dbeaver/pro#6612 ldap group mapping full dn (#3966)

* dbeaver/pro#6612 ldap group mapping full dn

* dbeaver/pro#6612 ldap group mapping full dn

---------

Co-authored-by: Evgenia <139753579+EvgeniaBzzz@users.noreply.github.com>

server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/WebConnectionInfo.java

@@ -341,6 +341,16 @@ public class WebConnectionInfo {
         if (CommonUtils.isEmpty(authModelId)) {
             authModelId = AuthModelDatabaseNative.ID;
         }
+
+        // Patch auth model
+        DBPAuthModelDescriptor authModel = DBWorkbench.getPlatform().getDataSourceProviderRegistry().getAuthModel(authModelId);
+        if (authModel != null) {
+            DBPAuthModelDescriptor amReplace = authModel.getReplacedBy(dataSourceContainer.getDriver());
+            if (amReplace != null && amReplace != authModel) {
+                return amReplace.getId();
+            }
+        }
+
         return authModelId;
     }
 

server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/server/CBApplicationCE.java

@@ -17,8 +17,6 @@
 package io.cloudbeaver.server;
 
 import io.cloudbeaver.auth.NoAuthCredentialsProvider;
-import io.cloudbeaver.model.CBWebServerConfig;
-import io.cloudbeaver.model.WebServerConfig;
 import io.cloudbeaver.model.config.CBServerConfig;
 import io.cloudbeaver.model.rm.local.LocalResourceController;
 import io.cloudbeaver.service.security.CBEmbeddedSecurityController;

server/bundles/io.cloudbeaver.service.data.transfer/src/io/cloudbeaver/service/data/transfer/impl/WebDataTransferImportServlet.java

@@ -77,7 +77,7 @@ public class WebDataTransferImportServlet extends WebServiceServletBase {
             response.sendError(HttpServletResponse.SC_FORBIDDEN, "Permission denied");
             return;
         }
-        if (!session.hasPermission(DBWConstants.GLOBAL_PERMISSION_DATA_EDITOR_IMPORT)) {
+        if (!session.hasGlobalPermission(DBWConstants.GLOBAL_PERMISSION_DATA_EDITOR_IMPORT)) {
             response.sendError(HttpServletResponse.SC_FORBIDDEN, "Import is not allowed for this user");
             return;
         }

server/bundles/io.cloudbeaver.service.ldap.auth/src/io/cloudbeaver/service/ldap/auth/LdapAuthProvider.java

@@ -533,8 +533,7 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
     @NotNull
     private List<String> getGroupForMember(String fullDN, LdapSettings ldapSettings, Map<String, Object> authParameters) {
         DirContext context = null;
-        NamingEnumeration<SearchResult> searchResults = null;
-        List<String> result = new ArrayList<>();
+        Set<String> result = new LinkedHashSet<>();
         try {
             Map<String, String> environment = creteAuthEnvironment(ldapSettings);
             if (CommonUtils.isEmpty(ldapSettings.getBindUserDN())) {
@@ -554,11 +553,67 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
             }
 
             context = initConnection(environment);
+            List<String> groupsByMemberOfAttribute = findGroupsByMemberOfAttribute(fullDN, context);
+            log.debug("Found " + groupsByMemberOfAttribute.size() + " groups by memberOf attribute");
+            result.addAll(groupsByMemberOfAttribute);
+            List<String> groupsByMemberAttribute = findGroupsByMemberAttribute(fullDN, ldapSettings, context);
+            log.debug("Found " + groupsByMemberAttribute.size() + " groups by member attribute");
+            result.addAll(groupsByMemberAttribute);
+        } catch (Exception e) {
+            log.error("Group not found", e);
+        } finally {
+            try {
+                if (context != null) {
+                    context.close();
+                }
+            } catch (Exception e) {
+                log.error("Close resource of ldap group search failed", e);
+            }
+        }
+        return new ArrayList<>(result);
+    }
 
-            String searchFilter = "(member={0})";
-            SearchControls searchControls = new SearchControls();
-            searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
-            searchResults = context.search(ldapSettings.getBaseDN(), searchFilter, new Object[] {fullDN}, searchControls);
+    private List<String> findGroupsByMemberOfAttribute(String fullDN, DirContext context) throws NamingException {
+        List<String> result = new ArrayList<>();
+        SearchControls memberOfSearch = new SearchControls();
+        memberOfSearch.setSearchScope(SearchControls.OBJECT_SCOPE);
+        memberOfSearch.setTimeLimit(30_000);
+        memberOfSearch.setReturningAttributes(new String[] {"*", "+"});
+        NamingEnumeration<SearchResult> userRecord = context.search(fullDN, "(objectClass=*)", memberOfSearch);
+        try {
+            if (userRecord.hasMore()) {
+                SearchResult userResult = userRecord.next();
+                Attributes userAttributes = userResult.getAttributes();
+                Attribute memberOfAttr = userAttributes.get("memberOf");
+                if (memberOfAttr != null) {
+                    NamingEnumeration<?> groups = memberOfAttr.getAll();
+                    while (groups.hasMore()) {
+                        String groupDN = String.valueOf(groups.next());
+                        result.add(groupDN);
+                    }
+                }
+            }
+        } finally {
+            if (userRecord != null) {
+                userRecord.close();
+            }
+        }
+
+        return result;
+    }
+
+    private List<String> findGroupsByMemberAttribute(String fullDN, LdapSettings ldapSettings, DirContext context) throws NamingException {
+        List<String> result = new ArrayList<>();
+        String searchFilter = "(member={0})";
+        SearchControls searchControls = new SearchControls();
+        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
+        NamingEnumeration<SearchResult> searchResults = context.search(
+            ldapSettings.getBaseDN(),
+            searchFilter,
+            new Object[] {fullDN},
+            searchControls
+        );
+        try {
             while (searchResults.hasMore()) {
                 try {
                     SearchResult next = searchResults.next();
@@ -570,18 +625,9 @@ public class LdapAuthProvider implements SMAuthProviderExternal<SMSession>, SMBr
                     log.error("Failed fetch user group. Skipping...", e);
                 }
             }
-        } catch (Exception e) {
-            log.error("Group not found", e);
         } finally {
-            try {
-                if (context != null) {
-                    context.close();
-                }
-                if (searchResults != null) {
-                    searchResults.close();
-                }
-            } catch (Exception e) {
-                log.error("Close resource of ldap group search failed", e);
+            if (searchResults != null) {
+                searchResults.close();
             }
         }
         return result;

server/drivers/clickhouse_com/pom.xml

@@ -38,6 +38,11 @@
                 </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>org.lz4</groupId>
+            <artifactId>lz4-java</artifactId>
+            <version>1.8.1</version>
+        </dependency>
     </dependencies>
 
 </project>