AD Security realm authentication and filter with objectGUID instead of sAMAccountName

[a.niemeyer]

Hi,

Within the EAP 7.0 servers' standalone.xml config for a security realm with AD auth, I would like to change that from

<advanced-filter filter="(&amp;(sAMAccountName={0}))"/>

to

<advanced-filter filter="(&amp;(objectGUID={0}))"/>

.

The actual works fine, but I don't know how to change to the desired objectGUID..

Probably the login method with passed username has to change to the encoded objectGUID?!

The login itself goes like this:

@POST
@Path("/login")

public Response login(@FormParam("username") String username, @FormParam("password") String password, @Context HttpServletRequest request) {

   try {

   if (request.getUserPrincipal() != null) {

   logger.info(String.format("user %s is already logged in", request.getUserPrincipal().getName()));

  } else {

  request.login(username, password);

   logger.info("Login Success for: " + username);

  }

  } catch (ServletException e) {

   logger.error("Login Exception: " + e.getMessage());

   return LoginFormServiceUtil.seeOther("../fail_login.html");

  }

Thank you in advance!

Kind regards,

Andreas

[mchoma]

Why such need?

To get user objectGUID in login method you would need extra LDAP call to get that information.

[a.niemeyer]

Such need for marriage...

Could you provide an example?

[mchoma]

You mean sAMAccountName has changed. So user starts to use new sAMAccountName. What is the problem?

[a.niemeyer]

We would rely on the objectGUID for the applicative authorisation and the GUI doesn't require the change - otherwise a particular account is needed to migrate.