How to allow anonymous login in org.apache.ftpserver?

Question

I wrote a little code like this to start an ftp server embedded in my application. It's based on apache ftpserver

I found that anonymous user could not login. Client keeps get 530.

Do I have add a configure file for ftp? I can not find any API to create a User to add to UserManger.

private void start_ftp() throws FtpException {
    FtpServerFactory serverFactory = new FtpServerFactory();

    ListenerFactory factory = new ListenerFactory();

    // set the port of the listener
    factory.setPort(DEF_FTP_PORT);

    // replace the default listener
    serverFactory.addListener("default", factory.createListener());

    Ftplet fl = new MyFtplet();

    Map<String, Ftplet> map_ftplest = new LinkedHashMap<String, Ftplet>();
    map_ftplest.put("default", fl);

    serverFactory.setFtplets(map_ftplest);

    UserManagerFactory u_factory = new PropertiesUserManagerFactory();
    UserManager u_manager = u_factory.createUserManager();
    //u_manager.
    Boolean b = u_manager.doesExist("anonymous");

    serverFactory.setUserManager(u_manager);

    // start the server
    server = serverFactory.createServer();

    server.start();
}

Answer 1

An own UserManager isn't needed. Try this:

FtpServerFactory serverFactory = new FtpServerFactory();
ConnectionConfigFactory connectionConfigFactory = new ConnectionConfigFactory();
connectionConfigFactory.setAnonymousLoginEnabled(true);

serverFactory.setConnectionConfig(connectionConfigFactory.createConnectionConfig());

BaseUser user = new BaseUser();
user.setName("anonymous");
serverFactory.getUserManager().save(user);

startFtpServer(serverFactory);

Answer 2

To achieve anonymous login through Apache FtpServer you have to enable anonymous authentication and then add a "anonymous" user to the UserManager.

Here is a snippet that sets anonymous authentication:

FtpServerFactory serverFactory = new FtpServerFactory();

ConnectionConfigFactory connectionConfigFactory = new ConnectionConfigFactory();
connectionConfigFactory.setAnonymousLoginEnabled(false);

serverFactory.setConnectionConfig(connectionConfigFactory.createConnectionConfig());
serverFactory.setUserManager(new TestUserManagerFactory().createUserManager());

startFtpServer(serverFactory);

You can then provide a UserManager that authenticates and authorizes logins. Here is a custom UserManagerFactory and AbstractUserManager:

private class TestUserManagerFactory implements UserManagerFactory {

    @Override
    public UserManager createUserManager() {
        return new TestUserManager("admin", new ClearTextPasswordEncryptor());
    }
}

private class TestUserManager extends AbstractUserManager {
    private BaseUser testUser;
    private BaseUser anonUser;

    public TestUserManager(String adminName, PasswordEncryptor passwordEncryptor) {
        super(adminName, passwordEncryptor);

        testUser = new BaseUser();
        testUser.setAuthorities(Arrays.asList(new Authority[] {new ConcurrentLoginPermission(1, 1)}));
        testUser.setEnabled(true);
        testUser.setHomeDirectory(TEST_USER_FTP_ROOT);
        testUser.setMaxIdleTime(10000);
        testUser.setName(TEST_USERNAME);
        testUser.setPassword(TEST_PASSWORD);

        anonUser = new BaseUser(testUser);
        anonUser.setName("anonymous");
    }

    @Override
    public User getUserByName(String username) throws FtpException {
        if(TEST_USERNAME.equals(username)) {
            return testUser;
        } else if(anonUser.getName().equals(username)) {
            return anonUser;
        }

        return null;
    }

    @Override
    public String[] getAllUserNames() throws FtpException {
        return new String[] {TEST_USERNAME, anonUser.getName()};
    }

    @Override
    public void delete(String username) throws FtpException {
        //no opt
    }

    @Override
    public void save(User user) throws FtpException {
        //no opt
        System.out.println("save");
    }

    @Override
    public boolean doesExist(String username) throws FtpException {
        return (TEST_USERNAME.equals(username) || anonUser.getName().equals(username)) ? true : false;
    }

    @Override
    public User authenticate(Authentication authentication) throws AuthenticationFailedException {
        if(UsernamePasswordAuthentication.class.isAssignableFrom(authentication.getClass())) {
            UsernamePasswordAuthentication upAuth = (UsernamePasswordAuthentication) authentication;

            if(TEST_USERNAME.equals(upAuth.getUsername()) && TEST_PASSWORD.equals(upAuth.getPassword())) {
                return testUser;
            }

            if(anonUser.getName().equals(upAuth.getUsername())) {
                return anonUser;
            }
        } else if(AnonymousAuthentication.class.isAssignableFrom(authentication.getClass())) {
            return anonUser;
        }

        return null;
    }
}

The bit that really matters is the return of anonUser.

HTH