Preserve LDAP DNs during Active Directory authorization

Author: abhiramaab

core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java

@@ -169,7 +169,7 @@ protected Set<String> getRoleNamesForUser(String username, LdapContext ldapConte
         SearchControls searchControls = new SearchControls();
         searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
 
-        String userPrincipalName = getUsernameWithSuffix(username);
+        String userPrincipalName = getUsernameForAuthentication(username);
 
         Object[] searchArguments = new Object[] {userPrincipalName};
 
@@ -238,8 +238,7 @@ protected Collection<String> getRoleNamesForGroups(Collection<String> groupNames
     protected String getUsernameWithSuffix(String username) {
         String sanitizedUsername = Rdn.escapeValue(username);
         if (principalSuffix != null
-                && !sanitizedUsername.toLowerCase(Locale.ROOT)
-                .endsWith(principalSuffix.toLowerCase(Locale.ROOT))) {
+                && !sanitizedUsername.toLowerCase(Locale.ROOT).endsWith(principalSuffix.toLowerCase(Locale.ROOT))) {
             return sanitizedUsername + principalSuffix;
         }
         return sanitizedUsername;

core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java

@@ -154,7 +154,9 @@ void testInitialization() {
 
     @Test
     void testUsernameForAuthenticationWithDn() {
-        ActiveDirectoryRealm activeDirectoryRealm = new ActiveDirectoryRealm();
+        ActiveDirectoryRealm activeDirectoryRealm = new ActiveDirectoryRealm() {{
+            this.principalSuffix = "@example.com";
+        }};
 
         String dn = "CN=my_name,OU=Development,OU=Special Accounts,DC=mycompany,DC=com";
 
@@ -172,7 +174,9 @@ void testUsernameForAuthenticationWithUsername() {
 
     @Test
     void testAuthenticationUsesDnWithoutEscaping() throws Exception {
-        ActiveDirectoryRealm activeDirectoryRealm = new ActiveDirectoryRealm();
+        ActiveDirectoryRealm activeDirectoryRealm = new ActiveDirectoryRealm() {{
+            this.principalSuffix = "@example.com";
+        }};
         LdapContextFactory factory = createMock(LdapContextFactory.class);
         LdapContext ldapContext = createNiceMock(LdapContext.class);
 
@@ -188,6 +192,37 @@ void testAuthenticationUsesDnWithoutEscaping() throws Exception {
         verify(factory);
     }
 
+    @Test
+    void testAuthorizationUsesDnWithoutEscaping() throws Exception {
+        ActiveDirectoryRealm activeDirectoryRealm = new ActiveDirectoryRealm() {{
+            this.principalSuffix = "@example.com";
+        }};
+
+        LdapContext ldapContext = createNiceMock(LdapContext.class);
+        NamingEnumeration<SearchResult> results = createNiceMock(NamingEnumeration.class);
+
+        String dn = "CN=my_name,OU=Development,OU=Special Accounts,DC=mycompany,DC=com";
+
+        Capture<Object[]> captureArgs = Capture.newInstance(CaptureType.ALL);
+
+        expect(ldapContext.search(
+                anyString(),
+                anyString(),
+                capture(captureArgs),
+                anyObject(SearchControls.class)))
+                .andReturn(results);
+
+        replay(ldapContext);
+
+        activeDirectoryRealm.getRoleNamesForUser(dn, ldapContext);
+
+        Object[] searchArguments = captureArgs.getValue();
+
+        assertThat(searchArguments[0]).isEqualTo(dn);
+
+        verify(ldapContext);
+    }
+
     public void assertExistingUserSuffix(String username, String expectedPrincipalName) throws Exception {
 
         LdapContext ldapContext = createMock(LdapContext.class);