delegating binds to custom partitions

• Key: DIRSERVER-435
• Type: New Feature
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Alex Karasulu
• Reporter: Norval Hope
• Fix Version/s: 1.0-RC1

Description

I have created a patch which permits SimpleAuthenticator to optionally delegate bind calls to the custom partition matching the DN provided to a bind call. This seems like the right general approach to take, but there were some points I wasn't completely certain about (being a noob):
    1) I pass the credentials in as a Object (rather then byte[]) to allow for future flexibility when SASL support is added to DS.
    2) The bind() call returns an InitialContext which SimpleAuthenticator immediately closes, rather then say returning a boolean. This seems sensible though.
    3) Given the new bind() call is only optionally implemented by a ContextPartition, the default bases classes return null when it is called. A NotImplementedException type approach would work just as well, but I am unsure how the relative pros and cons are preceived by the core DS developers (runtime cost versus cleanliness).

I also realise that the bind call is only one of a number of delegations that will eventually need to be supported to custom partitions, but hope that this patch isn't heading in the wrong direction and thus compromising any future work that may be required.

If the patch is deemed useful, but further work is required due to any/all of the reasons above (or some I haven't considered) then let me know.

Comments

[Trustin Lee]

Thank you for your patch first of all, Norbert. But can I know the use case of this patch? BIND operation is used only for authentication and AuthenticationService performs it already. Is there any reason to delegate bind operation to interceptors and context partitions? Any ideas are appreciated.

[Alex Karasulu]

What's the status of this?

[Trustin Lee]

In the long run, we'll have to change the interceptor interface to filter all LDAP operations. It will help users implement LDAP proxy very easily. WDYT?

[Alex Karasulu]

You mean just adding bind() to what we have? I guess that's the only missing operation. However I think this is a wrong turn in our architectural vision.

First because a partitions are for storage. Using them for proxying is tangential to our aims.

A proxy can be implemented in other ways via views. Using a partition to do is effective but a hack. When we implement views proxies can easily be written.

Still there may be some benefit to intercepting a bind operation. Let me think more about this. Bind interception might be good for views too. Thanks T.

[Alex Karasulu]

unbind and bind operations have been added to partitions and piplined. They are now called when there are no authenticators registered to handle the authmeth.

Closing all issues created in 2005 and before which are marked resolved