Build against Spring Security

Jenkinsfile

@@ -1 +1 @@
-buildPlugin()
+buildPlugin(platforms: ['docker', 'maven-windows'])

pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>org.jenkins-ci.plugins</groupId>
     <artifactId>plugin</artifactId>
-    <version>4.4</version>
+    <version>4.7</version>
     <relativePath />
   </parent>
 
@@ -28,7 +28,7 @@
     <changelist>-SNAPSHOT</changelist>
     <gitHubRepo>jenkinsci/${project.artifactId}-plugin</gitHubRepo>
     <apacheds.version>2.0.0.AM25</apacheds.version>
-    <jenkins.version>2.235.3</jenkins.version>
+    <jenkins.version>2.257-rc30526.4bb45a702b8d</jenkins.version> <!-- TODO https://github.com/jenkinsci/jenkins/pull/4848 -->
     <java.level>8</java.level>
     <configuration-as-code.version>1.36</configuration-as-code.version>
   </properties>
@@ -54,64 +54,20 @@
   </pluginRepositories>
 
   <dependencies>
-    <dependency> <!-- to appear earlier in the test CP for purposes of PCT -->
-      <groupId>org.jenkins-ci.main</groupId>
-      <artifactId>jenkins-core</artifactId>
-      <version>${jenkins.version}</version>
-    </dependency>
-    <dependency> <!-- for compatibility with https://github.com/jenkinsci/jenkins/pull/4848 -->
-      <groupId>org.acegisecurity</groupId>
-      <artifactId>acegi-security</artifactId>
-      <version>1.0.7</version>
+    <dependency> <!-- Repeat this from jenkins/core/pom.xml to avoid bundling Spring libraries already in core -->
+      <groupId>org.springframework.security</groupId>
+      <artifactId>spring-security-web</artifactId>
+      <scope>provided</scope>
       <exclusions>
-        <exclusion>
-          <groupId>commons-codec</groupId>
-          <artifactId>commons-codec</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>commons-collections</groupId>
-          <artifactId>commons-collections</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>commons-lang</groupId>
-          <artifactId>commons-lang</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.springframework</groupId>
-          <artifactId>spring-core</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.springframework</groupId>
-          <artifactId>spring-jdbc</artifactId>
-        </exclusion>
         <exclusion>
           <groupId>org.springframework</groupId>
-          <artifactId>spring-remoting</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.springframework</groupId>
-          <artifactId>spring-support</artifactId>
+          <artifactId>spring-jcl</artifactId>
         </exclusion>
       </exclusions>
     </dependency>
     <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-dao</artifactId>
-      <version>1.2.9</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.springframework</groupId>
-          <artifactId>spring-beans</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.springframework</groupId>
-          <artifactId>spring-context</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.springframework</groupId>
-          <artifactId>spring-core</artifactId>
-        </exclusion>
-      </exclusions>
+      <groupId>org.springframework.security</groupId>
+      <artifactId>spring-security-ldap</artifactId>
     </dependency>
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>

src/main/java/org/acegisecurity/providers/ldap/authenticator/BindAuthenticator2.java → src/main/java/jenkins/security/plugins/ldap/BindAuthenticator2.java

@@ -21,13 +21,14 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  * THE SOFTWARE.
  */
-package org.acegisecurity.providers.ldap.authenticator;
-
-import org.acegisecurity.ldap.InitialDirContextFactory;
-import org.acegisecurity.userdetails.ldap.LdapUserDetails;
+package jenkins.security.plugins.ldap;
 
 import java.util.logging.Logger;
 import java.util.logging.Level;
+import org.springframework.ldap.core.DirContextOperations;
+import org.springframework.ldap.core.support.BaseLdapPathContextSource;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.ldap.authentication.BindAuthenticator;
 
 /**
  * {@link BindAuthenticator} with improved diagnostics.
@@ -40,19 +41,19 @@ public class BindAuthenticator2 extends BindAuthenticator {
      */
     private boolean hadSuccessfulAuthentication;
 
-    public BindAuthenticator2(InitialDirContextFactory initialDirContextFactory) {
-        super(initialDirContextFactory);
+    public BindAuthenticator2(BaseLdapPathContextSource contextSource) {
+        super(contextSource);
     }
 
     @Override
-    public LdapUserDetails authenticate(String username, String password) {
-        LdapUserDetails user = super.authenticate(username, password);
+    public DirContextOperations authenticate(Authentication authentication) {
+        DirContextOperations operations = super.authenticate(authentication);
         hadSuccessfulAuthentication = true;
-        return user;
+        return operations;
     }
 
     @Override
-    void handleBindException(String userDn, String username, Throwable cause) {
+    protected void handleBindException(String userDn, String username, Throwable cause) {
         LOGGER.log(hadSuccessfulAuthentication? Level.FINE : Level.WARNING,
             "Failed to bind to LDAP: userDn"+userDn+"  username="+username,cause);
         super.handleBindException(userDn, username, cause);

src/main/java/jenkins/security/plugins/ldap/FromGroupSearchLDAPGroupMembershipStrategy.java

@@ -25,6 +25,7 @@
 
 import hudson.Extension;
 import hudson.security.LDAPSecurityRealm;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.Set;
 import java.util.TreeSet;
@@ -35,13 +36,12 @@
 import javax.naming.NamingException;
 import javax.naming.directory.Attributes;
 import javax.naming.ldap.LdapName;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.ldap.LdapEntryMapper;
-import org.acegisecurity.providers.ldap.LdapAuthoritiesPopulator;
-import org.acegisecurity.userdetails.ldap.LdapUserDetails;
 import org.apache.commons.lang.StringUtils;
 import org.kohsuke.stapler.DataBoundConstructor;
-import org.springframework.dao.DataAccessException;
+import org.springframework.ldap.core.DirContextOperations;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.ldap.LdapUtils;
+import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 
 /**
  * Traditional strategy.
@@ -76,15 +76,15 @@ public void setAuthoritiesPopulator(LdapAuthoritiesPopulator authoritiesPopulato
     }
 
     @Override
-    public GrantedAuthority[] getGrantedAuthorities(LdapUserDetails ldapUser) {
-        return getAuthoritiesPopulator().getGrantedAuthorities(ldapUser);
+    public Collection<? extends GrantedAuthority> getGrantedAuthorities(DirContextOperations userData, String username) {
+        return getAuthoritiesPopulator().getGrantedAuthorities(userData, username);
     }
 
     @Override
-    public Set<String> getGroupMembers(String groupDn, LDAPConfiguration conf) throws DataAccessException {
+    public Set<String> getGroupMembers(String groupDn, LDAPConfiguration conf) {
         LDAPExtendedTemplate template = conf.getLdapTemplate();
         String[] memberAttributes = { "member", "uniqueMember", "memberUid" };
-        return (Set<String>) template.retrieveEntry(groupDn, new GroupMembersMapper(), memberAttributes);
+        return template.executeReadOnly(ctx -> new GroupMembersMapper().mapAttributes(groupDn, ctx.getAttributes(LdapUtils.getRelativeName(groupDn, ctx), memberAttributes)));
     }
 
     @Extension
@@ -99,7 +99,7 @@ public String getDisplayName() {
     /**
      * Maps member attributes in groups to a set of member names.
      */
-    private static class GroupMembersMapper implements LdapEntryMapper {
+    private static class GroupMembersMapper implements LdapEntryMapper<Set<String>> {
         @Override
         public Set<String> mapAttributes(String dn, Attributes attributes) throws NamingException {
             NamingEnumeration<?> enumeration;

src/main/java/jenkins/security/plugins/ldap/FromUserRecordLDAPGroupMembershipStrategy.java

@@ -26,20 +26,19 @@
 import hudson.Extension;
 import hudson.security.LDAPSecurityRealm;
 import java.util.Set;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.GrantedAuthorityImpl;
-import org.acegisecurity.ldap.LdapEntryMapper;
-import org.acegisecurity.userdetails.ldap.LdapUserDetails;
 import org.apache.commons.lang.StringUtils;
 import org.kohsuke.stapler.DataBoundConstructor;
-import org.springframework.dao.DataAccessException;
+import org.springframework.ldap.core.DirContextOperations;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 import javax.naming.InvalidNameException;
 import javax.naming.NamingException;
 import javax.naming.directory.Attribute;
 import javax.naming.directory.Attributes;
 import javax.naming.ldap.LdapName;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
@@ -67,9 +66,9 @@ public String getAttributeName() {
     }
 
     @Override
-    public GrantedAuthority[] getGrantedAuthorities(LdapUserDetails ldapUser) {
+    public Collection<? extends GrantedAuthority> getGrantedAuthorities(DirContextOperations userData, String username) {
         List<GrantedAuthority> result = new ArrayList<GrantedAuthority>();
-        Attributes attributes = ldapUser.getAttributes();
+        Attributes attributes = userData.getAttributes();
         final String attributeName = getAttributeName();
         Attribute attribute = attributes == null ? null : attributes.get(attributeName);
         if (attribute != null) {
@@ -82,7 +81,7 @@ public GrantedAuthority[] getGrantedAuthorities(LdapUserDetails ldapUser) {
                     } catch (InvalidNameException e) {
                         LOGGER.log(Level.FINEST, "Expected a Group DN but found: {0}", groupName);
                     }
-                    result.add(new GrantedAuthorityImpl(groupName));
+                    result.add(new SimpleGrantedAuthority(groupName));
                 }
             } catch (NamingException e) {
                 LogRecord lr = new LogRecord(Level.FINE,
@@ -102,37 +101,37 @@ public GrantedAuthority[] getGrantedAuthorities(LdapUserDetails ldapUser) {
                     String role = ga.getAuthority();
 
                     // backward compatible name mangling
-                    if (authoritiesPopulatorImpl.isConvertToUpperCase()) {
+                    if (authoritiesPopulatorImpl._isConvertToUpperCase()) {
                         role = role.toUpperCase();
                     }
-                    GrantedAuthorityImpl extraAuthority = new GrantedAuthorityImpl(
-                            authoritiesPopulatorImpl.getRolePrefix() + role);
+                    GrantedAuthority extraAuthority = new SimpleGrantedAuthority(
+                            authoritiesPopulatorImpl._getRolePrefix() + role);
                     result.add(extraAuthority);
                 }
             }
-            result.addAll(authoritiesPopulatorImpl.getAdditionalRoles(ldapUser));
+            result.addAll(authoritiesPopulatorImpl.getAdditionalRoles(userData, username));
             GrantedAuthority defaultRole = authoritiesPopulatorImpl.getDefaultRole();
             if (defaultRole != null) {
                 result.add(defaultRole);
             }
         }
 
-        return result.toArray(new GrantedAuthority[result.size()]);
+        return result;
     }
 
     @Override
-    public Set<String> getGroupMembers(String groupDn, LDAPConfiguration conf) throws DataAccessException {
+    public Set<String> getGroupMembers(String groupDn, LDAPConfiguration conf) {
         LDAPExtendedTemplate template = conf.getLdapTemplate();
         String searchBase = conf.getUserSearchBase() != null ? conf.getUserSearchBase() : "";
         String[] filterArgs = { getAttributeName(), groupDn };
-        return new HashSet<>((List<String>)template.searchForAllEntries(searchBase, USER_SEARCH_FILTER,
+        return new HashSet<>(template.searchForAllEntries(searchBase, USER_SEARCH_FILTER,
                 filterArgs, new String[]{}, new UserRecordMapper()));
     }
 
     /**
      * Maps users records to names.
      */
-    private static class UserRecordMapper implements LdapEntryMapper {
+    private static class UserRecordMapper implements LdapEntryMapper<String> {
         @Override
         public String mapAttributes(String dn, Attributes attributes) throws NamingException {
             LdapName name = new LdapName(dn);