protected Set rolesFor()

in zeppelin-server/src/main/java/org/apache/zeppelin/realm/LdapRealm.java [331:429]
80 lines of code
15 McCabe index (conditional complexity)

  protected Set<String> rolesFor(PrincipalCollection principals, String userNameIn,
          final LdapContext ldapCtx, final LdapContextFactory ldapContextFactory, Session session)
          throws NamingException {
    final Set<String> roleNames = new HashSet<>();
    final Set<String> groupNames = new HashSet<>();
    final String userName;
    if (getUserLowerCase()) {
      LOGGER.debug("userLowerCase true");
      userName = userNameIn.toLowerCase();
    } else {
      userName = userNameIn;
    }

    String userDn = getUserDnForSearch(userName);

    // Activate paged results
    int pageSize = getPagingSize();
    LOGGER.debug("Ldap PagingSize: {}", pageSize);
    int numResults = 0;
    try {
      ldapCtx.addToEnvironment(Context.REFERRAL, "ignore");

      ldapCtx.setRequestControls(new Control[]{new PagedResultsControl(pageSize,
            Control.NONCRITICAL)});

      // ldapsearch -h localhost -p 33389 -D
      // uid=guest,ou=people,dc=hadoop,dc=apache,dc=org -w guest-password
      // -b dc=hadoop,dc=apache,dc=org -s sub '(objectclass=*)'
      NamingEnumeration<SearchResult> searchResultEnum = null;
      SearchControls searchControls = getGroupSearchControls();
      try {
        if (groupSearchEnableMatchingRuleInChain) {
          searchResultEnum = ldapCtx.search(
              getGroupSearchBase(),
              String.format(
                  MATCHING_RULE_IN_CHAIN_FORMAT, groupObjectClass, memberAttribute, userDn),
              searchControls);
          while (searchResultEnum != null && searchResultEnum.hasMore()) {
            // searchResults contains all the groups in search scope
            numResults++;
            final SearchResult group = searchResultEnum.next();

            Attribute attribute = group.getAttributes().get(getGroupIdAttribute());
            String groupName = attribute.get().toString();

            String roleName = roleNameFor(groupName);
            if (roleName != null) {
              roleNames.add(roleName);
            } else {
              roleNames.add(groupName);
            }
          }
        } else {
          // Default group search filter
          String searchFilter = String.format("(objectclass=%1$s)", groupObjectClass);

          // If group search filter is defined in Shiro config, then use it
          if (groupSearchFilter != null) {
            searchFilter = expandTemplate(groupSearchFilter, userName);
            //searchFilter = String.format("%1$s", groupSearchFilter);
          }
          LOGGER.debug("Group SearchBase|SearchFilter|GroupSearchScope: " + "{}|{}|{}",
              getGroupSearchBase(), searchFilter, groupSearchScope);
          searchResultEnum = ldapCtx.search(
              getGroupSearchBase(),
              searchFilter,
              searchControls);
          while (searchResultEnum != null && searchResultEnum.hasMore()) {
            // searchResults contains all the groups in search scope
            numResults++;
            final SearchResult group = searchResultEnum.next();
            addRoleIfMember(userDn, group, roleNames, groupNames, ldapContextFactory);
          }
        }
      } catch (PartialResultException e) {
        LOGGER.debug("Ignoring PartitalResultException");
      } finally {
        if (searchResultEnum != null) {
          searchResultEnum.close();
        }
      }
      // Re-activate paged results
      ldapCtx.setRequestControls(new Control[]{new PagedResultsControl(pageSize,
              null, Control.CRITICAL)});
    } catch (SizeLimitExceededException e) {
      LOGGER.info("Only retrieved first {} groups due to SizeLimitExceededException.", numResults);
    } catch (IOException e) {
      LOGGER.error("Unabled to setup paged results");
    }
    // save role names and group names in session so that they can be
    // easily looked up outside of this object
    session.setAttribute(SUBJECT_USER_ROLES, roleNames);
    session.setAttribute(SUBJECT_USER_GROUPS, groupNames);
    if (!groupNames.isEmpty() && (principals instanceof MutablePrincipalCollection)) {
      ((MutablePrincipalCollection) principals).addAll(groupNames, getName());
    }
    LOGGER.debug("User RoleNames: {}::{}", userName, roleNames);
    return roleNames;
  }