/*
 * Copyright (c) 2003, 2021 Oracle and/or its affiliates. All rights reserved.
 *
 * This program and the accompanying materials are made available under the
 * terms of the Eclipse Public License v. 2.0, which is available at
 * http://www.eclipse.org/legal/epl-2.0.
 *
 * This Source Code may also be made available under the following Secondary
 * Licenses when the conditions for such availability set forth in the
 * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
 * version 2 with the GNU Classpath Exception, which is available at
 * https://www.gnu.org/software/classpath/license.html.
 *
 * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
 */

package com.sun.jndi.ldap.obj;

import com.sun.enterprise.security.GroupPrincipal;
import com.sun.jndi.ldap.LdapURL;

import java.security.Principal;
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Hashtable;
import java.util.NoSuchElementException;
import java.util.Set;

import javax.naming.CompositeName;
import javax.naming.Context;
import javax.naming.Name;
import javax.naming.NameNotFoundException;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.BasicAttributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.ModificationItem;
import javax.naming.directory.SearchControls;
import javax.naming.ldap.LdapContext;
import javax.naming.spi.NamingManager;

/**
 * A representation of the LDAP groupOfNames object class.
 * This is a static group: its members are listed in the group's member
 * LDAP attribute.
 * <p>
 * Note that when a <tt>GroupOfNames</tt> object is created by the application
 * program then most of its methods throw {@link IllegalStateException}
 * until the program binds the object in the directory. However, when a
 * <tt>GroupOfNames</tt> object is returned to the application program then the
 * object is already bound in the directory and its methods function normally.
 * <p>
 * A <tt>GroupOfNames</tt> instance is not synchronized against concurrent
 * multithreaded access. Multiple threads trying to access and modify a
 * <tt>GroupOfNames</tt> should lock the object.
 * <p>
 * In order to bind a <tt>GroupOfNames</tt> object in the directory, the
 * following LDAP object class definition (RFC 2256) must be supported in the
 * directory schema:
 * <pre>
 *     ( 2.5.6.9 NAME 'groupOfNames'
 *        SUP top
 *        STRUCTURAL
 *        MUST ( member $
 *               cn )
 *        MAY ( businessCategory $
 *              seeAlso $
 *              owner $
 *              ou $
 *              o $
 *              description ) )
 * </pre>
 * See
 * {@link javax.naming.directory.DirContext#bind(javax.naming.Name,
 * java.lang.Object, javax.naming.directory.Attributes) DirContext.bind}
 * for details on binding an object in the directory.
 * <p>
 * The following code sample shows how the class may be used:
 * <pre>
 *
 *     // set the java.naming.factory.object property
 *     env.put(Context.OBJECT_FACTORIES,
 *         "com.sun.jndi.ldap.obj.LdapGroupFactory");
 *
 *     // set the java.naming.factory.state property
 *     env.put(Context.STATE_FACTORIES,
 *         "com.sun.jndi.ldap.obj.LdapGroupFactory");
 *
 *     // create an initial context using the supplied environment properties
 *     DirContext ctx = new InitialDirContext(env);
 *
 *     // create a set of members
 *     Set members = new HashSet();
 *     members.add("cn=bill,ou=people");
 *     members.add("cn=ben,ou=people");
 *     members.add("cn=sysadmins,ou=groups");
 *     Group administrators = new GroupOfNames(members);
 *
 *     // bind the group in the directory
 *     ctx.bind("cn=administrators,ou=groups", administrators);
 *
 *     // list all of the group's members
 *     listMembers(administrators);
 *     ...
 *
 *
 *     // list the members of a group (subgroups are expanded, by default)
 *     void listMembers(Group group) {
 *         for (Enumeration members = group.members();
 *                 members.hasMoreElements(); ) {
 *             Object object = members.nextElement();
 *             if (object instanceof Group) {
 *                 System.out.println("+" + ((Group) object).getName());
 *             } else if (object instanceof Principal) {
 *                 System.out.println(" " + ((Principal) object).getName());
 *             }
 *          }
 *      }
 *
 * </pre>
 *
 * @author Vincent Ryan
 */
public class GroupOfNames implements GroupPrincipal {

    private static final boolean debug = false;
    private static final String OBJECT_CLASS = "groupOfNames";
    private static final String MEMBER_ATTR_ID = "member";
    private static final String MEMBER_FILTER_EXPR = "(member={0})";
    private static final String EXPAND_GROUP = "com.sun.jndi.ldap.obj.expandGroup";
    private static final Attribute OBJECT_CLASS_ATTR = new BasicAttribute("objectClass", "top");
    static {
        OBJECT_CLASS_ATTR.add(OBJECT_CLASS);
    }
    private static final SearchControls BASE_SEARCH_NO_ATTRS = new SearchControls();
    static {
        BASE_SEARCH_NO_ATTRS.setSearchScope(SearchControls.OBJECT_SCOPE);
        BASE_SEARCH_NO_ATTRS.setReturningAttributes(new String[0]); // no attrs
    }

    private boolean objectIsBound;
    private boolean expandGroup = true;
    private Attributes attributes = null;
    private Attribute memberAttr = null;
    private String memberAttrId;
    private String memberFilterExpr;
    private final Object[] filterArgs = new Object[1];
    private final ModificationItem[] modification = new ModificationItem[1];

    private String groupDN = null;
    private String bindDN = null;
    private DirContext rootCtx = null;
    private DirContext ctx = null;
    private DirContext bindCtx = null;
    private Name name = null;
    private Name bindName = null;
    private Hashtable env = null;

    /**
     * Create an empty group object.
     * <p>
     * Note that the newly constructed object does not represent a group in
     * the directory until it is bound by using
     * {@link javax.naming.directory.DirContext#bind(javax.naming.Name,
     * java.lang.Object, javax.naming.directory.Attributes) DirContext.bind}.
     */
    public GroupOfNames() {
        if (debug) {
            System.out.println("[debug] constructing an empty group");
        }
        initializeState(OBJECT_CLASS_ATTR, MEMBER_ATTR_ID, MEMBER_FILTER_EXPR, null);
    }

    /**
     * Create a group object with an initial set of members.
     * <p>
     * Note that the newly constructed object does not represent a group in
     * the directory until it is bound by using
     * {@link javax.naming.directory.DirContext#bind(javax.naming.Name,
     * java.lang.Object, javax.naming.directory.Attributes) DirContext.bind}.
     *
     * @param members The set of initial members. It may be null.
     *                Each element is of class {@link String} or
     *                {@link java.security.Principal}.
     */
    public GroupOfNames(Set members) {
        if (debug) {
            System.out.println("[debug] constructing a group");
        }
        initializeState(OBJECT_CLASS_ATTR, MEMBER_ATTR_ID, MEMBER_FILTER_EXPR, members);
    }

    /**
     * Create a group object.
     * This method is called by {@link GroupOfUniqueNames}.
     *
     * @param objectClass The LDAP objectClass attribute.
     * @param memberAttrId The LDAP attribute ID which identifies the members.
     * @param memberfilterExpr The filter expression used to find a member.
     * @param members The set of initial members. It may be null.
     */
    // package private (used by GroupOfUniqueNames)
    GroupOfNames(Attribute objectClass, String memberAttrId, String memberFilterExpr, Set members) {
        initializeState(objectClass, memberAttrId, memberFilterExpr, members);
    }

    /**
     * Create a group object from its entry in the directory.
     * This method is called by {@link GroupOfUniqueNames}.
     *
     * @param objectClass The LDAP objectClass attribute.
     * @param memberAttrId The LDAP attribute ID which identifies the members.
     * @param memberfilterExpr The filter expression used to find a member.
     * @param members The set of initial members. It may be null.
     * @param groupDN The group's distinguished name.
     * @param name The group's LDAP distinguished name.
     * @param ctx An LDAP context.
     * @param name The group's name relative to the context.
     * @param env The context's environment properties.
     * @param attributes The group's LDAP attributes.
     */
    // package private (used by GroupOfUniqueNames)
    GroupOfNames(Attribute objectClass, String memberAttrId,
        String memberFilterExpr, Set members, String groupDN,
        DirContext ctx, Name name, Hashtable env, Attributes attributes) {

        initializeState(objectClass, memberAttrId, memberFilterExpr, members);
        initializeBoundState(groupDN, ctx, name, env, attributes);
    }

    /**
     * Create a group object from its entry in the directory.
     * This method is called by {@link LdapGroupFactory}.
     *
     * @param groupDN The group's distinguished name.
     * @param ctx An LDAP context.
     * @param name The group's name relative to the context.
     * @param env The context's environment properties.
     * @param attributes The group's LDAP attributes.
     * @return Object The new object instance.
     */
    // package private (used by LdapGroupFactory)
    static Object getObjectInstance(String groupDN, DirContext ctx, Name name, Hashtable env, Attributes attributes) {
        if (debug) {
            System.out.println("[debug] creating a group named: " + groupDN);
        }
        return new GroupOfNames(OBJECT_CLASS_ATTR, MEMBER_ATTR_ID,
            MEMBER_FILTER_EXPR, null, groupDN, ctx, name, env, attributes);
    }

    /**
     * Adds a member to the group.
     * Performs an LDAP modify to add the member.
     *
     * @param member The name of the member to be added.
     * @return boolean true if the addition was successful; false otherwise.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    public boolean addMember(Principal member) {
        try {
            return addMember(member.getName());
        } catch (NamingException e) {
            if (debug) {
                System.out.println("[debug] error adding the member: " + e);
            }
            return false;
        }
    }

    /**
     * Adds a member to the group.
     * Performs an LDAP modify to add the member.
     *
     * @param dn The distinguished name (RFC 2253) of the member to be added.
     * @return boolean true if the addition was successful; false otherwise.
     * @throws NamingException The exception is thrown if an error occurs while
     *                         performing LDAP modify.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    public boolean addMember(String dn) throws NamingException {
        if (! isBound()) {
            throw new IllegalStateException();
        }
        if (debug) {
            System.out.println("[debug] adding the member: " + dn);
        }
        return modifyMember(dn, DirContext.ADD_ATTRIBUTE);
    }

    /**
     * Checks if the supplied name is a member of the group.
     * Performs LDAP searches to determine membership.
     * <p>
     * By default, subgroups are also checked.
     * As subgroup expansion is potentially an expensive activity the feature
     * may be disabled by setting the environment property
     * "com.sun.jndi.ldap.obj.expandGroup"
     * to the string value "false".
     *
     * @param member The name of the member to be checked.
     * @return boolean true if membership is confirmed; false otherwise.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    @Override
    public boolean isMember(Principal member) {
        try {
            return isMember(member.getName());
        } catch (NamingException e) {
            if (debug) {
                System.out.println("[debug] error testing for membership: " + e);
            }
            return false;
        }
    }

    /**
     * Checks if the supplied name is a member of the group.
     * Performs LDAP searches to determine membership.
     * <p>
     * By default, subgroups are also checked.
     * As subgroup expansion is potentially an expensive activity the feature
     * may be disabled by setting the environment property
     * "com.sun.jndi.ldap.obj.expandGroup"
     * to the string value "false".
     *
     * @param dn The distinguished name (RFC 2253) of the member to be checked.
     * @return boolean true if membership is confirmed; false otherwise.
     * @throws NamingException The exception is thrown if an error occurs while
     *                         performing LDAP search.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    public boolean isMember(String dn) throws NamingException {

        if (! isBound()) {
            throw new IllegalStateException();
        }
        if (debug) {
            System.out.println("[debug] checking if \"" + dn + "\" is a member");
        }

        // Check cache
        if (memberAttr != null && memberAttr.contains(dn)) {
            return true;
        }

        // Check directory group
        filterArgs[0] = dn;
        NamingEnumeration results = ctx.search(name, memberFilterExpr, filterArgs, BASE_SEARCH_NO_ATTRS);

        // Membership is confirmed if any results are returned
        if (results != null && results.hasMore()) {
            results.close(); // cleanup
            return true;
        }

        // Check directory subgroups
        if (expandGroup) {
            return isSubgroupMember(dn);
        }

        return false;
    }

    /**
     * Returns the members of the group.
     * Performs LDAP searches to retrieve the members.
     * <p>
     * By default, subgroups and their members are also included.
     * As subgroup expansion is potentially an expensive activity the feature
     * may be disabled by setting the environment property
     * "com.sun.jndi.ldap.obj.expandGroup"
     * to the string value "false". When the feature is disabled only the
     * group's direct members are returned.
     *
     * @return Enumeration The list of members of the group.
     *         When only the {@link LdapGroupFactory} object factory is active
     *         then each element in the enumeration is of class
     *         {@link com.sun.enterprise.security.GroupPrincipal} or
     *         {@link java.security.Principal}. However, when additional
     *         object factories are active then the enumeration may contain
     *         elements of a different class.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    @Override
    public Enumeration members() {
        if (!isBound()) {
            throw new IllegalStateException();
        }
        if (debug) {
            System.out.println("[debug] enumerating the members");
        }

        try {
            // Retrieve the group's member attribute unless already cached
            if ((memberAttr != null)
                || (memberAttr = ctx.getAttributes(name, new String[] {memberAttrId}).get(memberAttrId)) != null) {
                return new Members(memberAttr.getAll());
            }

        } catch (NamingException e) {
            if (debug) {
                System.out.println("[debug] error enumerating the members: " + e);
            }
            // ignore
        }
        return new Members(); // empty
    }

    /**
     * Removes a member from the group.
     * Performs an LDAP modify to remove the member.
     *
     * @param member The name of the member to be removed.
     * @return boolean true if the removal was successful; false otherwise.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    public boolean removeMember(Principal member) {
        try {
            return removeMember(member.getName());
        } catch (NamingException e) {
            if (debug) {
                System.out.println("[debug] error removing the member: " + e);
            }
            return false;
        }
    }

    /**
     * Removes a member from the group.
     * Performs an LDAP modify to remove the member.
     *
     * @param dn The distinguished name (RFC 2253) of the member to be removed.
     * @return boolean true if the removal was successful; false otherwise.
     * @throws NamingException The exception is thrown if an error occurs while
     *                         performing LDAP modify.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    public boolean removeMember(String dn) throws NamingException {
        if (!isBound()) {
            throw new IllegalStateException();
        }
        if (debug) {
            System.out.println("[debug] removing the member: " + dn);
        }
        return modifyMember(dn, DirContext.REMOVE_ATTRIBUTE);
    }

    /**
     * Retrieves the distinguished name of the group.
     *
     * @return String The distinguished name of the group.
     * @throws IllegalStateException The exception is thrown if the
     *         group does not represent a group in the directory.
     */
    @Override
    public String getName() {
        if (!isBound()) {
            throw new IllegalStateException();
        }
        return groupDN;
    }

    /**
     * Sets the distinguished name of the group.
     * This method is called by {@link LdapGroupFactory}.
     *
     * @param groupDN The group's distinguished name.
     * @param ctx An LDAP context.
     * @param name The group's name relative to the context.
     */
    // package private (used by LdapGroupFactory)
    void setName(String groupDN, DirContext ctx, Name name) {
        bindDN = groupDN;
        bindCtx = ctx;
        bindName = name;
    }

    /**
     * Creates a string representation of the group.
     *
     * @return String A string listing the distinguished name of the group and
     *         the contents of the group's attribute set. See
     * {@link javax.naming.directory.BasicAttributes#toString()}
     *         for details. The name is omitted if the group is not bound in
     *         the directory and null is returned if no attributes are
     *         available.
     */
    @Override
    public String toString() {
        isBound(); // refresh attributes (if necessary)
        if (groupDN != null) {
            StringBuffer buffer = new StringBuffer();
            buffer.append("{name: ").append(groupDN).append("}");
            if (attributes != null) {
                buffer.append(attributes.toString());
            }
            return buffer.toString();
        } else {
            return attributes == null ? "" : attributes.toString();
        }
    }

    /**
     * Retrieves the group's attributes.
     * This method is called by {@link LdapGroupFactory}.
     *
     * @return Attribute The group's attributes.
     */
    // package private (used by LdapGroupFactory)
    Attributes getAttributes() {
        return attributes;
    }

    /**
     * Determines whether the supplied LDAP objectClass attribute matches that
     * of the group. A match occurs if the argument contains the value
     * "GroupOfNames".
     *
     * @param objectClass The non-null objectClass attribute to check against.
     * @return true if the objectClass attributes match; false otherwise.
     */
    // package private (used by LdapGroupFactory)
    static boolean matches(Attribute objectClass) {

        try {
            for (Enumeration values = objectClass.getAll(); values.hasMoreElements();) {
                if (OBJECT_CLASS.equalsIgnoreCase((String) values.nextElement())) {
                    return true;
                }
            }
        } catch (NamingException e) {
            if (debug) {
                System.out.println("[debug] error matching objectClass: " + e);
            }
            // ignore
        }
        return false;
    }

    /**
     * Determines whether the group object is bound in the directory.
     *
     * A group object is considered to be bound in the directory when
     * each of the values of its objectClass attribute match those of
     * an object in the directory having this group's distinguished name.
     *
     * @return true if the object is bound; false otherwise.
     */
    private boolean isBound() {
        if (objectIsBound) {
            return true;
        } else if (bindCtx != null && bindName != null && attributes != null) {
            try {
                // Retrieve the group's attributes
                Attributes bindAttrs = bindCtx.getAttributes(bindName);
                Attribute bindObjectClass = bindAttrs.get("objectClass");
                // Check whether the objectClass attributes match
                if (bindObjectClass != null && bindObjectClass.equals(attributes.get("objectClass"))) {
                    // Set the group's bound state
                    initializeBoundState(bindDN, bindCtx, bindName, env, bindAttrs);
                    return true;
                }

            } catch (NameNotFoundException e) {
                if (debug) {
                    System.out.println("[debug] object is not bound: " + e);
                }
                // ignore

            } catch (NamingException e) {
                if (debug) {
                    System.out.println("[debug] error checking if bound: " + e);
                }
                // ignore
            }
            // Reset state to unbound
            bindDN = null;
            bindCtx = null;
            bindName = null;
        }
        return false;
    }

    /**
     * Releases the naming context created by this group.
     * Closes the root naming context if one had been created.
     *
     * @throws NamingException The exception is thrown if a problem is
     *                         encountered while closing the naming context.
     */
    public void close() throws NamingException {
        if (rootCtx != null && rootCtx != ctx) {
            rootCtx.close();
            rootCtx = null;
        }
    }

    /**
     * Initialize the group's state when unbound.
     */
    private void initializeState(Attribute objectClass, String memberAttrId, String memberFilterExpr, Set members) {
        objectIsBound = false;
        this.memberAttrId = memberAttrId;
        this.memberFilterExpr = memberFilterExpr;

        // initialize the group's attribute set.
        attributes = new BasicAttributes(true);
        attributes.put(objectClass);

        if (members != null && (!members.isEmpty())) {
            memberAttr = new BasicAttribute(memberAttrId);
            for (Object object : members) {
                if (object instanceof Principal) {
                    memberAttr.add(((Principal) object).getName());
                } else {
                    memberAttr.add(object);
                }
            }
            attributes.put(memberAttr);
        }
    }

    /**
     * Initialize the group's state when bound.
     */
    private void initializeBoundState(String groupDN, DirContext ctx, Name name, Hashtable env, Attributes attributes) {
        objectIsBound = true;
        this.groupDN = groupDN;
        this.ctx = ctx;
        this.name = name;
        this.env = env;
        if (env == null && ctx != null) {
            try {
                this.env = ctx.getEnvironment();
            } catch (NamingException e) {
                // ignore
            }
        }
        if (env != null) {
            String expandGroup = (String) env.get(EXPAND_GROUP);
            if ("false".equalsIgnoreCase(expandGroup)) {
                this.expandGroup = false;
            }
        }
        if (attributes != null) {
            this.attributes = attributes;
            memberAttr = attributes.get(memberAttrId);
        }
    }

    /**
     * Add or remove a value from the member attribute.
     */
    private boolean modifyMember(String member, int mod_op) throws NamingException {
        Attribute memberAttr = new BasicAttribute(memberAttrId, member);
        modification[0] = new ModificationItem(mod_op, memberAttr);
        ctx.modifyAttributes(name, modification);
        this.memberAttr = null; // invalidate the cache
        return true;
    }

    /**
     * Checks if the supplied name is a member of any subgroups.
     * All the members are retrieved and any subgroups are explored.
     */
    private boolean isSubgroupMember(String dn) throws NamingException {
        for (NamingEnumeration members = (NamingEnumeration) members(); members.hasMore();) {
            Object obj = members.next();
            if (obj instanceof GroupOfNames && ((GroupOfNames) obj).isMember(dn)) {
                members.close(); // cleanup
                return true;
            } else if (obj instanceof GroupOfURLs && ((GroupOfURLs) obj).isMember(dn)) {
                members.close(); // cleanup
                return true;
            }
        }
        return false;
    }

    /**
     * Generate environment properties suitable for the root context using
     * the supplied set of properties. The following properties are modified
     * if necessary:
     * <ul>
     * <li> java.naming.provider.url property:
     *        trim any components after hostname/port.
     *        (identifies the root context).
     * </ul>
     *
     * @param env A set of environment properties. It is cloned only when a
     *            modification is necessary.
     * @return A set of environment properties suitable for the root context.
     */
    // package private (used by GroupOfURLs)
    static Hashtable generateRootContextProperties(Hashtable env) {
        String url = null;

        if (env != null) {
            if ((url = (String) env.get(Context.PROVIDER_URL)) != null) {

                try {
                    // java.net.URI is cleaner but depends on J2SE v 1.4
                    LdapURL ldapUrl = new LdapURL(url);
                    String dn = ldapUrl.getDN();
                    // check if a non-empty DN is present
                    if (dn != null && dn.length() > 0) {
                        String host = ldapUrl.getHost();
                        int port = ldapUrl.getPort();
                        url = "ldap://" + ((host != null) ? host : "") + ((port != -1) ? (":" + port) : "");
                    } else {
                        url = null; // reset flag
                    }
                } catch (NamingException e) {
                    throw new IllegalArgumentException(url);
                }
            }
            // only clone if making mods
            if (url != null) {
                env = (Hashtable) env.clone();
                env.put(Context.PROVIDER_URL, url);
            }
        }

        return env;
    }


    /**
     * The members of a static group.
     */
    class Members implements NamingEnumeration {

        private NamingEnumeration memberDNs = null;
        private final boolean expandSubgroups;
        private ArrayList subgroups = null;
        private NamingEnumeration subgroupMembers = null;

        /**
         * Empty members object derived from a static group.
         */
        Members() {
            if (debug) {
                System.out.println("[debug] constructing an empty GroupOfNames.Members object");
            }
            expandSubgroups = expandGroup; // GroupOfNames.expandGroup
        }

        /**
         * Members object derived from a static group.
         */
        Members(NamingEnumeration memberDNs) {
            if (debug) {
                System.out.println("[debug] constructing a GroupOfNames.Members object");
            }
            this.memberDNs = memberDNs;
            expandSubgroups = expandGroup; // GroupOfNames.expandGroup
        }

        /**
         * Check if the group has more members.
         *
         * @return true if the group has another member.
         */
        @Override
        public boolean hasMoreElements() {
            try {
                return hasMore();
            } catch (NamingException e) {
                if (debug) {
                    System.out.println("[debug] error checking for more members: " +
                        e);
                }
                return false;
            }
        }

        /**
         * Check if the group has more members.
         *
         * @return true if the group has another member.
         * @throws NamingException If a problem is encountered while checking
         *                         whether the group has any more members.
         */
        @Override
        public boolean hasMore() throws NamingException {

            if (memberDNs == null) {
                return false; // empty
            }

            if (memberDNs.hasMore()) {
                return true;
            }

            // Check subgroups
            if (expandSubgroups && subgroups != null) {
                if (subgroupMembers == null && (! subgroups.isEmpty())) {
                    // Retrieve the first subgroup's members
                    subgroupMembers =
                        (NamingEnumeration)((GroupPrincipal)subgroups.remove(0)).members();
                }
                if (null != subgroupMembers && subgroupMembers.hasMore()) {
                    return true;
                } else if (! subgroups.isEmpty()) {
                    // Retrieve the next subgroup's members
                    subgroupMembers =
                        (NamingEnumeration)((GroupPrincipal)subgroups.remove(0)).members();
                    return subgroupMembers.hasMore();
                }
            }

            return false;
        }

        /**
         * Retrieve the next member of the group.
         * Some members may themselves be groups. Such a member is returned as
         * an object of class {@link com.sun.enterprise.security.GroupPrincipal}.
         * <p>
         * Note that in order to determine whether a member is itself a group
         * this method reads each member's LDAP entry. As this is potentially an
         * expensive activity the feature may be disabled by setting the
         * environment property
         * "com.sun.jndi.ldap.obj.expandGroup"
         * to the string value "false".  When the feature is
         * disabled then an object of class {@link java.security.Principal}
         * is returned. By default, the feature is enabled.
         *
         * @return The next member of the group.
         *         When only the {@link LdapGroupFactory} object factory is active
         *         then an object of class
         *         {@link java.security.Principal} or
         *         {@link com.sun.enterprise.security.GroupPrincipal} is returned.
         *         However, when additional object factories are active then an
         *         object of a different class may be returned.
         * @throws NoSuchElementException If no more members exist or if a
         *         {@link javax.naming.NamingException} was encountered while
         *         retrieving the next element.
         */
        @Override
        public Object nextElement() {
            try {
                return next();
            } catch (NamingException e) {
                // Exception.initCause is cleaner but depends on J2SE v 1.4
                throw new NoSuchElementException(e.toString());
            }
        }

        /**
         * Retrieve the next member of the group.
         * Some members may themselves be groups. Such a member is returned as
         * an object of class {@link com.sun.enterprise.security.GroupPrincipal}.
         * <p>
         * Note that in order to determine whether a member is itself a group
         * this method reads each member's LDAP entry. As this is potentially an
         * expensive activity the feature may be disabled by setting the
         * environment property
         * "com.sun.jndi.ldap.obj.expandGroup"
         * to the string value "false".  When the feature is
         * disabled then an object of class {@link java.security.Principal}
         * is returned. By default, the feature is enabled.
         *
         * @return The next member of the group.
         *         When only the {@link LdapGroupFactory} object factory is active
         *         then an object of class
         *         {@link java.security.Principal} or
         *         {@link com.sun.enterprise.security.GroupPrincipal} is returned.
         *         However, when additional object factories are active then an
         *         object of a different class may be returned.
         * @throws NamingException If a problem is encountered while retrieving the
         *                         next member of the group.
         * @throws NoSuchElementException If no more members exist.
         */
        @Override
        public Object next() throws NamingException {

            if (memberDNs == null) {
                throw new NoSuchElementException(); // empty
            }

            String memberDN = null;

            try {
                if (memberDNs.hasMore()) {
                    memberDN = (String)memberDNs.next();

                    // Skip lookup when expandGroup=false
                    if (! expandGroup) {
                        return new LdapPrincipal(memberDN);
                    }

                    // Create the root context
                    if (rootCtx == null) {
                        rootCtx = getRootContext();
                    }
                    // Perform the lookup from the root context
                    Object object = rootCtx.lookup(new CompositeName().add(memberDN));

                    if (object instanceof GroupPrincipal) {
                        if (expandSubgroups) {
                            if (subgroups == null) {
                                subgroups = new ArrayList();
                            }
                            subgroups.add(object);
                        }
                        // Subgroups are members too
                        return object;

                    } else if (object instanceof DirContext) {
                        ((DirContext)object).close(); // cleanup
                        return new LdapPrincipal(memberDN);

                    } else {
                        return object; // additional object factories are active
                    }
                }
            } catch (NameNotFoundException e) {
                // Cannot find the member's LDAP entry so return an LdapPrincipal
                return new LdapPrincipal(memberDN);
            }

            // Check subgroups
            if (expandSubgroups && subgroups != null) {
                if (subgroupMembers == null && (!subgroups.isEmpty())) {
                    // Retrieve the first subgroup's members
                    subgroupMembers = (NamingEnumeration) ((GroupPrincipal) subgroups.remove(0)).members();
                }
                if (null != subgroupMembers && subgroupMembers.hasMore()) {
                    return subgroupMembers.next();
                } else if (!subgroups.isEmpty()) {
                    // Retrieve the next subgroup's members
                    subgroupMembers = (NamingEnumeration) ((GroupPrincipal) subgroups.remove(0)).members();
                    return subgroupMembers.next();
                }
            }

            throw new NoSuchElementException();
        }

        /**
         * Closes the enumeration and releases its resources.
         *
         * @throws NamingException If a problem is encountered while
         *                         closing the enumeration.
         */
        @Override
        public void close() throws NamingException {
            if (subgroupMembers != null) {
                subgroupMembers.close(); // cleanup
            }
        }


        private DirContext getRootContext() throws NamingException {
            DirContext rootCtx = null;
            // test for the root of the namespace (the empty name)
            if (ctx.getNameInNamespace().length() == 0) {
                rootCtx = ctx; // context is already a root context
            } else {
                // Make properties suitable for the root context
                env = generateRootContextProperties(env);
                rootCtx = (DirContext) NamingManager.getInitialContext(env);
                // Propagate any context request controls (to rootCtx)
                if (ctx instanceof LdapContext) {
                    ((LdapContext) rootCtx).setRequestControls(((LdapContext) ctx).getRequestControls());
                }
            }
            return rootCtx;
        }
    }
}