org.opends.server.extensions

Class PlainSASLMechanismHandler

java.lang.Object

org.opends.server.api.SASLMechanismHandler<PlainSaslMechanismHandlerCfg>

org.opends.server.extensions.PlainSASLMechanismHandler

All Implemented Interfaces:

ConfigurationChangeListener<PlainSaslMechanismHandlerCfg>

public class PlainSASLMechanismHandler
extends SASLMechanismHandler<PlainSaslMechanismHandlerCfg>
implements ConfigurationChangeListener<PlainSaslMechanismHandlerCfg>

This class provides an implementation of a SASL mechanism that uses plain-text authentication. It is based on the proposal defined in draft-ietf-sasl-plain-08 in which the SASL credentials are in the form:

[authzid] UTF8NULL authcid UTF8NULL passwd

Note that this is a weak mechanism by itself and does not offer any protection for the password, so it may need to be used in conjunction with a connection security provider to prevent exposing the password.

Constructor Summary

Constructors

Constructor and Description
PlainSASLMechanismHandler()

Method Summary

Modifier and Type	Method and Description
ConfigChangeResult	applyConfigurationChange(PlainSaslMechanismHandlerCfg configuration) Applies the configuration changes to this change listener.
void	finalizeSASLMechanismHandler() Performs any finalization that may be necessary for this SASL mechanism handler.
void	initializeSASLMechanismHandler(PlainSaslMechanismHandlerCfg configuration) Initializes this SASL mechanism handler based on the information in the provided configuration entry.
boolean	isConfigurationAcceptable(PlainSaslMechanismHandlerCfg configuration, List<LocalizableMessage> unacceptableReasons) Indicates whether the provided configuration is acceptable for this SASL mechanism handler.
boolean	isConfigurationChangeAcceptable(PlainSaslMechanismHandlerCfg configuration, List<LocalizableMessage> unacceptableReasons) Indicates whether the proposed change to the configuration is acceptable to this change listener.
boolean	isPasswordBased(String mechanism) Indicates whether the specified SASL mechanism is password-based or uses some other form of credentials (e.g., an SSL client certificate or Kerberos ticket).
boolean	isSecure(String mechanism) Indicates whether the specified SASL mechanism should be considered secure (i.e., it does not expose the authentication credentials in a manner that is useful to a third-party observer, and other aspects of the authentication are generally secure).
void	processSASLBind(BindOperation bindOperation) Processes the SASL bind operation.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PlainSASLMechanismHandler

public PlainSASLMechanismHandler()

Method Detail

initializeSASLMechanismHandler

public void initializeSASLMechanismHandler(PlainSaslMechanismHandlerCfg configuration)

Description copied from class: SASLMechanismHandler

Initializes this SASL mechanism handler based on the information in the provided configuration entry. It should also register itself with the Directory Server for the particular kinds of SASL mechanisms that it will process.

Specified by:

initializeSASLMechanismHandler in class SASLMechanismHandler<PlainSaslMechanismHandlerCfg>

Parameters:

configuration - The configuration to use to initialize this SASL mechanism handler.

finalizeSASLMechanismHandler

public void finalizeSASLMechanismHandler()

Description copied from class: SASLMechanismHandler

Performs any finalization that may be necessary for this SASL mechanism handler. By default, no finalization is performed.

Overrides:

finalizeSASLMechanismHandler in class SASLMechanismHandler<PlainSaslMechanismHandlerCfg>

processSASLBind

public void processSASLBind(BindOperation bindOperation)

Description copied from class: SASLMechanismHandler

Processes the SASL bind operation. SASL mechanism implementations must ensure that the following actions are taken during the processing of this method:

• The BindOperation.setResultCode method must be used to set the appropriate result code.
• If the SASL processing gets far enough to be able to map the request to a user entry (regardless of whether the authentication is ultimately successful), then this method must call the BindOperation.setSASLAuthUserEntry method to provide it with the entry for the user that attempted to authenticate.
• If the bind processing was successful, then the BindOperation.setAuthenticationInfo method must be used to set the authentication info for the bind operation.
• If the bind processing was not successful, then the BindOperation.setAuthFailureReason method should be used to provide a message explaining why the authentication failed.

Specified by:

processSASLBind in class SASLMechanismHandler<PlainSaslMechanismHandlerCfg>

Parameters:

bindOperation - The SASL bind operation to be processed.

isPasswordBased

public boolean isPasswordBased(String mechanism)

Description copied from class: SASLMechanismHandler

Indicates whether the specified SASL mechanism is password-based or uses some other form of credentials (e.g., an SSL client certificate or Kerberos ticket).

Specified by:

isPasswordBased in class SASLMechanismHandler<PlainSaslMechanismHandlerCfg>

Parameters:

mechanism - The name of the mechanism for which to make the determination. This will only be invoked with names of mechanisms for which this handler has previously registered.

Returns:

true if this SASL mechanism is password-based, or false if it uses some other form of credentials.

isSecure

public boolean isSecure(String mechanism)

Description copied from class: SASLMechanismHandler

Indicates whether the specified SASL mechanism should be considered secure (i.e., it does not expose the authentication credentials in a manner that is useful to a third-party observer, and other aspects of the authentication are generally secure).

Specified by:

isSecure in class SASLMechanismHandler<PlainSaslMechanismHandlerCfg>

Parameters:

mechanism - The name of the mechanism for which to make the determination. This will only be invoked with names of mechanisms for which this handler has previously registered.

Returns:

true if this SASL mechanism should be considered secure, or false if not.

isConfigurationAcceptable

public boolean isConfigurationAcceptable(PlainSaslMechanismHandlerCfg configuration,
                                         List<LocalizableMessage> unacceptableReasons)

Description copied from class: SASLMechanismHandler

Indicates whether the provided configuration is acceptable for this SASL mechanism handler. It should be possible to call this method on an uninitialized SASL mechanism handler instance in order to determine whether the SASL mechanism handler would be able to use the provided configuration.

Overrides:

isConfigurationAcceptable in class SASLMechanismHandler<PlainSaslMechanismHandlerCfg>

Parameters:

configuration - The SASL mechanism handler configuration for which to make the determination.

unacceptableReasons - A list that may be used to hold the reasons that the provided configuration is not acceptable.

Returns:

true if the provided configuration is acceptable for this SASL mechanism handler, or false if not.

isConfigurationChangeAcceptable

public boolean isConfigurationChangeAcceptable(PlainSaslMechanismHandlerCfg configuration,
                                               List<LocalizableMessage> unacceptableReasons)

Description copied from interface: ConfigurationChangeListener

Indicates whether the proposed change to the configuration is acceptable to this change listener.

Specified by:

isConfigurationChangeAcceptable in interface ConfigurationChangeListener<PlainSaslMechanismHandlerCfg>

Parameters:

configuration - The new configuration containing the changes.

unacceptableReasons - A list that can be used to hold messages about why the provided configuration is not acceptable.

Returns:

Returns true if the proposed change is acceptable, or false if it is not.

applyConfigurationChange

public ConfigChangeResult applyConfigurationChange(PlainSaslMechanismHandlerCfg configuration)

Description copied from interface: ConfigurationChangeListener

Applies the configuration changes to this change listener.

Specified by:

applyConfigurationChange in interface ConfigurationChangeListener<PlainSaslMechanismHandlerCfg>

Parameters:

configuration - The new configuration containing the changes.

Returns:

Returns information about the result of changing the configuration.