|
|
|
@ -1,9 +1,6 @@ |
|
|
|
package com.spring.modules.sys.service.impl; |
|
|
|
|
|
|
|
import com.spring.ifs.bean.BaseSearchBean; |
|
|
|
import com.spring.modules.sys.service.CheckLdapDirectory; |
|
|
|
import org.slf4j.Logger; |
|
|
|
import org.slf4j.LoggerFactory; |
|
|
|
import org.springframework.beans.factory.annotation.Value; |
|
|
|
import org.springframework.stereotype.Service; |
|
|
|
|
|
|
|
@ -38,23 +35,14 @@ public class CheckLdapDirectoryImpl implements CheckLdapDirectory { |
|
|
|
@Value("${spring.ldap.password}") |
|
|
|
private String ldapPassword; |
|
|
|
|
|
|
|
private static final Logger logger = LoggerFactory.getLogger(CheckLdapDirectoryImpl.class); |
|
|
|
|
|
|
|
@Override |
|
|
|
public boolean checkUserLdapDirectory(String username, String directoryPath) { |
|
|
|
logger.info("Checking the folder permission for the user:"+username); |
|
|
|
logger.info("Checking the folder permission for the directory:"+directoryPath); |
|
|
|
public boolean checkUserLdapDirectory(String username, String directoryPath) throws NamingException { |
|
|
|
//查询文件的域控账号或分组 |
|
|
|
Map<String, String> directoryGroupAccount = this.getDirectoryLdapAccount(directoryPath); |
|
|
|
logger.info("Folder Group And Account:"+directoryGroupAccount.toString()); |
|
|
|
//查询用户是否是该文件夹的域控账号或分组 |
|
|
|
Map<String, String> ldapAccountGroup = this.getLapAccountGroup(username); |
|
|
|
//打印日志 |
|
|
|
logger.info("Ldap Group And Account:"+ldapAccountGroup.toString()); |
|
|
|
for(String strKey : directoryGroupAccount.keySet()) { |
|
|
|
if (ldapAccountGroup.containsKey(strKey)) { |
|
|
|
return true; |
|
|
|
} |
|
|
|
//Map<String, String> ldapAccountGroup = this.getLapAccountGroup(username); |
|
|
|
if (directoryGroupAccount.containsKey(username)) { |
|
|
|
return true; |
|
|
|
} |
|
|
|
return false; |
|
|
|
} |
|
|
|
@ -134,7 +122,7 @@ public class CheckLdapDirectoryImpl implements CheckLdapDirectory { |
|
|
|
* @date 2025/5/12 16:55 |
|
|
|
* @version 1.0 |
|
|
|
*/ |
|
|
|
public static Map<String, String> getDirectoryLdapAccount(String directoryPath) { |
|
|
|
public Map<String, String> getDirectoryLdapAccount(String directoryPath) throws NamingException { |
|
|
|
//获取文件夹 |
|
|
|
Path securityPath = Paths.get(directoryPath); |
|
|
|
//判断路径是否是文件夹 |
|
|
|
@ -144,6 +132,16 @@ public class CheckLdapDirectoryImpl implements CheckLdapDirectory { |
|
|
|
//返回的数据 |
|
|
|
Map<String, String> ldapGroupAccount = new HashMap<String, String>(); |
|
|
|
|
|
|
|
Properties env = new Properties(); |
|
|
|
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); |
|
|
|
env.put(Context.PROVIDER_URL, ldapUrl); |
|
|
|
env.put(Context.SECURITY_AUTHENTICATION, "simple"); |
|
|
|
env.put(Context.SECURITY_PRINCIPAL, ldapUserDn); |
|
|
|
env.put(Context.SECURITY_CREDENTIALS, ldapPassword); |
|
|
|
|
|
|
|
// 创建DirContext对象，建立与LDAP服务器的连接 |
|
|
|
DirContext ctx = new InitialDirContext(env); |
|
|
|
|
|
|
|
AclFileAttributeView aclView = Files.getFileAttributeView(securityPath, AclFileAttributeView.class); |
|
|
|
try { |
|
|
|
aclView.getAcl().forEach(aclEntry -> { |
|
|
|
@ -157,7 +155,138 @@ public class CheckLdapDirectoryImpl implements CheckLdapDirectory { |
|
|
|
} catch (IOException e) { |
|
|
|
throw new RuntimeException(e); |
|
|
|
} |
|
|
|
Map<String, String> ldapAccount = new HashMap<String, String>(); |
|
|
|
if (ldapGroupAccount.size() > 0) { |
|
|
|
//循环检查数据是否存在组信息 如果存在 需要把组数据 替换成账号的信息 |
|
|
|
for(String strKey : ldapGroupAccount.keySet()) { |
|
|
|
if (checkMemberIsGroupWithName(ctx, strKey)){ |
|
|
|
ldapAccount.putAll(getLdapAccountListFromGroup(ctx, strKey)); |
|
|
|
}else { |
|
|
|
ldapAccount.put(strKey, strKey); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
//返回执行的结果 |
|
|
|
return ldapGroupAccount; |
|
|
|
return ldapAccount; |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
/** |
|
|
|
* @description: 从组里面获取成员信息 |
|
|
|
* @author LR |
|
|
|
* @date 2025/6/30 17:45 |
|
|
|
* @version 1.0 |
|
|
|
*/ |
|
|
|
public Map<String, String> getLdapAccountListFromGroup(DirContext ctx, String groupDn) throws NamingException { |
|
|
|
Map<String, String> accountMap = new HashMap<>(); |
|
|
|
// 设置返回所有属性 |
|
|
|
SearchControls controls = new SearchControls(); |
|
|
|
controls.setReturningAttributes(new String[] {"member"}); |
|
|
|
controls.setSearchScope(SearchControls.SUBTREE_SCOPE); |
|
|
|
String nameFilter = "(&(objectClass=group)(cn="+groupDn+"))"; |
|
|
|
// 执行查询 |
|
|
|
NamingEnumeration<SearchResult> results = ctx.search(ldapBase, nameFilter, controls); |
|
|
|
while (results.hasMore()) { |
|
|
|
SearchResult result = results.next(); |
|
|
|
Attributes attrs = result.getAttributes(); |
|
|
|
|
|
|
|
NamingEnumeration<? extends Attribute> attrEnum = attrs.getAll(); |
|
|
|
|
|
|
|
while (attrEnum.hasMore()) { |
|
|
|
Attribute attr = attrEnum.next(); |
|
|
|
// 处理多值属性 |
|
|
|
NamingEnumeration<?> values = attr.getAll(); |
|
|
|
while (values.hasMore()) { |
|
|
|
Object value = values.next(); |
|
|
|
String valueStr = value.toString(); |
|
|
|
String currentMember = valueStr.substring(valueStr.indexOf("=")+1, valueStr.indexOf(",")); |
|
|
|
if (checkMemberIsGroup(ctx, valueStr)){ |
|
|
|
//递归调用 |
|
|
|
accountMap.putAll(getLdapAccountListFromGroup(ctx, currentMember)); |
|
|
|
}else { |
|
|
|
accountMap.put(getLdapAccountByMemberStr(ctx, valueStr), currentMember); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
return accountMap; |
|
|
|
} |
|
|
|
|
|
|
|
/** |
|
|
|
* @description: 检查当前是否是组信息 |
|
|
|
* @author LR |
|
|
|
* @date 2025/6/30 17:26 |
|
|
|
* @version 1.0 |
|
|
|
*/ |
|
|
|
public boolean checkMemberIsGroupWithName(DirContext ctx, String name) throws NamingException { |
|
|
|
// 设置返回所有属性 |
|
|
|
SearchControls controls = new SearchControls(); |
|
|
|
controls.setReturningAttributes(new String[] {"member"}); |
|
|
|
controls.setSearchScope(SearchControls.SUBTREE_SCOPE); |
|
|
|
String nameFilter = "(&(objectClass=group)(cn="+name+"))"; |
|
|
|
// 执行查询 |
|
|
|
NamingEnumeration<SearchResult> results = ctx.search(ldapBase, nameFilter, controls); |
|
|
|
boolean checkFlag = results.hasMore(); |
|
|
|
results.close(); |
|
|
|
return checkFlag; |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/** |
|
|
|
* @description: 检查当前是否是组信息 |
|
|
|
* @author LR |
|
|
|
* @date 2025/6/30 17:26 |
|
|
|
* @version 1.0 |
|
|
|
*/ |
|
|
|
public boolean checkMemberIsGroup(DirContext ctx, String memberDn) throws NamingException { |
|
|
|
Attributes attrs = ctx.getAttributes(memberDn, new String[] {"objectClass"}); |
|
|
|
Attribute attr = attrs.get("objectClass"); |
|
|
|
if (attr != null){ |
|
|
|
for (int i = 0; i < attr.size(); i++) { |
|
|
|
if ("group".equalsIgnoreCase(attr.get(i).toString())) { |
|
|
|
return true; |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
return false; |
|
|
|
} |
|
|
|
|
|
|
|
/** |
|
|
|
* @description: 通过名称获取账号的信息 |
|
|
|
* @author LR |
|
|
|
* @date 2025/7/1 13:38 |
|
|
|
* @version 1.0 |
|
|
|
*/ |
|
|
|
public String getLdapAccountByMemberStr(DirContext ctx, String memberDn) throws NamingException { |
|
|
|
Attributes attrs = ctx.getAttributes(memberDn, new String[] {"sAMAccountName"}); |
|
|
|
Attribute attr = attrs.get("sAMAccountName"); |
|
|
|
if (attr != null){ |
|
|
|
String userAccount = attr.get().toString(); |
|
|
|
return userAccount; |
|
|
|
} |
|
|
|
return ""; |
|
|
|
} |
|
|
|
|
|
|
|
/** |
|
|
|
* @description: 检查是否是用户 |
|
|
|
* @author LR |
|
|
|
* @date 2025/7/1 10:41 |
|
|
|
* @version 1.0 |
|
|
|
*/ |
|
|
|
public boolean checkStrIsAccount(DirContext ctx, String str) throws NamingException { |
|
|
|
// 设置返回所有属性 |
|
|
|
SearchControls controls = new SearchControls(); |
|
|
|
controls.setReturningAttributes(new String[] {"memberof"}); |
|
|
|
controls.setSearchScope(SearchControls.SUBTREE_SCOPE); |
|
|
|
String nameFilter = "(sAMAccountName="+str+")"; // 根据登录名精确匹配 |
|
|
|
|
|
|
|
// 执行查询 |
|
|
|
NamingEnumeration<SearchResult> results = ctx.search(ldapBase, nameFilter, controls); |
|
|
|
//如果含有信息 则是账号 |
|
|
|
if (results.hasMore()) { |
|
|
|
return true; |
|
|
|
} |
|
|
|
return false; |
|
|
|
} |
|
|
|
} |
