4 Replies Latest reply on Feb 25, 2015 6:53 AM by marcelomrwin

    Authenticating via LdapExtLoginModule against Active Directory Forest (LDAP_REFERRAL)

    lazarius
    lazarius Aug 22, 2014 4:17 AM

      Is there a way to authenticate against an Active Directory *Forest* via any of the Ldap Login Modules or any other special one?

       

      having the following config in standalone.xml:

                             <module-option name="java.naming.provider.url" value="ldap://ad.company.tld:389"/ >
                             <module-option name="baseCtxDN" value="OU=DE,OU=Users,OU=Accounts,OU=US,OU=Hosting,DC=ad00,DC=company,DC=tld"/ >
                             <module-option name="baseFilter" value="(CN={0})"/ >
                             <module-option name="rolesCtxDN" value="OU=Groups,OU=Accounts,OU=US,OU=Hosting,DC=ad00,DC=company,DC=tld"/ >
                             <module-option name="roleFilter" value="(member={1})"/>
                             <module-option name="roleAttributeID" value="CN"/ >
                             <module-option name="searchScope" value="SUBTREE_SCOPE"/>

       

      on wildfly 8 I get a javax.naming.NameNotFoundException with a full stack trace pointing to

      LdapCtx.java:3112. This in turn

      case LdapClient.LDAP_REFERRAL:
             e = new NamingException(message);
             break;

       

      points to a Referral Error, thus it looks like the LDAP module can't follow the referral control. Moreover, I found

      at http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html the Note (at the bottom):

      Windows Active Directory: Because Active Directory does not support the Manage Referral control, none of the examples in this lesson will work against Active Directory.

       

      thus I guess there is no chance for LdapExtLoginModule to succeed If it relies on JNDI provided by Java.