org.eclipse.scout.http.servletfilter.security.AnonymousSecurityFilter#active=false
org.eclipse.scout.http.servletfilter.security.BasicSecurityFilter#active=false

org.eclipse.scout.http.servletfilter.security.LDAPSecurityFilter#active=true
org.eclipse.scout.http.servletfilter.security.LDAPSecurityFilter#realm=developmnet
org.eclipse.scout.http.servletfilter.security.LDAPSecurityFilter#failover=false

!MESSAGE org.eclipse.scout.http.servletfilter.helper.DevelopmentAuthFilter.createDevelopmentSubject(DevelopmentAuthFilter.java:88) +++Development security: Create Subject based on System.getProperty('user.name')

org.eclipse.scout.http.servletfilter.helper.DevelopmentAuthFilter#active=false

      Attributes attrs = ldap.getAttributes(groupDN, new String[]{attributeId});

          dn = (String) allValues.next();
          // extract userName (e.g. "BulinskyMir")
          if (dn.length() > 4) {    
            un = dn.substring(3);   // this will fail if the DN returns "uid=BulinskyMir" instead of "cn=BulinskyMir"
            parts = un.split(",");

package org.eclipse.minicrm.server.services.custom.security;

import java.io.IOException;
import java.util.Enumeration;
import java.util.Hashtable;

import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.eclipse.scout.commons.Base64Utility;
import org.eclipse.scout.commons.logger.IScoutLogger;
import org.eclipse.scout.commons.logger.ScoutLogManager;
import org.eclipse.scout.commons.security.SimplePrincipal;
import org.eclipse.scout.http.servletfilter.FilterConfigInjection;
import org.eclipse.scout.http.servletfilter.security.AbstractChainableSecurityFilter;
import org.eclipse.scout.http.servletfilter.security.PrincipalHolder;

/**
 * <h4>LDAPSecurityFilter</h4> The following properties can be set in the <code>config.ini</code> file:
 * <ul>
 * <li><code>&lt;fully qualified name of class&gt;#active=true/false</code> <b>might be set in the extension point</b></li>
 * <li><code>&lt;fully qualified name of class&gt;#realm=abcde</code> <b>required</b></li>
 * <li><code>&lt;fully qualified name of class&gt;#failover=true/false</code> <b>default false</b></li>
 * <li>
 * <code>&lt;fully qualified name of class&gt;#ldapDirectory=[e.g. ldap://ldap.mycompany.com:389]</code> <b>required</b></li>
 * <li>
 * <code>&lt;fully qualified name of class&gt;#ldapBaseDN=[e.g. dc=mycompany,dc=com]</code> <b>required</b></li>
 * <li>
 * <code>&lt;fully qualified name of class&gt;#ldapSearchFilter=[e.g. (cn=%s)]</code> <b>required</b></li>
 * <li>
 * <code>&lt;fully qualified name of class&gt;#ldapSearchBindPassword=[e.g. password of LDAPReader]</code></li>
 * <li>
 * <code>&lt;fully qualified name of class&gt;#m_searchBindDN=[e.g. cn=LDAPReader,ou=Administrators,dc=mycompany,dc=com]</code></li>
 * </ul>
 * <p>
 * based on org.eclipse.scout.http.servletfilter.security.LDAPSecurityFilter
 * 
 * @since 1.0.0 18.02.2013
 */
public class LDAPExSecurityFilter extends AbstractChainableSecurityFilter {
  private static final IScoutLogger LOG = ScoutLogManager.getLogger(LDAPExSecurityFilter.class);
  public static final String PROP_BASIC_ATTEMPT = "LDAPExSecurityFilter.basicAttempt";

  private String m_directory;
  private String m_baseDn;
  private String m_searchFilter;
  private String m_searchBindPassword;
  private String m_searchBindDN;

  @Override
  public void init(FilterConfig config0) throws ServletException {
    super.init(config0);
    FilterConfigInjection.FilterConfig config = new FilterConfigInjection(config0, getClass()).getAnyConfig();
    m_directory = getParam(config, "ldapDirectory", false);
    m_baseDn = getParam(config, "ldapBaseDN", false);
    m_searchFilter = getParam(config, "ldapSearchFilter", false);
    m_searchBindPassword = getParam(config, "ldapSearchBindPassword", true);
    m_searchBindDN = getParam(config, "ldapSearchBindDN", true);
  }

  protected String getParam(FilterConfig filterConfig, String paramName, boolean nullAllowed) throws ServletException {
    String paramValue = filterConfig.getInitParameter(paramName);
    boolean exists = false;
    if (paramValue == null && nullAllowed) { // check if parameter exists
      Enumeration initParameterNames = filterConfig.getInitParameterNames();
      while (initParameterNames.hasMoreElements() && exists == false) {
        String object = (String) initParameterNames.nextElement();
        exists = object.equals(paramName);
      }
    }
    if (paramValue == null && !exists) {
      throw new ServletException("Missing init-param with name '" + paramName + "'.");
    }
    return paramValue;
  }

  @Override
  protected int negotiate(HttpServletRequest req, HttpServletResponse resp, PrincipalHolder holder) throws IOException, ServletException {
    String h = req.getHeader("Authorization");
    if (h != null && h.matches("Basic .*")) {
      String[] a = new String(Base64Utility.decode(h.substring(6)), "ISO-8859-1").split(":", 2);
      String user = a[0].toLowerCase();
      String pass = a[1];
      if (user != null && pass != null) {
        if (login(user, pass, m_directory, m_baseDn, m_searchBindDN, m_searchBindPassword, m_searchFilter)) {
          // success
          holder.setPrincipal(new SimplePrincipal(user));
          return STATUS_CONTINUE_WITH_PRINCIPAL;
        }
      }
    }
    int attempts = getBasicAttempt(req);
    if (attempts > 2) {
      return STATUS_CONTINUE_CHAIN;
    }
    else {
      setBasicAttept(req, attempts + 1);
      resp.setHeader("WWW-Authenticate", "Basic realm=\"" + getRealm() + "\"");
      return STATUS_CONTINUE_CHAIN;
    }
  }

  private int getBasicAttempt(HttpServletRequest req) {
    int basicAtttempt = 0;
    Object attribute = req.getSession().getAttribute(PROP_BASIC_ATTEMPT);
    if (attribute instanceof Integer) {
      basicAtttempt = ((Integer) attribute).intValue();
    }
    return basicAtttempt;
  }

  private void setBasicAttept(HttpServletRequest req, int attempts) {
    req.getSession().setAttribute(PROP_BASIC_ATTEMPT, attempts);
  }

  @SuppressWarnings("unchecked")
  protected boolean login(String username, String userPassword, String directory, String baseDN, String searchBindDN, String searchBindPassword, String searchFilter) throws ServletException {
    boolean isAuthenticated = false;

    // Step 1 - authenticate with functional user to get search access
    Hashtable env = new Hashtable();
    env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    env.put(Context.PROVIDER_URL, directory);
    env.put(Context.SECURITY_PRINCIPAL, searchBindDN);
    env.put(Context.SECURITY_CREDENTIALS, searchBindPassword);

    try {
      DirContext ctx = new InitialDirContext(env);
      SearchControls constraints = new SearchControls();
      constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
      String search = String.format(searchFilter, username);

      NamingEnumeration<SearchResult> results = ctx.search(baseDN, search, constraints);

      SearchResult sr = null;

      // Step 2 - authenticate with entered user credentials
      if (results != null && results.hasMore()) {
        sr = results.next();

        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        if (sr.isRelative()) {
          env.put(Context.SECURITY_PRINCIPAL, sr.getName() + "," + baseDN);
        }
        else {
          env.put(Context.SECURITY_PRINCIPAL, sr.getName());
        }
        env.put(Context.SECURITY_CREDENTIALS, userPassword);

        try {
          new InitialDirContext(env);
          isAuthenticated = true;
        } catch (NamingException ne) {
          isAuthenticated = false;
        }
      }
      else {
        isAuthenticated = false;
      }
    }
    catch (NamingException ne) {
      LOG.error("Exception in getting user DN from LDAP: " + ne);
      throw new SecurityException(ne.getMessage(), ne);
    }
    return isAuthenticated;
  }

}

org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#active=true
org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#realm=LDAP
org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#ldapDirectory=ldap://ldapi.mycompany.com:389
org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#ldapBaseDN=dc=mycompany,dc=com
org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#ldapSearchFilter=(cn=%s)
org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#ldapSearchBindDN=cn=LDAPReader,ou=Administrators,dc=mycompany,dc=ch
org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#ldapSearchBindPassword=pass1234
org.eclipse.minicrm.server.services.custom.security.LDAPExSecurityFilter#failover=false