WebLogic Server 8.1 API Reference

weblogic.security.providers.authentication
Class DefaultUserNameMapperImpl

java.lang.Object
  |
  +--weblogic.security.providers.authentication.DefaultUserNameMapperImpl

public class DefaultUserNameMapperImpl

extends java.lang.Object

implements UserNameMapper

Implementation of the UserNameMapper interface used to perform certificate-based and distinguished name user authentication via configuration attributes. Certificate-based authentication can be performed when a remote client makes a two-way-authenticated secure connection to the server, in which case the client's certificate chain can be used to authenticate the remote user. This removes the need for the client to explicitly provide a username and password. Distinguished name authentication can be performed via CSIv2 identity assertion.

To this implementation in the Default Identity Asserter, set the UseDefaultUserNameMapper field on the Default Identity Asserter tab in the Administration Console. To configure what attributes in the DN are used to map to the username, set the DefaultUserNameMapperAttribute and DefaultUserNameMapperAttributeDelimiter fields on he Default Identity Asserter tab in the Administration Console. Example values are E and @. For a Email value of smith@bea.com, the user would be mapped to smith.

Author:

Copyright © 2002 BEA Systems, Inc. All Rights Reserved.

Constructor Summary

DefaultUserNameMapperImpl(java.lang.String subjectDNAttribute, java.lang.String attributeDelimiter)
Creates the DefaultUserNameMapper implementation.

Method Summary

java.lang.String	mapCertificateToUserName(java.security.cert.X509Certificate[] certs, boolean ssl) Maps a certificate to a username based on a certificate chain presented.
java.lang.String	mapDistinguishedNameToUserName(byte[] distinguishedName) Map a X.501 distinguised name to a username based on the distinguished name attributes and values.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultUserNameMapperImpl

public DefaultUserNameMapperImpl(java.lang.String subjectDNAttribute,
                                 java.lang.String attributeDelimiter)

Creates the DefaultUserNameMapper implementation.

Parameters:

subjectDNAttribute - The attribute in the subject DN from the certificate that should be used in the mapping from certificate to username. This should be a value such as "ST", "E", or "CN".

attributeDelimiter - The delimiter to use as the end of the username in the mapping. For example, "@" in the value "E=smith@bea.com".

Method Detail

mapCertificateToUserName

public java.lang.String mapCertificateToUserName(java.security.cert.X509Certificate[] certs,
                                                 boolean ssl)

Maps a certificate to a username based on a certificate chain presented. If the user can be mapped successfully, this method returns the user with its WebLogic username optionally derived from the certificate, otherwise it returns null.

Specified by:

mapCertificateToUserName in interface UserNameMapper

Parameters:

certs - certificate chain presented by the client. An array of length at least 1. The first certificate is the leaf (i.e. end user's) certificate. If the length is greater than 1, the array is a certificate chain, with the last element being the root CA.

ssl - true if the certificates to check were presented by the client during a successful two-way SSL handshake.

Returns:

user name derived from certificate, if mapping succeeded, or null if failed

mapDistinguishedNameToUserName

public java.lang.String mapDistinguishedNameToUserName(byte[] distinguishedName)

Map a X.501 distinguised name to a username based on the distinguished name attributes and values. If the user can be mapped successfully, this method returns the user with its WebLogic username optionally derived from the distinguished name, otherwise it returns null.

Specified by:

mapDistinguishedNameToUserName in interface UserNameMapper

Parameters:

distinguishedName - ASN.1 encoding of a X.501 distinguised name.

Returns:

user name derived from distinguished name, if mapping succeeded, or null if failed