|
|
@@ -40,23 +40,19 @@ import javax.naming.directory.SearchControls;
|
|
|
|
|
|
/**
|
|
|
* The default strategy for obtaining user role information from the directory.<p>It obtains roles by
|
|
|
- * <ul>
|
|
|
- * <li>Reading the values of the roles specified by the attribute names in the <tt>userRoleAttributes</tt></li>
|
|
|
- * <li>Performing a search for "groups" the user is a member of and adding those to the list of roles.</li>
|
|
|
- * </ul>
|
|
|
+ * performing a search for "groups" the user is a member of.
|
|
|
* </p>
|
|
|
- * <p>If the <tt>userRolesAttributes</tt> property is set, any matching attributes amongst those retrieved for the
|
|
|
- * user will have their values added to the list of roles. If <tt>userRolesAttributes</tt> is null, no attributes will
|
|
|
- * be mapped to roles.</p>
|
|
|
* <p>A typical group search scenario would be where each group/role is specified using the <tt>groupOfNames</tt>
|
|
|
* (or <tt>groupOfUniqueNames</tt>) LDAP objectClass and the user's DN is listed in the <tt>member</tt> (or
|
|
|
* <tt>uniqueMember</tt>) attribute to indicate that they should be assigned that role. The following LDIF sample has
|
|
|
* the groups stored under the DN <tt>ou=groups,dc=acegisecurity,dc=org</tt> and a group called "developers" with
|
|
|
- * "ben" and "marissa" as members:<pre>dn: ou=groups,dc=acegisecurity,dc=orgobjectClass: top
|
|
|
+ * "ben" and "marissa" as members:
|
|
|
+ * <pre>dn: ou=groups,dc=acegisecurity,dc=orgobjectClass: top
|
|
|
* objectClass: organizationalUnitou: groupsdn: cn=developers,ou=groups,dc=acegisecurity,dc=org
|
|
|
* objectClass: groupOfNamesobjectClass: topcn: developersdescription: Acegi Security Developers
|
|
|
* member: uid=ben,ou=people,dc=acegisecurity,dc=orgmember: uid=marissa,ou=people,dc=acegisecurity,dc=orgou: developer
|
|
|
- * </pre></p>
|
|
|
+ * </pre>
|
|
|
+ * </p>
|
|
|
* <p>The group search is performed within a DN specified by the <tt>groupSearchBase</tt> property, which should
|
|
|
* be relative to the root DN of its <tt>InitialDirContextFactory</tt>. If the search base is null, group searching is
|
|
|
* disabled. The filter used in the search is defined by the <tt>groupSearchFilter</tt> property, with the filter
|
Luke Taylor