.realm.ldap.groupEmptyMemberPattern, "(&(objectClass=group)(!(member=*)))");

		SearchResult teamMembershipResult = searchTeamsInLdap(ldapConnection, groupBase, true, groupMemberPattern, null);
		if (teamMembershipResult != null && teamMembershipResult.getEntryCount() > 0) {
			for (int i = 0; i < teamMembershipResult.getEntryCount(); i++) {
				SearchResultEntry teamEntry = teamMembershipResult.getSearchEntries().get(i);
				if (!teamEntry.hasAttribute("member")) {
					String teamName = teamEntry.getAttribute("cn").getValue();

					TeamModel teamModel = userManager.getTeamModel(teamName);
					if (teamModel == null) {
						teamModel = createTeamFromLdap(teamEntry);
						setAdminAttribute(teamModel);
						userManager.updateTeamModel(teamModel);
					}
				}
			}
		}
		logger.info("Finished fetching empty teams from ldap.");
	}


	private SearchResult searchTeamsInLdap(LdapConnection ldapConnection, String base, boolean dereferenceAliases, String filter, List<String> attributes) {
		SearchResult result = ldapConnection.search(base, dereferenceAliases, filter, attributes);
		if (result == null) {
			return null;
		}

		if (result.getResultCode() != ResultCode.SUCCESS) {
			// Retry the search with user authorization in case we searched as a manager account that could not search for teams.
			logger.debug("Rebinding as user to search for teams in LDAP");
			result = null;
			if (ldapConnection.rebindAsUser()) {
				result = ldapConnection.search(base, dereferenceAliases, filter, attributes);
				if (result.getResultCode() != ResultCode.SUCCESS) {
					return null;
				}
				logger.info("Successful search after rebinding as user.");
			}
		}

		return result;
	}


	private TeamModel createTeamFromLdap(SearchResultEntry teamEntry) {
		TeamModel answer = new TeamModel(teamEntry.getAttributeValue("cn"));
		answer.accountType = getAccountType();
		// potentially retrieve other attributes here in the future

		return answer;
	}

	private SearchResult doSearch(LdapConnection ldapConnection, String base, String filter) {
		try {
			SearchRequest searchRequest = new SearchRequest(base, SearchScope.SUB, filter);
			SearchResult result = ldapConnection.search(searchRequest);
			if (result.getResultCode() != ResultCode.SUCCESS) {
				return null;
			}
			return result;
		} catch (LDAPException e) {
			logger.error("Problem creating LDAP search", e);
			return null;
		}
	}



	/**
	 * Returns a simple username without any domain prefixes.
	 *
	 * @param username
	 * @return a simple username
	 */
	protected String getSimpleUsername(String username) {
		int lastSlash = username.lastIndexOf('\\');
		if (lastSlash > -1) {
			username = username.substring(lastSlash + 1);
		}

		return username;
	}

	// From: https://www.owasp.org/index.php/Preventing_LDAP_Injection_in_Java
	private static final String escapeLDAPSearchFilter(String filter) {
		StringBuilder sb = new StringBuilder();
		for (int i = 0; i < filter.length(); i++) {
			char curChar = filter.charAt(i);
			switch (curChar) {
			case '\\':
				sb.append("\\5c");
				break;
			case '*':
				sb.append("\\2a");
				break;
			case '(':
				sb.append("\\28");
				break;
			case ')':
				sb.append("\\29");
				break;
			case '\u0000':
				sb.append("\\00");
				break;
			default:
				sb.append(curChar);
			}
		}
		return sb.toString();
	}

	private void configureSyncService() {
		LdapSyncService ldapSyncService = new LdapSyncService(settings, this);
		if (ldapSyncService.isReady()) {
			long ldapSyncPeriod = getSynchronizationPeriodInMilliseconds();
			int delay = 1;
			logger.info("Ldap sync service will update users and groups every {} minutes.",
					TimeUnit.MILLISECONDS.toMinutes(ldapSyncPeriod));
			scheduledExecutorService.scheduleAtFixedRate(ldapSyncService, delay, ldapSyncPeriod,  TimeUnit.MILLISECONDS);
		} else {
			logger.info("Ldap sync service is disabled.");
		}
	}



	private class LdapConnection {
		private LDAPConnection conn;
		private SimpleBindRequest currentBindRequest;
		private SimpleBindRequest managerBindRequest;
		private SimpleBindRequest userBindRequest;


		public LdapConnection() {
			String bindUserName = settings.getString(Keys.realm.ldap.username, "");
			String bindPassword = settings.getString(Keys.realm.ldap.password, "");
			if (StringUtils.isEmpty(bindUserName) && StringUtils.isEmpty(bindPassword)) {
				this.managerBindRequest = new SimpleBindRequest();
			}
			this.managerBindRequest = new SimpleBindRequest(bindUserName, bindPassword);
		}


		boolean connect() {
			try {
				URI ldapUrl = new URI(settings.getRequiredString(Keys.realm.ldap.server));
				String ldapHost = ldapUrl.getHost();
				int ldapPort = ldapUrl.getPort();

				if (ldapUrl.getScheme().equalsIgnoreCase("ldaps")) {
					// SSL
					SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager());
					conn = new LDAPConnection(sslUtil.createSSLSocketFactory());
					if (ldapPort == -1) {
						ldapPort = 636;
					}
				} else if (ldapUrl.getScheme().equalsIgnoreCase("ldap") || ldapUrl.getScheme().equalsIgnoreCase("ldap+tls")) {
					// no encryption or StartTLS
					conn = new LDAPConnection();
					 if (ldapPort == -1) {
						 ldapPort = 389;
					 }
				} else {
					logger.error("Unsupported LDAP URL scheme: " + ldapUrl.getScheme());
					return false;
				}

				conn.connect(ldapHost, ldapPort);

				if (ldapUrl.getScheme().equalsIgnoreCase("ldap+tls")) {
					SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager());
					ExtendedResult extendedResult = conn.processExtendedOperation(
							new StartTLSExtendedRequest(sslUtil.createSSLContext()));
					if (extendedResult.getResultCode() != ResultCode.SUCCESS) {
						throw new LDAPException(extendedResult.getResultCode());
					}
				}

				return true;

			} catch (URISyntaxException e) {
				logger.error("Bad LDAP URL, should be in the form: ldap(s|+tls)://<server>:<port>", e);
			} catch (GeneralSecurityException e) {
				logger.error("Unable to create SSL Connection", e);
			} catch (LDAPException e) {
				logger.error("Error Connecting to LDAP", e);
			}

			return false;
		}


		void close() {
			if (conn != null) {
				conn.close();
			}
		}


		SearchResult search(SearchRequest request) {
			try {
				return conn.search(request);
			} catch (LDAPSearchException e) {
				logger.error("Problem Searching LDAP [{}]",  e.getResultCode());
				return e.getSearchResult();
			}
		}


		SearchResult search(String base, boolean dereferenceAliases, String filter, List<String> attributes) {
			try {
				SearchRequest searchRequest = new SearchRequest(base, SearchScope.SUB, filter);
				if (dereferenceAliases) {
					searchRequest.setDerefPolicy(DereferencePolicy.SEARCHING);
				}
				if (attributes != null) {
					searchRequest.setAttributes(attributes);
				}
				SearchResult result = search(searchRequest);
				return result;

			} catch (LDAPException e) {
				logger.error("Problem creating LDAP search", e);
				return null;
			}
		}



		/**
		 * Bind using the manager credentials set in realm.ldap.username and ..password
		 * @return A bind result, or null if binding failed.
		 */
		BindResult bind() {
			BindResult result = null;
			try {
				result = conn.bind(managerBindRequest);
				currentBindRequest = managerBindRequest;
			} catch (LDAPException e) {
				logger.error("Error authenticating to LDAP with manager account to search the directory.");
				logger.error("  Please check your settings for realm.ldap.username and realm.ldap.password.");
				logger.debug("  Received exception when binding to LDAP", e);
				return null;
			}
			return result;
		}


		/**
		 * Bind using the given credentials, by filling in the username in the given {@code bindPattern} to
		 * create the DN.
		 * @return A bind result, or null if binding failed.
		 */
		BindResult bind(String bindPattern, String simpleUsername, String password) {
			BindResult result = null;
			try {
				String bindUser = StringUtils.replace(bindPattern, "${username}", escapeLDAPSearchFilter(simpleUsername));
				SimpleBindRequest request = new SimpleBindRequest(bindUser, password);
				result = conn.bind(request);
				userBindRequest = request;
				currentBindRequest = userBindRequest;
			} catch (LDAPException e) {
				logger.error("Error authenticating to LDAP with user account to search the directory.");
				logger.error("  Please check your settings for realm.ldap.bindpattern.");
				logger.debug("  Received exception when binding to LDAP", e);
				return null;
			}
			return result;
		}


		boolean rebindAsUser() {
			if (userBindRequest == null || currentBindRequest == userBindRequest) {
				return false;
			}
			try {
				conn.bind(userBindRequest);
				currentBindRequest = userBindRequest;
			} catch (LDAPException e) {
				conn.close();
				logger.error("Error rebinding to LDAP with user account.", e);
				return false;
			}
			return true;
		}


		boolean isAuthenticated(String userDn, String password) {
			verifyCurrentBinding();

			// If the currently bound DN is already the DN of the logging in user, authentication has already happened
			// during the previous bind operation. We accept this and return with the current bind left in place.
			// This could also be changed to always retry binding as the logging in user, to make sure that the
			// connection binding has not been tampered with in between. So far I see no way how this could happen
			// and thus skip the repeated binding.
			// This check also makes sure that the DN in realm.ldap.bindpattern actually matches the DN that was found
			// when searching the user entry.
			String boundDN = currentBindRequest.getBindDN();
			if (boundDN != null && boundDN.equals(userDn)) {
				return true;
			}

			// Bind a the logging in user to check for authentication.
			// Afterwards, bind as the original bound DN again, to restore the previous authorization.
			boolean isAuthenticated = false;
			try {
				// Binding will stop any LDAP-Injection Attacks since the searched-for user needs to bind to that DN
				SimpleBindRequest ubr = new SimpleBindRequest(userDn, password);
				conn.bind(ubr);
				isAuthenticated = true;
				userBindRequest = ubr;
			} catch (LDAPException e) {
				logger.error("Error authenticating user ({})", userDn, e);
			}

			try {
				conn.bind(currentBindRequest);
			} catch (LDAPException e) {
				logger.error("Error reinstating original LDAP authorization (code {}). Team information may be inaccurate for this log in.",
							e.getResultCode(), e);
			}
			return isAuthenticated;
		}



		private boolean verifyCurrentBinding() {
			BindRequest lastBind = conn.getLastBindRequest();
			if (lastBind == currentBindRequest) {
				return true;
			}
			logger.debug("Unexpected binding in LdapConnection. {} != {}", lastBind, currentBindRequest);

			String lastBoundDN = ((SimpleBindRequest)lastBind).getBindDN();
			String boundDN = currentBindRequest.getBindDN();
			logger.debug("Currently bound as '{}', check authentication for '{}'", lastBoundDN, boundDN);
			if (boundDN != null && ! boundDN.equals(lastBoundDN)) {
				logger.warn("Unexpected binding DN in LdapConnection. '{}' != '{}'.", lastBoundDN, boundDN);
				logger.warn("Updated binding information in LDAP connection.");
				currentBindRequest = (SimpleBindRequest)lastBind;
				return false;
			}
			return true;
		}
	}
}