LdapLoginModule to ActiveDirectory, could it be a bug?

[rtselvan]

I configured to the JBoss (4.0.3SP1) LdapLoginModule to authenticate to the active directory and it authenticates fine and but when it is retrieving the memberOf (roles) for the authenticated user, the LdapLoginModule uses the following (sAMAccountName=*) with the filter argument of the {userName} in the ctx.search() method. The search returns all of the roles in the active directory instead of returning the roles that the user is associated with. Should it be (sAMAccountName={0}) and filterArgs?

Is it a bug or is my configuration wrong? Should I report this in the JIRA?

Thanks
/selvan

[andrea_desantis]

I've the same problem and I think is a bug.
With JBoss 4.0.2 work's fine.

Thank's.

[clcarff]

I am having the same problem, and searching the source code I found the cause:

=========================
Org.jboss.security.auth.spi.LdapLoginModule
Line 347 (cvs:HEAD)

roleFilter.append("=*)");

should be changed to

roleFilter.append("={0})");
=========================

As of right now the search runs "(=*)" or in your specific case "(sAMAccountName=*)" which returns all objects that have a sAMAccount name to then search for roles. It should run "(={0})" so that the {0} gets replaced by the username specified in the filterArgs.

I do not see how in it's current state LdapLoginModule works for anyone. I hope we can see this fixed soon.

[clcarff]

Silly me, you already noted the error. The change was made to use the search filter in 4.0.3 this is why it still works properyly in 4.0.2. Has a Jira issue been posted yet?

[dhartford]

"clcarff" wrote:

=========================
Org.jboss.security.auth.spi.LdapLoginModule
Line 347 (cvs:HEAD)

roleFilter.append("=*)");

should be changed to

roleFilter.append("={0})");
=========================

Confirmed on 4.0.4beta, fixed my problem!

-D