{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerekvizity pre implementáciu","type":"text"}]},{"type":"paragraph","content":[{"text":"Údaje potrebné na implementáciu a konfiguráciu aplikácie:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Doména AD","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"URL adresa na LDAP","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"LDAP Search base ","type":"text","marks":[{"type":"strong"}]},{"text":"-","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"adresár v štruktúre AD od ktorého budú kladené dopyty","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"autorizačné údaje do LDAP pre technického používateľa","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Maven dependencies","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n org.springframework.ldap\n spring-ldap-core\n\n\n org.springframework.security\n spring-security-ldap\n\n\n com.unboundid\n unboundid-ldapsdk\n\n\n org.springframework.data\n spring-data-ldap\n","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Konfigurácia na úrovni aplikácie","type":"text"}]},{"type":"paragraph","content":[{"text":"Na integráciu s AD je potrebné override-núť default engine security konfiguráciu a rozšíriť ju o nasledovné nastavenia a Bean deklarácie. Taktiež je potrebné doplniť konfiguračné properties ako:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"adDomain","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ldapUrl","type":"text","marks":[{"type":"code"}]},{"text":" - URL adresa na LDAP v podobe ","type":"text"},{"text":"ldap//:{url}","type":"text","marks":[{"type":"code"}]},{"text":", port štandardne ","type":"text"},{"text":"389","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ldapSearchBase","type":"text","marks":[{"type":"code"}]},{"text":" - adresár v štruktúre AD, napr. ","type":"text"},{"text":"CN=Users,DC=domena,DC=sk","type":"text","marks":[{"type":"em"}]},{"text":"), ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ldapSearchFilter","type":"text","marks":[{"type":"code"}]},{"text":" filter na dohľadanie konkrétneho používateľa s parametrom, napr. ","type":"text"},{"text":"(userPrincipalName={0})","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"Do resource súboru ","type":"text"},{"text":"application.properties","type":"text","marks":[{"type":"strong"}]},{"text":" je potrebné dané údaje doplniť nasledovným spôsobom (a doplniť skutočné hodnoty za ","type":"text"},{"text":"{ } ","type":"text","marks":[{"type":"em"}]},{"text":"). Properties začínajúce na ","type":"text"},{"text":"spring.","type":"text","marks":[{"type":"code"}]},{"text":" vlastní samotný Spring a musia mať túto podobu, ostatné nemajú žiaden predpis.","type":"text"}]},{"type":"codeBlock","content":[{"text":"spring.data.ldap.repositories.enabled=true\nspring.ldap.username={username}\nspring.ldap.password={password}\nspring.ldap.urls=ldap://{url}\nspring.ldap.base={base}\n\ncustom.nastavenie.ad-domain={AD domena}\ncustom.nastavenie.ldap-search-filter={filter}","type":"text"}]},{"type":"paragraph","content":[{"text":"Override security konfigurácie:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@Configuration\n@Controller\n@EnableWebSecurity\n@Order(SecurityProperties.DEFAULT_FILTER_ORDER)\npublic class CustomSecurityConfiguration extends com.netgrif.workflow.configuration.SecurityConfiguration {\n ...\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Doplnenie potrebných properties a metód do security konfigurácie:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@Override\npublic void configure(AuthenticationManagerBuilder auth) throws Exception {\n auth.authenticationProvider(activeDirectoryLdapAuthenticationProvider());\n}","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@Value(\"${spring.ldap.urls}\")\nprivate String ldapUrl;\n\n@Value(\"${spring.ldap.base}\")\nprivate String base;\n\n@Value(\"${custom.nastavenie.ad-domain}\")\nprivate String domain;\n\n@Value(\"${custom.nastavenie.ldap-search-filter}\")\nprivate String ldapSearchFilter;\n\n@Bean\npublic ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider(){\n ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new\n ActiveDirectoryLdapAuthenticationProvider(this.adDomain, this.ldapUrl, this.ldapSearchBase);\n activeDirectoryLdapAuthenticationProvider.setUserDetailsContextMapper(new UserDetailsContextMapperImpl());\n activeDirectoryLdapAuthenticationProvider.setSearchFilter(this.ldapSearchFilter);\n return activeDirectoryLdapAuthenticationProvider;\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Ďalej je potrebné implementovať mapping triedu zodpovednú za vytvorenie používateľa po autentifikácii a poskytnutie objektu prihláseného používateľa (UserDetails, v NAE štandardne LoggedUser) Spring-u.","type":"text"}]},{"type":"paragraph","content":[{"text":"Všetky atribúty používateľa z AD sú dostupné v objekte ","type":"text"},{"text":"dirContextOperations","type":"text","marks":[{"type":"code"}]},{"text":". Údaje osoby je možné taktiež získať použitím LDAP repozitáru (definícia nižšie).","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"public class UserDetailsContextMapperImpl implements UserDetailsContextMapper {\n\n @Override\n public UserDetails mapUserFromContext(DirContextOperations dirContextOperations, String username, Collection authorities) {\n Optional ldapUserOptional = ldapUserRepository.findById(dirContextOperations.getDn());\n LdapUser ldapUser;\n if (!ldapUserOptional.isPresent()) {\n log.warn(\"User not found in LDAP \" + username);\n return null;\n }\n ldapUser = ldapUserOptional.get();\n // vytvorenie používateľa v DB ak neexistuje\n User user = ...\n\n return user.transformToLoggedUser();\n }\n\n @Override\n public void mapUserToContext(UserDetails userDetails, DirContextAdapter dirContextAdapter) {\n throw new UnsupportedOperationException(\"Not implemented\");\n }\n}","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Je odporúčané vhodným spôsobom rozšíriť/nahradiť User objekt tak, aby bolo možné ukladať jednoznačný údaj o tom, ku ktorej osobe v AD daný záznam prislúcha - napr. na základe DN, prípadne ","type":"text"},{"text":"userPrincipalName","type":"text","marks":[{"type":"code"}]},{"text":" alebo ","type":"text"},{"text":"sAMAccountName","type":"text","marks":[{"type":"code"}]},{"text":". Rozšírenie User objektu vyžaduje override prakticky celej UserService, ktorú NAE implementuje a bežne používa.","type":"text"}]},{"type":"paragraph","content":[{"text":"NAE interne v určitých metódach používateľov dohľadáva cez ID (typu Long), z tohto dôvodu je potrebné aby používatelia boli ukladaní v DB a vždy podľa tohto údaju dohľadateľní.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Pre dohľadávanie používateľov je užitočné doplniť nasledovnú entitnú a repository triedu:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@Entry(\n base = \"{search base}\",\n objectClasses = {\"Top\"} // pripadne ine objectClasses ktore pouzivatelske objekty reprezentuju\n)\n@Data\npublic final class LdapUser {\n\n @Id\n private Name dn;\n\n @Attribute(name = \"cn\")\n private String commonName;\n\n @Attribute(name = \"mail\")\n private String mail;\n\n @Attribute(name = \"userPrincipalName\")\n private String userPrincipalName;\n\n @Attribute(name = \"sAMAccountName\")\n private String uid;\n\n @Attribute(name = \"givenName\")\n private String givenName;\n\n @Attribute(name = \"displayName\")\n private String fullName;\n\n @Attribute(name = \"sn\")\n private String surname;\n\n @Attribute(name = \"objectClass\")\n private List objectClass;\n\n @Attribute(name = \"memberOf\")\n private List memberOf;\n\n @Attribute(name = \"description\")\n private String description;\n\n public LdapUser() {\n objectClass = new ArrayList<>();\n memberOf = new ArrayList<>();\n }\n}","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@Repository\npublic interface LdapUserRepository extends LdapRepository, QuerydslPredicateExecutor {\n\n List findAllByMail(String mail);\n\n LdapUser findByUid(String commonName);\n\n List findAll(Predicate predicate);\n\n List findAll();\n}","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Metódy do Spring Repository interface tried je možné ľubovoľne dopĺnať a Spring ich automaticky doimplementuje na základe štruktúry ich názvov.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"V neposlednom rade je potrebné na main triedu aplikácie doplniť anotáciu ","type":"text"},{"text":"@EnableLdapRepositories","type":"text","marks":[{"type":"code"}]},{"text":", viď nižšie:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"java"},"content":[{"text":"@SpringBootApplication\n@EnableAsync\n@EnableCaching\n@ComponentScan({\"com.netgrif.workflow\", \"com.spolocnost.aplikacia\"})\n@EnableLdapRepositories\npublic class NetgrifDemoApp {\n ...\n}","type":"text"}]},{"type":"paragraph"}],"version":1}