3 Replies Latest reply on Jan 24, 2006 4:57 PM by abickford

    authentication via ldap and role via database.

    jbossalexandre
    jbossalexandre Jan 9, 2006 8:33 AM

      I set up jboss so it check password with my LDAP. Now I want it to get the user role in a database but only the role(not checking the password once again because password are only stored in the LDAP).
      How can I do that?
      alex

      • 2203 Views
      • Tags:
        • 1. Re: authentication via ldap and role via database.
          jbossalexandre
          jbossalexandre Jan 9, 2006 9:20 AM (in response to jbossalexandre)

          trying to be clearer the doc chapter 8.4.6.3 says:
          It's often the case that a local LDAP server provides identity and authentication services but is unable to use the authorization services. This is because application roles don't always map well onto LDAP groups, and LDAP administrators are often hesitant to allow external application-specific data in central LDAP servers. For this reason, the LDAP authentication module is often paired with another login module, such as the database login module, that can provide roles more suitable to the application being developed.

          but chapter 8.4.6.4 says about the databaseLoginModule:
          You would use this login module if you have your username, password and role information relational database
          My question:
          How can I use the databaseLoginModule just to retrieve role or what module should I use to do so? I don't have the password in the database.
          thanks in advance for help, link or anything usefull.

            • Actions
          • 2. Re: authentication via ldap and role via database.
            joris77
            joris77 Jan 23, 2006 9:48 AM (in response to jbossalexandre)

            I'm not an expert but, I think you have to write your own custom loginmodule and after you have authenticated with LDAP call the database for the roles with the user id.

            Regards,

            Joris Wijlens

              • Actions
            • 3. Re: authentication via ldap and role via database.
              abickford
              abickford Jan 24, 2006 4:57 PM (in response to jbossalexandre)

              I came across the same documentation and it sounds like these modules could be chained togeter to achive this functionality. So far I have not been successful in getting this to work. I'd hate to write a custom LoginModule out of ignorance of what is already in place. It seems like there would be a standard solution/best practice for this usecase.

              From what I've found, as long as the username/password are the same in both LDAP and the DB, you are fine. If they don't match, you are out of luck. Is there a way, short of hacking the source code, to get the DatabaseServerLoginModule to ignore the password/principalsQuery and just add the roles that match the userID previously authenticated by LDAP? Or is what I'm asking dangerous and not supported?

              adam

                • Actions