Skip to Content

Wiki source code of org.clazzes.login.ldap

Version 5.1 by wolfgang_glas@iteg_at on 2013-02-22 08.34:02
Show last authors
1 The ldap-login-service is provided as an OSGi bundle, which may be activated by
2
3 (% class="code" %)
4 (((
5 obr:addurl http:~/~/maven.clazzes.org/repository.xml
6 obr:deploy ldap-login-service
7 )))
8
9 The maven artifact is:
10
11 (% class="code" %)
12 (((
13 <groupId>org.clazzes.login</groupId>
14 <artifactId>ldap-login-service</artifactId>
15 )))
16
17 === {{id name="org.clazzes.login.ldap-Functionality"/}}Functionality ===
18
19 The LDAP login service authenticates against users in an ADS domain or against users in an LDAP server configured for an individual domain.
20
21 The function {{code language="none"}}tryLogin(){{/code}} needs credentials if run against a legacy LDAP Server.
22
23 For AD DS servers, an additional non-search authentication method {{code language="none"}}bindAds{{/code}} is implemented for {{code language="none"}}tryLogin(){{/code}}, which tries to bind using a principal in the form {{code language="none"}}user@domain{{/code}}.
24
25 The functions {{code language="none"}}searchUser(){{/code}}, {{code language="none"}}getGroups(){{/code}}, {{code language="none"}}getGroupMembers(){{/code}} need bind credentials and will only work in AD DS environments.
26
27 === {{id name="org.clazzes.login.ldap-SampleConfigurationforauthenticationagainstanADS-Domain"/}}Sample Configuration for authentication against an ADS-Domain{{id name="org.clazzes.login.ldap-sampleAdsConfig"/}} ===
28
29 The following sample configuration is the most common configuration OSGi configuration in PID {{code language="none"}}org.clazzes.login.ldap{{/code}}, which allows you to authenticate users against an Active Directory Domain.
30
31 All you need to know is the Windows/NetBIOS Name of your domain and the corresponding DNS name used to physically locate the Active Directory server.
32
33 In our example we use {{code language="none"}}EXAMPLE{{/code}} as the Windows/NetBIOS domain name with its DNS counterpart {{code language="none"}}example.com{{/code}}.
34
35 |=(((
36 (% class="tablesorter-header-inner" %)
37 (((
38 Key
39 )))
40 )))|=(((
41 (% class="tablesorter-header-inner" %)
42 (((
43 Value
44 )))
45 )))
46 |(((
47 {{code language="none"}}
48 defaultDomain
49 {{/code}}
50 )))|(((
51 {{code language="none"}}
52 EXAMPLE
53 {{/code}}
54 )))
55 |(((
56 {{code language="none"}}
57 domain.EXAMPLE.controllerUri
58 {{/code}}
59 )))|(((
60 {{code language="none"}}
61 ads://example.com
62 {{/code}}
63 )))
64 |(((
65 {{code language="none"}}
66 domain.EXAMPLE.authMethod
67 {{/code}}
68 )))|(((
69 {{code language="none"}}
70 bindAds
71 {{/code}}
72 )))
73
74 === {{id name="org.clazzes.login.ldap-DetailedConfiguration"/}}Detailed Configuration ===
75
76 The LDAP login service may be configured using the OSGi configuration PID {{code language="none"}}org.clazzes.login.ldap{{/code}} using these configuration values:
77
78 |=(((
79 (% class="tablesorter-header-inner" %)
80 (((
81 Key
82 )))
83 )))|=(((
84 (% class="tablesorter-header-inner" %)
85 (((
86 Default Value
87 )))
88 )))|=(((
89 (% class="tablesorter-header-inner" %)
90 (((
91 Description
92 )))
93 )))
94 |(((
95 {{code language="none"}}
96 defaultDomain
97 {{/code}}
98 )))|(((
99
100 )))|(((
101 The domain to use for principals, which do not contain a domain.
102 )))
103 |(((
104 {{code language="none"}}
105 domain.<domain>.controllerUri
106 {{/code}}
107 )))|(((
108
109 )))|(((
110 The server to contact. Supported URL schemes: {{code language="none"}}ldap{{/code}}, {{code language="none"}}ldaps{{/code}}, {{code language="none"}}ads{{/code}}. See below
111 )))
112 |(((
113 {{code language="none"}}
114 domain.<domain>.authMethod
115 {{/code}}
116 )))|(((
117 {{code language="none"}}
118 searchAndBind
119 {{/code}}
120 )))|(((
121 The method for authenticating a user. Supported methods: {{code language="none"}}searchAndBind{{/code}}, {{code language="none"}}bindAds{{/code}}.
122 )))
123 |(((
124 {{code language="none"}}
125 domain.<domain>.bindUser
126 {{/code}}
127 )))|(((
128
129 )))|(((
130 The DN used for binding before searching something in the domain <domain>. For {{code language="none"}}tryLogin(){{/code}} this applies only to the authMethod {{code language="none"}}searchAndBind{{/code}}.
131 )))
132 |(((
133 {{code language="none"}}
134 domain.<domain>.bindPassword
135 {{/code}}
136 )))|(((
137
138 )))|(((
139 The password used for binding searching something in the domain <domain>. For {{code language="none"}}tryLogin(){{/code}} this applies only to the authMethod {{code language="none"}}searchAndBind{{/code}}.
140 )))
141 |(((
142 {{code language="none"}}
143 domain.<domain>.userAttribute
144 {{/code}}
145 )))|(((
146 {{code language="none"}}
147 samAccountName
148 {{/code}}
149 )))|(((
150 The LDAP attribute to use for finding a given user name.
151 )))
152 |(((
153 {{code language="none"}}
154 domain.<domain>.prettyNameAttribute
155 {{/code}}
156 )))|(((
157 {{code language="none"}}
158 cn
159 {{/code}}
160 )))|(((
161 The LDAP attribute to try to use as pretty name for users and groups.
162 )))
163 |(((
164 {{code language="none"}}
165 domain.<domain>.eMailAddressAttribute
166 {{/code}}
167 )))|(((
168 {{code language="none"}}
169 mail
170 {{/code}}
171 )))|(((
172 The LDAP attribute to try to use as primary e-mail address for users.
173 )))
174
175 There may be multiple domains in a configuration.
176
177 === {{id name="org.clazzes.login.ldap-ControllerSchemes"/}}Controller Schemes ===
178
179 The URL schemes for a domain controller are ldap, ldaps and ads.
180
181 The {{code language="none"}}ads{{/code}} URL scheme for the URL {{code language="none"}}ads://mydomain.com{{/code}} undertakes a lookup for the DNS records
182
183 (% class="code" %)
184 (((
185 SRV _ldap._tcp.mydomain.com
186 TXT _ldap._tcp.mydomain.com
187 )))
188
189 to auto-detect the apropriate {{code language="none"}}ldap(s){{/code}} URI.
190
191