Class ActiveDirectoryRealm

  extended by org.apache.shiro.realm.CachingRealm
      extended by org.apache.shiro.realm.AuthenticatingRealm
          extended by org.apache.shiro.realm.AuthorizingRealm
              extended by org.apache.shiro.realm.ldap.AbstractLdapRealm
                  extended by org.apache.shiro.realm.activedirectory.ActiveDirectoryRealm
All Implemented Interfaces:
LogoutAware, Authorizer, PermissionResolverAware, RolePermissionResolverAware, CacheManagerAware, Realm, Initializable, Nameable

public class ActiveDirectoryRealm
extends AbstractLdapRealm

A Realm that authenticates with an active directory LDAP server to determine the roles for a particular user. This implementation queries for the user's groups and then maps the group names to roles using the groupRolesMap.


Field Summary
Fields inherited from class org.apache.shiro.realm.ldap.AbstractLdapRealm
principalSuffix, searchBase, systemPassword, systemUsername, url
Constructor Summary
Method Summary
protected  AuthenticationInfo buildAuthenticationInfo(String username, char[] password)
protected  AuthorizationInfo buildAuthorizationInfo(Set<String> roleNames)
protected  Collection<String> getRoleNamesForGroups(Collection<String> groupNames)
          This method is called by the default implementation to translate Active Directory group names to role names.
protected  AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token, LdapContextFactory ldapContextFactory)
          Builds an AuthenticationInfo object by querying the active directory LDAP context for the specified username.
protected  AuthorizationInfo queryForAuthorizationInfo(PrincipalCollection principals, LdapContextFactory ldapContextFactory)
          Builds an AuthorizationInfo object by querying the active directory LDAP context for the groups that a user is a member of.
 void setGroupRolesMap(Map<String,String> groupRolesMap)
Methods inherited from class org.apache.shiro.realm.ldap.AbstractLdapRealm
doGetAuthenticationInfo, doGetAuthorizationInfo, onInit, setLdapContextFactory, setPrincipalSuffix, setSearchBase, setSystemPassword, setSystemUsername, setUrl
Methods inherited from class org.apache.shiro.realm.AuthorizingRealm
afterCacheManagerSet, checkPermission, checkPermission, checkPermission, checkPermissions, checkPermissions, checkPermissions, checkRole, checkRole, checkRoles, checkRoles, checkRoles, clearCachedAuthorizationInfo, doClearCache, getAuthorizationCache, getAuthorizationCacheKey, getAuthorizationCacheName, getAuthorizationInfo, getPermissionResolver, getRolePermissionResolver, hasAllRoles, hasRole, hasRole, hasRoles, hasRoles, isAuthorizationCachingEnabled, isPermitted, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, isPermittedAll, setAuthorizationCache, setAuthorizationCacheName, setAuthorizationCachingEnabled, setName, setPermissionResolver, setRolePermissionResolver
Methods inherited from class org.apache.shiro.realm.AuthenticatingRealm
assertCredentialsMatch, clearCachedAuthenticationInfo, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, supports
Methods inherited from class org.apache.shiro.realm.CachingRealm
clearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabled
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
Methods inherited from interface org.apache.shiro.util.Initializable

Constructor Detail


public ActiveDirectoryRealm()
Method Detail


public void setGroupRolesMap(Map<String,String> groupRolesMap)


protected AuthenticationInfo queryForAuthenticationInfo(AuthenticationToken token,
                                                        LdapContextFactory ldapContextFactory)
                                                 throws NamingException
Builds an AuthenticationInfo object by querying the active directory LDAP context for the specified username. This method binds to the LDAP server using the provided username and password - which if successful, indicates that the password is correct.

This method can be overridden by subclasses to query the LDAP server in a more complex way.

Specified by:
queryForAuthenticationInfo in class AbstractLdapRealm
token - the authentication token provided by the user.
ldapContextFactory - the factory used to build connections to the LDAP server.
an AuthenticationInfo instance containing information retrieved from LDAP.
NamingException - if any LDAP errors occur during the search.


protected AuthenticationInfo buildAuthenticationInfo(String username,
                                                     char[] password)


protected AuthorizationInfo queryForAuthorizationInfo(PrincipalCollection principals,
                                                      LdapContextFactory ldapContextFactory)
                                               throws NamingException
Builds an AuthorizationInfo object by querying the active directory LDAP context for the groups that a user is a member of. The groups are then translated to role names by using the configured groupRolesMap.

This implementation expects the principal argument to be a String username.

Subclasses can override this method to determine authorization data (roles, permissions, etc) in a more complex way. Note that this default implementation does not support permissions, only roles.

Specified by:
queryForAuthorizationInfo in class AbstractLdapRealm
principals - the principal of the Subject whose account is being retrieved.
ldapContextFactory - the factory used to create LDAP connections.
the AuthorizationInfo for the given Subject principal.
NamingException - if an error occurs when searching the LDAP server.


protected AuthorizationInfo buildAuthorizationInfo(Set<String> roleNames)


protected Collection<String> getRoleNamesForGroups(Collection<String> groupNames)
This method is called by the default implementation to translate Active Directory group names to role names. This implementation uses the groupRolesMap to map group names to role names.

groupNames - the group names that apply to the current user.
a collection of roles that are implied by the given role names.

Copyright © 2004-2014 The Apache Software Foundation. All Rights Reserved.