Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
apache
DolphinScheduler
提交
17a9dd25
DolphinScheduler
项目概览
apache
/
DolphinScheduler
上一次同步 1 年多
通知
707
Star
9572
Fork
3514
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
DolphinScheduler
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
未验证
提交
17a9dd25
编写于
8月 22, 2022
作者:
K
kezhenxu94
提交者:
GitHub
8月 22, 2022
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Fix vulnerability in LDAP login (#11586)
上级
5813a61f
变更
4
隐藏空白更改
内联
并排
Showing
4 changed file
with
20 addition
and
6 deletion
+20
-6
dolphinscheduler-api/pom.xml
dolphinscheduler-api/pom.xml
+5
-0
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/ldap/LdapService.java
.../dolphinscheduler/api/security/impl/ldap/LdapService.java
+8
-6
dolphinscheduler-bom/pom.xml
dolphinscheduler-bom/pom.xml
+6
-0
tools/dependencies/known-dependencies.txt
tools/dependencies/known-dependencies.txt
+1
-0
未找到文件。
dolphinscheduler-api/pom.xml
浏览文件 @
17a9dd25
...
...
@@ -176,6 +176,11 @@
<artifactId>
py4j
</artifactId>
</dependency>
<dependency>
<groupId>
org.springframework
</groupId>
<artifactId>
spring-ldap
</artifactId>
</dependency>
<dependency>
<groupId>
com.h2database
</groupId>
<artifactId>
h2
</artifactId>
...
...
dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/ldap/LdapService.java
浏览文件 @
17a9dd25
...
...
@@ -38,11 +38,13 @@ import org.slf4j.Logger;
import
org.slf4j.LoggerFactory
;
import
org.springframework.beans.factory.annotation.Value
;
import
org.springframework.context.annotation.Configuration
;
import
org.springframework.ldap.support.filter.EqualsFilter
;
import
org.springframework.stereotype.Component
;
@Component
@Configuration
public
class
LdapService
{
private
static
final
Logger
logger
=
LoggerFactory
.
getLogger
(
LdapService
.
class
);
@Value
(
"${security.authentication.ldap.user.admin:#{null}}"
)
...
...
@@ -89,20 +91,19 @@ public class LdapService {
Properties
searchEnv
=
getManagerLdapEnv
();
LdapContext
ctx
=
null
;
try
{
//Connect to the LDAP server and Authenticate with a service user of whom we know the DN and credentials
//
Connect to the LDAP server and Authenticate with a service user of whom we know the DN and credentials
ctx
=
new
InitialLdapContext
(
searchEnv
,
null
);
SearchControls
sc
=
new
SearchControls
();
sc
.
setReturningAttributes
(
new
String
[]{
ldapEmailAttribute
});
sc
.
setSearchScope
(
SearchControls
.
SUBTREE_SCOPE
);
String
searchFilter
=
String
.
format
(
"(%s=%s)"
,
ldapUserIdentifyingAttribute
,
userId
);
//Search for the user you want to authenticate, search him with some attribute
NamingEnumeration
<
SearchResult
>
results
=
ctx
.
search
(
ldapBaseDn
,
searchFilter
,
sc
);
EqualsFilter
filter
=
new
EqualsFilter
(
ldapUserIdentifyingAttribute
,
userId
);
NamingEnumeration
<
SearchResult
>
results
=
ctx
.
search
(
ldapBaseDn
,
filter
.
toString
(),
sc
);
if
(
results
.
hasMore
())
{
// get the users DN (distinguishedName) from the result
SearchResult
result
=
results
.
next
();
NamingEnumeration
<?
extends
Attribute
>
attrs
=
result
.
getAttributes
().
getAll
();
while
(
attrs
.
hasMore
())
{
//Open another connection to the LDAP server with the found DN and the password
//
Open another connection to the LDAP server with the found DN and the password
searchEnv
.
put
(
Context
.
SECURITY_PRINCIPAL
,
result
.
getNameInNamespace
());
searchEnv
.
put
(
Context
.
SECURITY_CREDENTIALS
,
userPwd
);
try
{
...
...
@@ -149,7 +150,8 @@ public class LdapService {
public
LdapUserNotExistActionType
getLdapUserNotExistAction
()
{
if
(
StringUtils
.
isBlank
(
ldapUserNotExistAction
))
{
logger
.
info
(
"security.authentication.ldap.user.not.exist.action configuration is empty, the default value 'CREATE'"
);
logger
.
info
(
"security.authentication.ldap.user.not.exist.action configuration is empty, the default value 'CREATE'"
);
return
LdapUserNotExistActionType
.
CREATE
;
}
...
...
dolphinscheduler-bom/pom.xml
浏览文件 @
17a9dd25
...
...
@@ -609,6 +609,12 @@
<!-- TODO: remove this dependency management after removing powermock -->
<scope>
test
</scope>
</dependency>
<dependency>
<groupId>
org.springframework
</groupId>
<artifactId>
spring-ldap
</artifactId>
<version>
1.1.2
</version>
</dependency>
</dependencies>
</dependencyManagement>
...
...
tools/dependencies/known-dependencies.txt
浏览文件 @
17a9dd25
...
...
@@ -251,6 +251,7 @@ spring-core-5.3.19.jar
spring-expression-5.3.22.jar
spring-jcl-5.3.22.jar
spring-jdbc-5.3.19.jar
spring-ldap-1.1.2.jar
spring-plugin-core-2.0.0.RELEASE.jar
spring-plugin-metadata-2.0.0.RELEASE.jar
spring-tx-5.3.19.jar
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录