如何获取弹簧安全中的所有LDAP组

Question

如何获取所有Active Directory组（不仅与当前用户有关）？我正在使用spring security ldap。你能提供一些例子吗？

Answer 1

检查这个接口： http://static.springsource.org/spring-security/site/docs/3.1.x/apidocs/org/springframework/security/ldap/userdetails/LdapAuthoritiesPopulator.html

这个类默认：

http://static.springsource.org/spring-security/site/docs/3.1.x/apidocs/org/springframework/security/ldap/userdetails/DefaultLdapAuthoritiesPopulator.html

它可以帮助

Answer 2

你可以做的是写LdapAuthoritiesPopulator实现了DefaultLdapAuthoritiesPopulator匹配实现一个额外的方法来检索所有角色。

public class ExtendedLdapAuthoritiesPopulator 
     implements LdapAuthoritiesPopulator { 

    // Copy implementation of DefaultLdapAuthoritiesPopulator (omitted). 

    private String allAuthorityFilter 
     = "(&(objectClass=group)(objectCategory=group))"; 
    public void setAllAuthorityFilter(String allAuthorityFilter) { 
     Assert.notNull(allAuthorityFilter, 
         "allAuthorityFilter must not be null"); 
     this.allAuthorityFilter = allAuthorityFilter; 
    } 

    public final Collection<GrantedAuthority> getAllAuthorities() { 
     if (groupSearchBase == null) { 
      return new HashSet<>(); 
     } 
     Set<GrantedAuthority> authorities = new HashSet<>(); 
     if (logger.isDebugEnabled()) { 
      logger.debug("Searching for all roles with filter '" 
         + allAuthorityFilter + "' in search base '" 
         + groupSearchBase + "'"); 
     } 
     Set<String> roles = ldapTemplate.searchForSingleAttributeValues(
       groupSearchBase, 
       allAuthorityFilter, 
       new String[0], 
       groupRoleAttribute); 
     if (logger.isDebugEnabled()) { 
      logger.debug("Roles from search: " + roles); 
     } 
     for (String role : roles) { 
      if (convertToUpperCase) { 
       role = role.toUpperCase(); 
      } 
      authorities.add(new SimpleGrantedAuthority(rolePrefix + role)); 
     } 
     return authorities; 
    } 

} 

在您的spring安全配置中，将DefaultLdapAuthoritiesPopulator更改为您的新实现。

一个附加属性可以设置AllAuthorityFilter哪些过滤哪些组将被返回。

您可能更喜欢您的实现只检索基于String的角色名称而不是GrantedAuthority实例。