Skip to content

[7.x.x] Address issues in the LDAP Security Realm #167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adamretter wants to merge 2 commits into
base: develop-7.x.x
Choose a base branch
from
Open

[7.x.x] Address issues in the LDAP Security Realm #167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
65101af
[refactor] Remove defunct ActiveDirectory security module, this has b…
adamretter Jan 15, 2026
9f9aa6c
[bugfix] Fix a number of issues in the LDAP Security Realm, including…
adamretter Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions elemental-parent/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,6 +322,7 @@
<form>XML_STYLE</form>
<g>SLASHSTAR_STYLE</g>
<java>SLASHSTAR_STYLE</java>
<ldif>SCRIPT_STYLE</ldif>
<plist>XML_STYLE</plist>
<types>SCRIPT_STYLE</types>
<xconf>XML_STYLE</xconf>
Expand Down
18 changes: 18 additions & 0 deletions exist-core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -883,6 +883,7 @@
<include>src/test/java/org/exist/collections/triggers/XQueryTriggerSetUidTest.java</include>
<include>src/test/java/org/exist/collections/triggers/XQueryTriggerTest.java</include>
<include>src/main/java/org/exist/config/Configuration.java</include>
<include>src/main/java/org/exist/config/ConfigurationDocumentTrigger.java</include>
<include>src/main/java/org/exist/config/ConfigurationImpl.java</include>
<include>src/main/java/org/exist/config/Configurator.java</include>
<include>src/test/java/org/exist/config/TwoDatabasesTest.java</include>
Expand Down Expand Up @@ -1003,10 +1004,14 @@
<include>src/main/java/org/exist/repo/ExistRepository.java</include>
<include>src/main/java/org/exist/scheduler/UserXQueryJob.java</include>
<include>src/main/java/org/exist/scheduler/impl/QuartzSchedulerImpl.java</include>
<include>src/main/java/org/exist/security/AbstractRealm.java</include>
<include>src/main/java/org/exist/security/AXSchemaType.java</include>
<include>src/main/java/org/exist/security/EffectiveSubject.java</include>
<include>src/main/java/org/exist/security/EXistSchemaType.java</include>
<include>src/test/java/org/exist/security/FnDocSecurityTest.java</include>
<include>src/main/java/org/exist/security/Permission.java</include>
<include>src/main/java/org/exist/security/PermissionRequired.java</include>
<include>src/main/java/org/exist/security/Principal.java</include>
<include>src/test/java/org/exist/security/RestApiSecurityTest.java</include>
<include>src/main/java/org/exist/security/SecurityManager.java</include>
<include>src/main/java/org/exist/security/SimpleACLPermissionInternal.java</include>
Expand All @@ -1015,7 +1020,11 @@
<include>src/test/java/org/exist/security/UnixStylePermissionTest.java</include>
<include>src/test/java/org/exist/security/XqueryApiTest.java</include>
<include>src/main/java/org/exist/security/internal/AccountImpl.java</include>
<include>src/main/java/org/exist/security/internal/RealmImpl.java</include>
<include>src/main/java/org/exist/security/internal/SecurityManagerImpl.java</include>
<include>src/main/java/org/exist/security/internal/aider/UnixStylePermissionAider.java</include>
<include>src/main/java/org/exist/security/management/AccountsManagement.java</include>
<include>src/main/java/org/exist/security/management/GroupsManagement.java</include>
<include>src/main/java/org/exist/source/Source.java</include>
<include>src/main/java/org/exist/source/SourceFactory.java</include>
<include>src/main/java/org/exist/source/URLSource.java</include>
Expand Down Expand Up @@ -1587,6 +1596,7 @@
<exclude>src/test/java/org/exist/collections/triggers/XQueryTriggerSetUidTest.java</exclude>
<exclude>src/test/java/org/exist/collections/triggers/XQueryTriggerTest.java</exclude>
<exclude>src/main/java/org/exist/config/Configuration.java</exclude>
<exclude>src/main/java/org/exist/config/ConfigurationDocumentTrigger.java</exclude>
<exclude>src/main/java/org/exist/config/ConfigurationImpl.java</exclude>
<exclude>src/main/java/org/exist/config/Configurator.java</exclude>
<exclude>src/test/java/org/exist/config/TwoDatabasesTest.java</exclude>
Expand Down Expand Up @@ -1722,11 +1732,15 @@
<exclude>src/main/java/org/exist/resolver/XercesXmlResolverAdapter.java</exclude>
<exclude>src/main/java/org/exist/scheduler/UserXQueryJob.java</exclude>
<exclude>src/main/java/org/exist/scheduler/impl/QuartzSchedulerImpl.java</exclude>
<exclude>src/main/java/org/exist/security/AbstractRealm.java</exclude>
<exclude>src/main/java/org/exist/security/AXSchemaType.java</exclude>
<exclude>src/main/java/org/exist/security/EffectiveSubject.java</exclude>
<exclude>src/main/java/org/exist/security/EXistSchemaType.java</exclude>
<exclude>src/test/java/org/exist/security/FnDocSecurityTest.java</exclude>
<exclude>src/main/java/org/exist/security/Permission.java</exclude>
<exclude>src/main/java/org/exist/security/PermissionRequired.java</exclude>
<exclude>src/main/java/org/exist/security/PermissionRequiredCheck.java</exclude>
<exclude>src/main/java/org/exist/security/Principal.java</exclude>
<exclude>src/test/java/org/exist/security/RestApiSecurityTest.java</exclude>
<exclude>src/main/java/org/exist/security/SecurityManager.java</exclude>
<exclude>src/main/java/org/exist/security/SimpleACLPermissionInternal.java</exclude>
Expand All @@ -1735,7 +1749,11 @@
<exclude>src/test/java/org/exist/security/UnixStylePermissionTest.java</exclude>
<exclude>src/test/java/org/exist/security/XqueryApiTest.java</exclude>
<exclude>src/main/java/org/exist/security/internal/AccountImpl.java</exclude>
<exclude>src/main/java/org/exist/security/internal/RealmImpl.java</exclude>
<exclude>src/main/java/org/exist/security/internal/SecurityManagerImpl.java</exclude>
<exclude>src/main/java/org/exist/security/internal/aider/UnixStylePermissionAider.java</exclude>
<exclude>src/main/java/org/exist/security/management/AccountsManagement.java</exclude>
<exclude>src/main/java/org/exist/security/management/GroupsManagement.java</exclude>
<exclude>src/main/java/org/exist/source/Source.java</exclude>
<exclude>src/main/java/org/exist/source/SourceFactory.java</exclude>
<exclude>src/main/java/org/exist/source/URLSource.java</exclude>
Expand Down
29 changes: 27 additions & 2 deletions exist-core/src/main/java/org/exist/config/ConfigurationDocumentTrigger.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,28 @@
/*
* Elemental
* Copyright (C) 2024, Evolved Binary Ltd
*
* admin@evolvedbinary.com
* https://www.evolvedbinary.com | https://www.elemental.xyz
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; version 2.1.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* NOTE: Parts of this file contain code from 'The eXist-db Authors'.
* The original license header is included below.
*
* =====================================================================
*
* eXist-db Open Source Native XML Database
* Copyright (C) 2001 The eXist-db Authors
*
Expand Down Expand Up @@ -332,9 +356,10 @@ private void processPrincipal(final PrincipalType principalType) throws SAXExcep

//check if there is a name collision, i.e. another principal with the same name
final String principalName = findName();
// first check if the account or group exists before trying to retrieve it
// otherwise the LDAP realm will create a new user, leading to an endless loop

// NOTE(AR) first check if the account or group exists before trying to retrieve it otherwise a realm (e.g. LDAP) may create a new user, which could lead to an endless loop and eventually a StackOverflowError
final boolean principalExists = principalName != null && principalType.hasPrincipal(sm, principalName);

Principal existingPrincipleByName = null;
if (principalExists) {
existingPrincipleByName = principalType.getPrincipal(sm, principalName);
Expand Down
40 changes: 32 additions & 8 deletions exist-core/src/main/java/org/exist/config/Configurator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@
import java.util.function.Predicate;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import javax.annotation.Nullable;
import javax.xml.XMLConstants;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParser;
Expand Down Expand Up @@ -156,9 +157,15 @@ protected static <T extends Annotation> T getAnnotation(Field field, Class<T> an
*
* @return The Getter method for the property or null
*/
public static Method searchForGetMethod(final Class<?> clazz, final String property) {
public static @Nullable Method searchForGetMethod(final Class<?> clazz, final String property) {
try {
final String methodName = ("get" + property).toLowerCase();
String methodName = property;
if (!methodName.startsWith("get-") && !methodName.startsWith("get_")) {
methodName = "get" + methodName;
}
methodName = methodName.replace("-", "");
methodName = methodName.replace("_", "");

for (final Method method : clazz.getMethods()) {
if (method.getName().equalsIgnoreCase(methodName)) {
return method;
Expand All @@ -178,9 +185,15 @@ public static Method searchForGetMethod(final Class<?> clazz, final String prope
*
* @return The Setter method for the field or null
*/
public static Method searchForSetMethod(final Class<?> clazz, final Field field) {
public static @Nullable Method searchForSetMethod(final Class<?> clazz, final Field field) {
try {
final String methodName = ("set" + field.getName()).toLowerCase();
String methodName = field.getName();
if (!methodName.startsWith("set-") && !methodName.startsWith("set_")) {
methodName = "set" + methodName;
}
methodName = methodName.replace("-", "");
methodName = methodName.replace("_", "");

for (final Method method : clazz.getMethods()) {
if (method.getName().equalsIgnoreCase(methodName)) {
return method;
Expand All @@ -200,9 +213,14 @@ public static Method searchForSetMethod(final Class<?> clazz, final Field field)
*
* @return The Adder method for the property or null
*/
public static Method searchForAddMethod(final Class<?> clazz, final String property) {
public static @Nullable Method searchForAddMethod(final Class<?> clazz, final String property) {
try {
final String methodName = ("add" + property).toLowerCase();
String methodName = property;
if (!methodName.startsWith("add-") && !methodName.startsWith("add_")) {
methodName = "add" + methodName;
}
methodName = methodName.replace("-", "");
methodName = methodName.replace("_", "");
for (final Method method : clazz.getMethods()) {
if (method.getName().equalsIgnoreCase(methodName)
&& method.getParameterTypes().length == 1
Expand All @@ -216,9 +234,15 @@ public static Method searchForAddMethod(final Class<?> clazz, final String prope
return null;
}

public static Method searchForInsertMethod(final Class<?> clazz, final String property) {
public static @Nullable Method searchForInsertMethod(final Class<?> clazz, final String property) {
try {
final String methodName = ("insert" + property).toLowerCase();
String methodName = property;
if (!methodName.startsWith("insert-") && !methodName.startsWith("insert_")) {
methodName = "insert" + methodName;
}
methodName = methodName.replace("-", "");
methodName = methodName.replace("_", "");

for (final Method method : clazz.getMethods()) {
if (method.getName().equalsIgnoreCase(methodName)
&& method.getParameterTypes().length == 2
Expand Down
30 changes: 28 additions & 2 deletions exist-core/src/main/java/org/exist/security/AXSchemaType.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,28 @@
/*
* Elemental
* Copyright (C) 2024, Evolved Binary Ltd
*
* admin@evolvedbinary.com
* https://www.evolvedbinary.com | https://www.elemental.xyz
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; version 2.1.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* NOTE: Parts of this file contain code from 'The eXist-db Authors'.
* The original license header is included below.
*
* =====================================================================
*
* eXist-db Open Source Native XML Database
* Copyright (C) 2001 The eXist-db Authors
*
Expand All @@ -21,6 +45,8 @@
*/
package org.exist.security;

import javax.annotation.Nullable;

/**
*
* @author <a href="mailto:adam.retter@googlemail.com">Adam Retter</a>
Expand Down Expand Up @@ -54,7 +80,7 @@ public String getAlias() {
return alias;
}

public static AXSchemaType valueOfNamespace(final String namespace) {
public static @Nullable AXSchemaType valueOfNamespace(final String namespace) {
for(final AXSchemaType axSchemaType : AXSchemaType.values()) {
if(axSchemaType.getNamespace().equals(namespace)) {
return axSchemaType;
Expand All @@ -63,7 +89,7 @@ public static AXSchemaType valueOfNamespace(final String namespace) {
return null;
}

public static AXSchemaType valueOfAlias(final String alias) {
public static @Nullable AXSchemaType valueOfAlias(final String alias) {
for(final AXSchemaType axSchemaType : AXSchemaType.values()) {
if(axSchemaType.getAlias().equals(alias)) {
return axSchemaType;
Expand Down
Loading
Loading