DefaultDirectoryService.createBootstrapEntries() throws NullPointerException if no authorizationService is configured

• Key: DIRSERVER-746
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Minor
• Assignee: Unassigned
• Reporter: Bastiaan Bakker
• Component/s: core

Description

DefaultDirectoryService.createBootstrapEntries() has a hardcoded dependency on AuthorizationService being configured as the 'authorizationService' interceptor. If one does not want to configure an authorizationService the code in question will throw a NullPointerException. Also if one does configure a different authorizationService implementation the code will throw a ClassCastException.
Clearly the code should not assume an AuthorizationService instance has been configured as the 'authorizationService' interceptor.

Comments

[Bastiaan Bakker]

The attached patchs adds a check to DefaultDirectoryService.createBootstrapEntries() to ensure that the authorizarionService interceptor exists and is an instance of AuthorizationService before calling cacheNewGroup()

[Emmanuel Lecharny]

Thanks for the post Bastiaan. And sorry for the loooooong time it took to respond.

Thanks for the report and for the patch. Nice catch !

I have somehow inverted the logic for this part : if we don't have an AuthorizationService, or if it's not a correct interceptor, then an exception is thrown (the Ldap Server is always supposed to set this kind of interceptor). If no authorization service is needed, then a pass-through service mst be created.

Here is the modified code :
...
            Interceptor authzInterceptor = interceptorChain.get( "authorizationService" );
            
            if ( authzInterceptor == null )
            {
                log.error( "The Authorization service is null : this is not allowed" );
                throw new NamingException( "The Authorization service is null" );
            }
            
            if ( !( authzInterceptor instanceof AuthorizationService) )
            {
                log.error( "The Authorization service is not set correctly : '{}' is an incorect interceptor",
                    authzInterceptor.getClass().getName() );
                throw new NamingException( "The Authorization service is incorrectly set" );
                
            }

            AuthorizationService authzSrvc = ( AuthorizationService ) authzInterceptor;
            authzSrvc.cacheNewGroup( upName, normName, attributes );
...

[Emmanuel Lecharny]

Fixed in 1.0.1 :
http://svn.apache.org/viewvc?view=rev&rev=499801

Fixed in 1.5.0 :
http://svn.apache.org/viewvc?view=rev&rev=499802

closed