Returns ExtendedGeorchestra* objects when createUserInLdap set to true

Considering the following configuration scenario:

* external authentication (oidc/oauth2 or pre-auth) being configured
* `createUsersInGeorchestraLdap` set to true

Then the resolved GeorchestraUser should be an
`ExtendedGeorchestraUser`, in order to have a behaviour coherent with
the extended geOrchestra LDAP authentication.

Without doing so, users externally authenticated will resolve as a
classic GeorchestraUser, leading to missing http headers and breaking
some geOrchestra applications (e.g. datafeeder, which requires the
`sec-orgname` provided only when resolving to an
`ExtendedGeorchestraUser`).

This also refactors the LdapConfigProperties to
GeorchestraGatewaySecurityConfigProperties, as the object is not only
about LDAP, but also nests some other configureable features (OIDC,
...).

Documentation has been updated to describe / explain the behaviour.

Tests:
* testsuite adapted
* added specific tests case scenario

docs/authzn.adoc

@@ -276,3 +276,24 @@ sec-roles: ROLE_ORG_6007280321;ROLE_GDI_PLANER;ROLE_GDI_EDITOR;ROLE_USER
 sec-org: 6007280321
 ```
 
+== Automatically creating users in a geOrchestra LDAP
+
+As in the <<pre-authentication.adoc#,pre-authentication method>>, it is possible
+to create externally authenticated users into a geOrchestra (extended) LDAP, so
+that an administrator can promote the user to a higher role than `USER` by default.
+
+In order to do so, you will need to set the following property, and make sure
+an `extended` LDAP named `default` is defined, as in the following configuration
+snippet:
+
+```
+georchestra:
+ gateway:
+ security:
+ create-non-existing-users-in-l-d-a-p: true
+ ldap:
+ default:
+ enabled: true
+ extended: true
+ [...]
+```

gateway/src/main/java/org/georchestra/gateway/accounts/admin/AbstractAccountsManager.java

@@ -57,7 +57,7 @@ protected Optional<GeorchestraUser> findInternal(GeorchestraUser mappedUser) {
  return findByUsername(mappedUser.getUsername());
  }
 
- GeorchestraUser createIfMissing(GeorchestraUser mapped) {
+ protected GeorchestraUser createIfMissing(GeorchestraUser mapped) {
  lock.writeLock().lock();
  try {
  GeorchestraUser existing = findInternal(mapped).orElse(null);

gateway/src/main/java/org/georchestra/gateway/accounts/admin/AccountCreated.java

@@ -24,7 +24,7 @@
 import lombok.Value;
 
 /**
- * Application event published when a new account was created
+ * Application event published when a new account has been created
  */
 @Value
 public class AccountCreated {

gateway/src/main/java/org/georchestra/gateway/accounts/admin/ldap/GeorchestraLdapAccountManagementConfiguration.java

@@ -35,7 +35,8 @@
 import org.georchestra.ds.users.UserRule;
 import org.georchestra.gateway.accounts.admin.AccountManager;
 import org.georchestra.gateway.accounts.admin.CreateAccountUserCustomizer;
-import org.georchestra.gateway.security.ldap.LdapConfigProperties;
+import org.georchestra.gateway.security.GeorchestraGatewaySecurityConfigProperties;
+import org.georchestra.gateway.security.ldap.extended.DemultiplexingUsersApi;
 import org.georchestra.gateway.security.ldap.extended.ExtendedLdapConfig;
 import org.georchestra.security.api.UsersApi;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
@@ -48,16 +49,21 @@
 import org.springframework.ldap.pool.validation.DefaultDirContextValidator;
 
 @Configuration(proxyBeanMethods = false)
-@EnableConfigurationProperties(LdapConfigProperties.class)
+@EnableConfigurationProperties(GeorchestraGatewaySecurityConfigProperties.class)
 public class GeorchestraLdapAccountManagementConfiguration {
 
  @Bean
  AccountManager ldapAccountsManager(//
  ApplicationEventPublisher eventPublisher, //
- AccountDao accountDao, RoleDao roleDao, OrgsDao orgsDao) {
+ AccountDao accountDao, //
+ RoleDao roleDao, //
+ OrgsDao orgsDao, //
+ DemultiplexingUsersApi demultiplexingUsersApi,
+ GeorchestraGatewaySecurityConfigProperties configProperties) {
 
  UsersApi usersApi = ldapUsersApi(accountDao, roleDao);
- return new LdapAccountsManager(eventPublisher::publishEvent, accountDao, roleDao, orgsDao, usersApi);
+ return new LdapAccountsManager(eventPublisher::publishEvent, accountDao, roleDao, orgsDao,
+ demultiplexingUsersApi, configProperties);
  }
 
  @Bean
@@ -79,7 +85,7 @@ private UsersApi ldapUsersApi(AccountDao accountDao, RoleDao roleDao) {
  }
 
  @Bean
- LdapContextSource singleContextSource(LdapConfigProperties config) {
+ LdapContextSource singleContextSource(GeorchestraGatewaySecurityConfigProperties config) {
  ExtendedLdapConfig ldapConfig = config.extendedEnabled().get(0);
  LdapContextSource singleContextSource = new LdapContextSource();
  singleContextSource.setUrl(ldapConfig.getUrl());
@@ -110,15 +116,15 @@ LdapTemplate ldapTemplate(PoolingContextSource contextSource) throws Exception {
  }
 
  @Bean
- RoleDao roleDao(LdapTemplate ldapTemplate, LdapConfigProperties config) {
+ RoleDao roleDao(LdapTemplate ldapTemplate, GeorchestraGatewaySecurityConfigProperties config) {
  RoleDaoImpl impl = new RoleDaoImpl();
  impl.setLdapTemplate(ldapTemplate);
  impl.setRoleSearchBaseDN(config.extendedEnabled().get(0).getRolesRdn());
  return impl;
  }
 
  @Bean
- OrgsDao orgsDao(LdapTemplate ldapTemplate, LdapConfigProperties config) {
+ OrgsDao orgsDao(LdapTemplate ldapTemplate, GeorchestraGatewaySecurityConfigProperties config) {
  OrgsDaoImpl impl = new OrgsDaoImpl();
  impl.setLdapTemplate(ldapTemplate);
  ExtendedLdapConfig ldapConfig = config.extendedEnabled().get(0);
@@ -129,7 +135,8 @@ OrgsDao orgsDao(LdapTemplate ldapTemplate, LdapConfigProperties config) {
  }
 
  @Bean
- AccountDao accountDao(LdapTemplate ldapTemplate, LdapConfigProperties config) throws Exception {
+ AccountDao accountDao(LdapTemplate ldapTemplate, GeorchestraGatewaySecurityConfigProperties config)
+ throws Exception {
  ExtendedLdapConfig ldapConfig = config.extendedEnabled().get(0);
  String baseDn = ldapConfig.getBaseDn();
  String userSearchBaseDN = ldapConfig.getUsersRdn();

gateway/src/main/java/org/georchestra/gateway/accounts/admin/ldap/LdapAccountsManager.java

@@ -18,34 +18,29 @@
  */
 package org.georchestra.gateway.accounts.admin.ldap;
 
-import java.util.Arrays;
-import java.util.List;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.stream.Collectors;
-
+import lombok.NonNull;
+import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.georchestra.ds.DataServiceException;
 import org.georchestra.ds.DuplicatedCommonNameException;
 import org.georchestra.ds.orgs.Org;
 import org.georchestra.ds.orgs.OrgsDao;
 import org.georchestra.ds.roles.RoleDao;
 import org.georchestra.ds.roles.RoleFactory;
-import org.georchestra.ds.users.Account;
-import org.georchestra.ds.users.AccountDao;
-import org.georchestra.ds.users.AccountFactory;
-import org.georchestra.ds.users.DuplicatedEmailException;
-import org.georchestra.ds.users.DuplicatedUidException;
-import org.georchestra.gateway.accounts.admin.AbstractAccountsManager;;
+import org.georchestra.ds.users.*;
+import org.georchestra.gateway.accounts.admin.AbstractAccountsManager;
 import org.georchestra.gateway.accounts.admin.AccountManager;
-import org.georchestra.security.api.UsersApi;
+import org.georchestra.gateway.security.GeorchestraGatewaySecurityConfigProperties;
+import org.georchestra.gateway.security.ldap.extended.DemultiplexingUsersApi;
 import org.georchestra.security.model.GeorchestraUser;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.ldap.NameNotFoundException;
 
-import lombok.NonNull;
-import lombok.extern.slf4j.Slf4j;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.stream.Collectors;
 
 /**
  * {@link AccountManager} that fetches and creates {@link GeorchestraUser}s from
@@ -55,30 +50,31 @@
 @Slf4j(topic = "org.georchestra.gateway.accounts.admin.ldap")
 class LdapAccountsManager extends AbstractAccountsManager {
 
- private @Value("${georchestra.gateway.security.defaultOrganization:}") String defaultOrganization;
+ private final @NonNull GeorchestraGatewaySecurityConfigProperties georchestraGatewaySecurityConfigProperties;
  private final @NonNull AccountDao accountDao;
  private final @NonNull RoleDao roleDao;
-
  private final @NonNull OrgsDao orgsDao;
- private final @NonNull UsersApi usersApi;
+ private final @NonNull DemultiplexingUsersApi demultiplexingUsersApi;
 
  public LdapAccountsManager(ApplicationEventPublisher eventPublisher, AccountDao accountDao, RoleDao roleDao,
- OrgsDao orgsDao, UsersApi usersApi) {
+ OrgsDao orgsDao, DemultiplexingUsersApi demultiplexingUsersApi,
+ GeorchestraGatewaySecurityConfigProperties georchestraGatewaySecurityConfigProperties) {
  super(eventPublisher);
  this.accountDao = accountDao;
  this.roleDao = roleDao;
  this.orgsDao = orgsDao;
- this.usersApi = usersApi;
+ this.demultiplexingUsersApi = demultiplexingUsersApi;
+ this.georchestraGatewaySecurityConfigProperties = georchestraGatewaySecurityConfigProperties;
  }
 
  @Override
  protected Optional<GeorchestraUser> findByOAuth2Uid(@NonNull String oAuth2Provider, @NonNull String oAuth2Uid) {
- return usersApi.findByOAuth2Uid(oAuth2Provider, oAuth2Uid).map(this::ensureRolesPrefixed);
+ return demultiplexingUsersApi.findByOAuth2Uid(oAuth2Provider, oAuth2Uid).map(this::ensureRolesPrefixed);
  }
 
  @Override
  protected Optional<GeorchestraUser> findByUsername(@NonNull String username) {
- return usersApi.findByUsername(username).map(this::ensureRolesPrefixed);
+ return demultiplexingUsersApi.findByUsername(username).map(this::ensureRolesPrefixed);
  }
 
  private GeorchestraUser ensureRolesPrefixed(GeorchestraUser user) {
@@ -150,8 +146,9 @@ private Account mapToAccountBrief(@NonNull GeorchestraUser preAuth) {
  Account newAccount = AccountFactory.createBrief(username, password, firstName, lastName, email, phone, title,
  description, oAuth2Provider, oAuth2Uid);
  newAccount.setPending(false);
- if (StringUtils.isEmpty(org) && !StringUtils.isBlank(defaultOrganization)) {
- newAccount.setOrg(defaultOrganization);
+ String defaultOrg = this.georchestraGatewaySecurityConfigProperties.getDefaultOrganization();
+ if (StringUtils.isEmpty(org) && !StringUtils.isBlank(defaultOrg)) {
+ newAccount.setOrg(defaultOrg);
  } else {
  newAccount.setOrg(org);
  }

gateway/src/main/java/org/georchestra/gateway/app/GeorchestraGatewayApplication.java

@@ -28,7 +28,7 @@
 import javax.annotation.PostConstruct;
 
 import org.georchestra.gateway.security.GeorchestraUserMapper;
-import org.georchestra.gateway.security.ldap.LdapConfigProperties;
+import org.georchestra.gateway.security.GeorchestraGatewaySecurityConfigProperties;
 import org.georchestra.security.model.GeorchestraUser;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
@@ -58,13 +58,13 @@
 @Controller
 @Slf4j
 @SpringBootApplication
-@EnableConfigurationProperties(LdapConfigProperties.class)
+@EnableConfigurationProperties(GeorchestraGatewaySecurityConfigProperties.class)
 public class GeorchestraGatewayApplication {
 
  private @Autowired RouteLocator routeLocator;
  private @Autowired GeorchestraUserMapper userMapper;
 
- private @Autowired(required = false) LdapConfigProperties ldapConfigProperties;
+ private @Autowired(required = false) GeorchestraGatewaySecurityConfigProperties georchestraGatewaySecurityConfigProperties;
 
  private boolean ldapEnabled = false;
 
@@ -79,8 +79,9 @@ public static void main(String[] args) {
 
  @PostConstruct
  void initialize() {
- if (ldapConfigProperties != null) {
- ldapEnabled = ldapConfigProperties.getLdap().values().stream().anyMatch((server -> server.isEnabled()));
+ if (georchestraGatewaySecurityConfigProperties != null) {
+ ldapEnabled = georchestraGatewaySecurityConfigProperties.getLdap().values().stream()
+ .anyMatch((server -> server.isEnabled()));
  }
  }
 

gateway/src/main/java/org/georchestra/gateway/autoconfigure/accounts/ConditionalOnCreateLdapAccounts.java

@@ -35,7 +35,7 @@
 @Retention(RetentionPolicy.RUNTIME)
 @Documented
 @ConditionalOnDefaultGeorchestraLdapEnabled
-@ConditionalOnProperty(name = "georchestra.gateway.security.createNonExistingUsersInLDAP", havingValue = "true", matchIfMissing = false)
+@ConditionalOnProperty(name = "georchestra.gateway.security.create-non-existing-users-in-l-d-a-p", havingValue = "true", matchIfMissing = false)
 public @interface ConditionalOnCreateLdapAccounts {
 
 }

gateway/src/main/java/org/georchestra/gateway/autoconfigure/accounts/GeorchestraLdapAccountsCreationAutoConfiguration.java

@@ -19,9 +19,15 @@
 package org.georchestra.gateway.autoconfigure.accounts;
 
 import org.georchestra.gateway.accounts.admin.ldap.GeorchestraLdapAccountManagementConfiguration;
+import org.georchestra.gateway.security.ldap.extended.ExtendedLdapAuthenticationConfiguration;
+import org.georchestra.gateway.security.ldap.extended.ExtendedLdapConfig;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.AutoConfiguration;
 import org.springframework.context.annotation.Import;
 
+import javax.annotation.PostConstruct;
+import java.util.List;
+
 /**
  * {@link AutoConfiguration @AutoConfiguration}
  * 
@@ -30,6 +36,16 @@
  */
 @AutoConfiguration
 @ConditionalOnCreateLdapAccounts
-@Import(GeorchestraLdapAccountManagementConfiguration.class)
+@Import({ GeorchestraLdapAccountManagementConfiguration.class, ExtendedLdapAuthenticationConfiguration.class })
 public class GeorchestraLdapAccountsCreationAutoConfiguration {
-}
+
+ @Autowired
+ private List<ExtendedLdapConfig> configs;
+
+ @PostConstruct
+ void failIfNoExtendedLdapCongfigs() {
+ if (configs.isEmpty()) {
+ throw new IllegalStateException("LDAP account creation requires an extended LDAP configuration");
+ }
+ }
+}

gateway/src/main/java/org/georchestra/gateway/autoconfigure/security/AtLeastOneLdapDatasourceEnabledCondition.java

@@ -28,7 +28,7 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import org.georchestra.gateway.security.ldap.LdapConfigProperties;
+import org.georchestra.gateway.security.GeorchestraGatewaySecurityConfigProperties;
 import org.springframework.boot.autoconfigure.condition.ConditionMessage;
 import org.springframework.boot.autoconfigure.condition.ConditionMessage.ItemsBuilder;
 import org.springframework.boot.autoconfigure.condition.ConditionOutcome;
@@ -48,7 +48,7 @@
  * the externalized config properties
  * {@code georchestra.gateway.security.ldap.<configName>.enabled}
  * 
- * @see LdapConfigProperties
+ * @see GeorchestraGatewaySecurityConfigProperties
  */
 class AtLeastOneLdapDatasourceEnabledCondition extends SpringBootCondition {
 

gateway/src/main/java/org/georchestra/gateway/security/ldap/LdapConfigProperties.java → gateway/src/main/java/org/georchestra/gateway/security/GeorchestraGatewaySecurityConfigProperties.java

@@ -16,7 +16,7 @@
  * You should have received a copy of the GNU General Public License along with
  * geOrchestra. If not, see <http://www.gnu.org/licenses/>.
  */
-package org.georchestra.gateway.security.ldap;
+package org.georchestra.gateway.security;
 
 import java.util.List;
 import java.util.Map;
@@ -26,6 +26,8 @@
 
 import javax.validation.Valid;
 
+import org.georchestra.gateway.security.ldap.LdapConfigBuilder;
+import org.georchestra.gateway.security.ldap.LdapConfigPropertiesValidations;
 import org.georchestra.gateway.security.ldap.basic.LdapServerConfig;
 import org.georchestra.gateway.security.ldap.extended.ExtendedLdapConfig;
 import org.springframework.boot.context.properties.ConfigurationProperties;
@@ -61,10 +63,12 @@
 @Validated
 @Accessors(chain = true)
 @ConfigurationProperties(prefix = "georchestra.gateway.security")
-public class LdapConfigProperties implements Validator {
+public class GeorchestraGatewaySecurityConfigProperties implements Validator {
 
  private boolean createNonExistingUsersInLDAP = true;
 
+ private String defaultOrganization = "";
+
  @Valid
  private Map<String, Server> ldap = Map.of();
 
@@ -182,12 +186,12 @@ public class LdapConfigProperties implements Validator {
  }
 
  public @Override boolean supports(Class<?> clazz) {
- return LdapConfigProperties.class.equals(clazz);
+ return GeorchestraGatewaySecurityConfigProperties.class.equals(clazz);
  }
 
  @Override
  public void validate(Object target, Errors errors) {
- LdapConfigProperties config = (LdapConfigProperties) target;
+ GeorchestraGatewaySecurityConfigProperties config = (GeorchestraGatewaySecurityConfigProperties) target;
  Map<String, Server> ldap = config.getLdap();
  if (ldap == null || ldap.isEmpty()) {
  return;

gateway/src/main/java/org/georchestra/gateway/security/ldap/LdapAuthenticationConfiguration.java

@@ -22,6 +22,7 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import org.georchestra.gateway.security.GeorchestraGatewaySecurityConfigProperties;
 import org.georchestra.gateway.security.ServerHttpSecurityCustomizer;
 import org.georchestra.gateway.security.ldap.basic.BasicLdapAuthenticationConfiguration;
 import org.georchestra.gateway.security.ldap.basic.BasicLdapAuthenticationProvider;
@@ -49,9 +50,11 @@
  * authorization across multiple LDAP databases.
  * <p>
  * This configuration sets up the required beans for spring-based LDAP
- * authentication and authorization, using {@link LdapConfigProperties} to get
- * the {@link LdapConfigProperties#getUrl() connection URL} and the
- * {@link LdapConfigProperties#getBaseDn() base DN}.
+ * authentication and authorization, using
+ * {@link GeorchestraGatewaySecurityConfigProperties} to get the
+ * {@link GeorchestraGatewaySecurityConfigProperties#getUrl() connection URL}
+ * and the {@link GeorchestraGatewaySecurityConfigProperties#getBaseDn() base
+ * DN}.
  * <p>
  * As a result, the {@link ServerHttpSecurity} will have HTTP-Basic
  * authentication enabled and {@link ServerHttpSecurity#formLogin() form login}
@@ -68,12 +71,12 @@
  * the matching gateway-route configuration. See
  * {@link ExtendedLdapAuthenticationConfiguration} for further details.
  * 
- * @see LdapConfigProperties
+ * @see GeorchestraGatewaySecurityConfigProperties
  * @see BasicLdapAuthenticationConfiguration
  * @see ExtendedLdapAuthenticationConfiguration
  */
 @Configuration(proxyBeanMethods = true)
-@EnableConfigurationProperties(LdapConfigProperties.class)
+@EnableConfigurationProperties(GeorchestraGatewaySecurityConfigProperties.class)
 @Import({ //
  BasicLdapAuthenticationConfiguration.class, //
  ExtendedLdapAuthenticationConfiguration.class })