Package org.gridgain.internal.security.ldap

Class LdapFilter

java.lang.Object
org.gridgain.internal.security.ldap.LdapFilter
public class LdapFilter extends Object
Ldap filter.

  • Constructor Details

    • LdapFilter

      public LdapFilter(String template)
      Constructor.
      Parameters:
      template - Filter template.

  • Method Details

    • resolve

      public String resolve(String identifier)
      Resolves the filter template by substituting the {0} placeholder with the supplied identifier.

      The identifier is escaped per RFC 4515 before substitution, so that filter metacharacters (*, (, ), \ and NUL) in user-supplied input are treated as literal characters instead of being interpreted as filter syntax. This prevents LDAP injection through the login name (or any other value flowing into the filter).

      Parameters:
      identifier - Value to substitute for the {0} placeholder.
      Returns:
      Resolved filter string.

    • identifierAttributes

      public Set<String> identifierAttributes()
      Returns the names of the attributes this filter matches the substituted identifier against, in the order the template mentions them.

      These are the only attributes of a matched entry that can hold the directory's own spelling of the identifier, so they are both the set worth requesting from the directory and the set worth comparing the identifier against. Requesting exactly them keeps the rest of the entry — userPassword above all, but also bulk values such as jpegPhoto or a long memberOf list — from being pulled over the wire and held in memory on every authentication.

      An attribute counts only when its own assertion value contains the placeholder, so (&(objectClass=person)(uid={0})) yields uid alone. A template that never substitutes the identifier yields an empty set, and so does one that hides the placeholder in a syntax this deliberately simple reader does not cover (an RFC 4515 extensible match, for instance): the identifier then has no attribute known to hold it, which callers must treat as "nothing to compare against" rather than as a reason to fall back to reading the whole entry.

      Returns:
      Names of the attributes whose assertion value contains the {0} placeholder.