LdapLoginModule.java

[lrem]

Hi there,

I was wondering if there is any reason why the match statement of the InitialLdapContext search looks for only the username and not the fully qualified userDN?

 String roleAttrName = (String) options.get(ROLE_ATTRIBUTE_ID_OPT);
 if( roleAttrName == null )
 roleAttrName = "roles";
 BasicAttributes matchAttrs = new BasicAttributes(true);
 matchAttrs.put(uidAttrName, username);
 String[] roleAttr =
 {roleAttrName};
 try
 {
 NamingEnumeration answer = ctx.search(rolesCtxDN, matchAttrs, roleAttr);

My roles are set up with a list of uniquemembers which are fully qualified DNs (ie. uniquemember=uid=fred, ou=People, o=somewhere.co.uk). Is this not the normal way it is done?

[starksm64]

That is one way of doing it. An option should be added to indicate whether the username as passed to the login module should be used or the userDN.

[lrem]

Thanks for changing the code to allow this

[prashu]

Hi all,
Can anyone pls tell me how to configure LDAP with JBoss ???
I m very new to LDAP & have no idea abt LDAP.
Does it require any LDAP s/w ??? If so, how to configure it with JBoss ??? From where will I get it ??
Also, is there any sample code provided using LDAP with JBoss ????

Thanks & Regards,
Prashant

[rndgatewaynet]

lrem, can you please provide the .ldif files that makes up your db,
along with your auth.conf file??
thanx

[rndgatewaynet]

I mean it seems to me that the LdapLoginModule is designed
as to *select* the rolenames where uidattribute=*user supplied id",
or uidattribute="user's DN", but what we need at the end is
a list of pure role names like:
description: role1
description: role2
and so on.
If we set up the roles to be uniquemembers of
a groupofuniquenames object, all we get is something like
uniquemember: cn=role1
uniquemember: cn=role2, which clearly will fail the authorization
since what we need is to get role1,role2.

Am i missing some part?
How did you do it?

[rndgatewaynet]

Also, since most commercial ldap configurations (like lotus domino notes server), represent the groups like a set of persons,
it would be natural to search for group names that *have* this
user instead of searching for the roles of a user.

Any thoughts???

[lrem]

Groups = Roles