001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing,
013 * software distributed under the License is distributed on an
014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 * KIND, either express or implied.  See the License for the
016 * specific language governing permissions and limitations
017 * under the License.
018 */
019package org.apache.shiro.realm.ldap;
020
021import javax.naming.NamingException;
022import javax.naming.ldap.LdapContext;
023
024/**
025 * Interface that encapsulates the creation of {@code LdapContext} objects that are used by {@link DefaultLdapRealm}s to
026 * perform authentication attempts and query for authorization data.
027 *
028 * @since 0.2
029 */
030public interface LdapContextFactory {
031
032    /**
033     * Creates (or retrieves from a pool) a {@code LdapContext} connection bound using the system account, or
034     * anonymously if no system account is configured.
035     *
036     * @return a {@code LdapContext} bound by the system account, or bound anonymously if no system account
037     * is configured.
038     * @throws javax.naming.NamingException if there is an error creating the context.
039     */
040    LdapContext getSystemLdapContext() throws NamingException;
041
042    /**
043     * Creates (or retrieves from a pool) an {@code LdapContext} connection bound using the specified principal and
044     * credentials.  The format of the principal and credentials are whatever is supported by the underlying
045     * LDAP {@link javax.naming.spi.InitialContextFactory InitialContextFactory} implementation.  The default Sun
046     * (now Oracle) implementation supports
047     * <a href="http://download-llnw.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html">anonymous, simple, and
048     * SASL-based mechanisms</a>.
049     * <p/>
050     * This method was added in Shiro 1.1 to address the fact that principals and credentials can be more than just
051     * {@code String} user DNs and passwords for connecting to LDAP.  For example, the credentials can be an
052     * {@code X.509} certificate.
053     *
054     * @param principal   the principal to use when acquiring a connection to the LDAP directory
055     * @param credentials the credentials (password, X.509 certificate, etc.) to use when acquiring a connection to the
056     *                    LDAP directory
057     * @return the acquired {@code LdapContext} connection bound using the specified principal and credentials.
058     * @throws NamingException if unable to acquire a connection.
059     * @since 1.1
060     */
061    LdapContext getLdapContext(Object principal, Object credentials) throws NamingException;
062
063}