Login with LDAP into the management console

[pjbijl567]

I have configured logging into the management console of JBoss AS 7 via LDAP as decribed in:

https://docs.jboss.org/author/display/AS7/Securing+the+Management+Interfaces

Unfortunately I can only verify on ldap username/password. Is it also possible to restrict on groups?

For instance only people which belong to a certain ldap group are allowed to login to the management console.

Cheers,

Peter

[nickarls]

The documentation doesn't give any hints that would indicate it to be possible.

[pjbijl567]

I think it should be possible when you use a ldap filter using memberOf.

This is what I already found out. The problem is getting it to work within the own environment. It would be nice if there was some more documentation about this subject. It is a common scenario for a production environment.

https://community.jboss.org/message/630089

[jaikiran]

Peter Bijl wrote:

Is it also possible to restrict on groups?

For instance only people which belong to a certain ldap group are allowed to login to the management console.

Darran pointed me to a couple of JIRAs you might be interested in watching:

https://issues.jboss.org/browse/AS7-1519

https://issues.jboss.org/browse/AS7-2487

[pjbijl567]

I managed to get a working solution with Active Directory 2008R2:

host.xml

======

<security-realm name="ManagementRealmLDAP">

    <authentication>

        <ldap connection="ldap_connection" recursive="true" base-dn="CN=Users,DC=petersplanet,DC=corp">

            <advanced-filter filter="(&amp;(sAMAccountName={0})(memberOf=CN=JBossAdmins,CN=Users,DC=petersplanet,DC=corp))"/>

        </ldap>

    </authentication>

</security-realm>

<outbound-connections>

    <ldap name="ldap_connection" url="ldap://win17:389" search-dn="CN=ldapuser,CN=Users,DC=petersplanet,DC=corp" search-credential="secret"/>

</outbound-connections>