Apache Shiro LDAP Configuration (2 Step Authentication)

I'm working on a webapplication using the following:

Apache Shiro 1.2.4
Tomcat 8
Java 8

I'm trying to authenticate users via an LDAP realm.

I tested the login with JXplorer using the following values:

BaseND: ou=students,ou=users,o=data
UserDN/BindDN: cn={my distinguished name},ou=students,ou=users,o=data
JXplorer also has a certificate that I imported

Now to my problem:

I have to authenticate the users not based on cn but rather on uid. This wont work however.

Workflow suggested by LDAP-Admin at my company:

I have a system user which (as far as I understood) should connect to the LDAP-Server, searches the user based on the given uid and returns the cn for that user.

In a second step it should then be possible to authenticate the user with his cn just like its done (successfully) in JXplorer.

My shiro.ini configuration looks like this for my test LDAP (not the one I'm trying to authenticate against now)

ldapRealm = org.apache.shiro.realm.ldap.JndiLdapRealm
ldapRealm.userDnTemplate = cn={0},ou=People,dc=maxcrc,dc=com
ldapRealm.contextFactory.url = ldap://localhost:389

The problem I'm facing right now is that I cannot find information about how to configure my shiro.ini file in a way to math the suggested workflow from above.

Question #1

Can I use the standard org.apache.shiro.realm.ldap.JndiLdapRealm (how do I configure it)? Especially for the integration of the certificate I could not find anything appropriate.

Question #2

Do I need to create a custom JndiLdapRealm for this "2 step authentication" and how could such a Realm look like?

Solution

I found a solutiuon and that is to overload the getUserDN() Method from JndiLdapRealm

It now looks like this:

/**
* Addition to standard shiro code
* User logs in with his {@link principal} (username) but login needs to be performed with his cn instead
* The addition is an ldap query to get the users cn from the ldap server and store it (instead of the given principal) in the return String
* @return UserDN with user uid (cn) instead of principal (username)
*/
@Override
protected String getUserDn( final String principal ) throws IllegalArgumentException, IllegalStateException {

    if (!StringUtils.hasText(principal)) {
        throw new IllegalArgumentException("User principal cannot be null or empty for User DN construction.");
    }
    String prefix = getUserDnPrefix();
    String suffix = getUserDnSuffix();
    if (prefix == null && suffix == null) {
        log.debug("userDnTemplate property has not been configured, indicating the submitted " +
                  "AuthenticationToken's principal is the same as the User DN.  Returning the method argument " +
                  "as is.");
        return principal;
    }

    int prefixLength = prefix != null ? prefix.length() : 0;
    int suffixLength = suffix != null ? suffix.length() : 0;
    StringBuilder sb = new StringBuilder(prefixLength + principal.length() + suffixLength);
    if (prefixLength > 0) {
        sb.append(prefix);
    }

    /*############################################################################################
    * ADDITION TO STANDARD SHIRO CODE 
    * User logs in with his {@link principal} (username) but login needs to be performed with his cn instead
    *    => translate username to cn
    */
    AppSettings_Controler settings = Startup.getAppSettingsControler();
    LDAP_Manager ldap_manager = new LDAP_Manager();
    LdapContext ctx = ldap_manager.getLdapConnection();
    String user_uid = "";

    SearchControls constraints = new SearchControls();
    constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
    String[] attrIDs = {"cn"};
    constraints.setReturningAttributes(attrIDs);
    NamingEnumeration answer = null;

    try{
        answer = ctx.search(settings.get_ldap_search_dn_1(), settings.get_ldap_uname_field_name_1() + "=" + principal, constraints);
        if (answer.hasMore()) {
            Attributes attrs = ((SearchResult) answer.next()).getAttributes();
            user_uid = attrs.get("cn").toString().substring(attrIDs[0].length() + 2);
        } else {
            throw new Exception("Invalid User");
        }
    } catch (Exception ex) {
        // Error Handling & Fallback to my second LDAP-Server
        try{
            answer = ctx.search(settings.get_ldap_search_dn_2(), settings.get_ldap_uname_field_name_2() + "=" + principal, constraints);
            if (answer.hasMore()) {
                Attributes attrs = ((SearchResult) answer.next()).getAttributes();
                user_uid = attrs.get("cn").toString().substring(attrIDs[0].length() + 2);
            } else {
                throw new Exception("Invalid User");
            }
        }catch (Exception exe) {
            // Error Handling
        }
    }
    try {
        ctx.close();
    } catch (NamingException ex) {
        JndiLdapRealm_custom_error_logger.error("getUserDn(); Fehler beim schließen: ", ex);
    }
    //############################################################################################

    //############################################################################################
    // Shiro Standard Code -> add principal to String
    //sb.append(principal);
    /*############################################################################################

    /*############################################################################################
    * ALTERED CODE
    * Instead -> Add user's cn to String   
    */
    sb.append(user_uid);
    //############################################################################################

    if (suffixLength > 0) {
        sb.append(suffix);
    }
    return sb.toString();
}

This addition does an LDAP-Query to get the users uid (cn) based n the username provided. That way the login works with the user just entering his LDAP-Username withing my application and follows the workflow described above.

If you have any suggestions or comments don't hesitate to post them here ;)