private Set rolesFor()

in gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealm.java [253:328]
59 lines of code
15 McCabe index (conditional complexity)

    private Set<String> rolesFor(PrincipalCollection principals, final String userName, final LdapContext ldapCtx,
        final LdapContextFactory ldapContextFactory) throws NamingException {
      final Set<String> roleNames = new HashSet<>();
      final Set<String> groupNames = new HashSet<>();

      String userDn;
      if (userSearchAttributeName == null || userSearchAttributeName.isEmpty()) {
        // memberAttributeValuePrefix and memberAttributeValueSuffix were computed from memberAttributeValueTemplate
        userDn = memberAttributeValuePrefix + userName + memberAttributeValueSuffix;
      } else {
        userDn = getUserDn(userName);
      }

      // Activate paged results
      int pageSize = 100;
      int numResults = 0;
      byte[] cookie = null;
      try {
        ldapCtx.addToEnvironment(Context.REFERRAL, "ignore");

        ldapCtx.setRequestControls(new Control[]{new PagedResultsControl(pageSize, Control.NONCRITICAL)});

        do {
          // ldapsearch -h localhost -p 33389 -D uid=guest,ou=people,dc=hadoop,dc=apache,dc=org -w  guest-password
          //       -b dc=hadoop,dc=apache,dc=org -s sub '(objectclass=*)'

          NamingEnumeration<SearchResult> searchResultEnum = null;
          try {
            searchResultEnum = ldapCtx.search(
                getGroupSearchBase(),
                "objectClass=" + groupObjectClass,
                SUBTREE_SCOPE);

            while (searchResultEnum != null && searchResultEnum.hasMore()) { // searchResults contains all the groups in search scope
              numResults++;
              final SearchResult group = searchResultEnum.next();
              addRoleIfMember(userDn, group, roleNames, groupNames, ldapContextFactory);
            }
          } catch (PartialResultException e) {
            LOG.ignoringPartialResultException();
          } finally {
            if (searchResultEnum != null) {
              searchResultEnum.close();
            }
          }

          // Examine the paged results control response
          Control[] controls = ldapCtx.getResponseControls();
          if (controls != null) {
            for (Control control : controls) {
              if (control instanceof PagedResultsResponseControl) {
                PagedResultsResponseControl prrc = (PagedResultsResponseControl) control;
                cookie = prrc.getCookie();
              }
            }
          }

          // Re-activate paged results
          ldapCtx.setRequestControls(new Control[]{new PagedResultsControl(pageSize, cookie, Control.CRITICAL)});
        } while (cookie != null);
      } catch (SizeLimitExceededException e) {
        LOG.sizeLimitExceededOnlyRetrieved(numResults);
      } catch(IOException e) {
        LOG.unableToSetupPagedResults();
      }

      // save role names and group names in session so that they can be easily looked up outside of this object
      SecurityUtils.getSubject().getSession().setAttribute(SUBJECT_USER_ROLES, roleNames);
      SecurityUtils.getSubject().getSession().setAttribute(SUBJECT_USER_GROUPS, groupNames);
      if (!groupNames.isEmpty() && (principals instanceof MutablePrincipalCollection)) {
        ((MutablePrincipalCollection)principals).addAll(groupNames, getName());
      }
      LOG.lookedUpUserRoles(roleNames, userName);

      return roleNames;
    }