Ignore PartialResultException from LDAP.
This exception occurs when the server isn't following referrals for
you, and thus the result contains a referral. That happens when you're
using Active Directory. You almost certainly don't really want to
follow referrals in AD *anyways*, so just ignore these exceptions, so
we can still use the actual data.
Inspired by:
https://src.springframework.org/svn/spring-ldap/trunk/core/src/main/java/org/springframework/ldap/core/LdapTemplate.java
Change-Id: I484145a2e262173de6b3ac4081608bd684577916
Signed-Off-By: James Y Knight <jyknight@google.com>
(cherry picked from commit 1244ed057467ae07f4f0c6a7d70104ed3a5117dd)
diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt
index decbc72..8f751b4 100644
--- a/Documentation/config-gerrit.txt
+++ b/Documentation/config-gerrit.txt
@@ -1264,9 +1264,8 @@
+
_(Optional)_ How an LDAP referral should be handled if it is
encountered during directory traversal. Set to `follow` to
-automatically follow any referrals, or `ignore` to stop and fail
-with `javax.naming.PartialResultException: Unprocessed Continuation
-Reference(s)`
+automatically follow any referrals, or `ignore` to ignore the
+referrals.
+
By default, `ignore`.
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/Helper.java b/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/Helper.java
index 675202c..a9ea853 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/Helper.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/Helper.java
@@ -38,6 +38,7 @@
import javax.naming.Name;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
+import javax.naming.PartialResultException;
import javax.naming.directory.Attribute;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
@@ -168,9 +169,12 @@
final Attribute groupAtt = account.getAll(schema.accountMemberField);
if (groupAtt != null) {
final NamingEnumeration<?> groups = groupAtt.getAll();
- while (groups.hasMore()) {
- final String nextDN = (String) groups.next();
- recursivelyExpandGroups(groupDNs, schema, ctx, nextDN);
+ try {
+ while (groups.hasMore()) {
+ final String nextDN = (String) groups.next();
+ recursivelyExpandGroups(groupDNs, schema, ctx, nextDN);
+ }
+ } catch (PartialResultException e) {
}
}
}
@@ -203,9 +207,12 @@
ctx.getAttributes(compositeGroupName).get(schema.accountMemberField);
if (in != null) {
final NamingEnumeration<?> groups = in.getAll();
- while (groups.hasMore()) {
- final String nextDN = (String) groups.next();
- recursivelyExpandGroups(groupDNs, schema, ctx, nextDN);
+ try {
+ while (groups.hasMore()) {
+ final String nextDN = (String) groups.next();
+ recursivelyExpandGroups(groupDNs, schema, ctx, nextDN);
+ }
+ } catch (PartialResultException e) {
}
}
} catch (NamingException e) {
@@ -316,4 +323,4 @@
}
}
}
-}
\ No newline at end of file
+}
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/LdapQuery.java b/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/LdapQuery.java
index 70ce779..7d1e37d 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/LdapQuery.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/auth/ldap/LdapQuery.java
@@ -25,6 +25,7 @@
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
+import javax.naming.PartialResultException;
import javax.naming.directory.Attribute;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.DirContext;
@@ -69,8 +70,11 @@
res = ctx.search(base, pattern.getRawPattern(), pattern.bind(params), sc);
try {
final List<Result> r = new ArrayList<Result>();
- while (res.hasMore()) {
- r.add(new Result(res.next()));
+ try {
+ while (res.hasMore()) {
+ r.add(new Result(res.next()));
+ }
+ } catch (PartialResultException e) {
}
return r;
} finally {
