Thanks for Jaikiran help.

I have read that article to get the idea of the setup for authentication.

For the authentication with using password file, ldap and other else, it also include the role (authorization) checking. How can I ignore that role checking and just validate the username/password in my first approach?

Thanks for any help.

Can anyone help for this issue?

Thanks in advance.

Thanks for Peter so much.
(most of my question are answered by you, thank you)

Actually, I want to config the LDAP authentication. However, I get failure and it is hard to trace what's wrong. Do you have more example about LDAP Auth config? Or how to trace this auth error?

At the original design of our LDAP server, no role is designed; not for this purpose. Therefore, I just want to skip this role checking in LDAP auth.

I get 403 error when test the ldap auth. It seems that the password authentication is ok because no error is in the server.log. Therefore, it means something is wrong in role authentication.

As my ldap server does not have role design and information, I want to use the same tree (class) for the role authentication. For example, the one attribute of "userclass" or "department" will be used for role authentication. Please help to point out how to config my ldap authentication. My setting is as the following:

<application-policy name = "testLdapExample1">

<login-module code="org.jboss.security.auth.spi.LdapLoginModule"
flag="required">
<module-option name="java.naming.factory.initial">
com.sun.jndi.ldap.LdapCtxFactory
</module-option>
<module-option name="java.naming.provider.url">
ldap://ldap.my.com/
</module-option>
<module-option name="java.naming.security.authentication">
simple
</module-option>
<module-option name="principalDNPrefix">uid=</module-option>
<module-option name="principalDNSuffix">,ou=People,o=my.com</module-option>


<module-option name="rolesCtxDN">,ou=People,o=my.com</module-option>
<module-option name="uidAttributeID">uid</module-option>
<module-option name="matchOnUserDN">true</module-option>
<module-option name="roleAttributeID">uid</module-option>
<module-option name="roleAttributeIsDN">false</module-option>

<module-option name="searchTimeLimit">5000</module-option>
<module-option name="searchScope">ONELEVEL_SCOPE</module-option>
</login-module>

</application-policy>

Thanks Peter.

Workaround 2 is my target too. Under the LDAP tree, find the right person with related information (department code, user class, ...etc). These information can be used as the role. The question is how to config.

I show the setting of LDAP login module. I want to use the "departmentcode" as the role. How to set?

Each applications have their own user profile. For my case, the first step is the password - basic authentication. Then, later on, centralized role checking is a long term task.

Peter,

Can you help to solve my LDAP authentication problem? Thanks.

Thanks in advance for anyone's help.

Thanks Peter.

I do not have a full DN for a "departmentcode". I only know how to config apache to do basic authentication against our ldap server. I know my departmentcode, such as "iso", "hro",...etc.

Also, I do not have ldapsearch utility. Please recommend me which ldapsearch utility I should use to help me to config the ldap setting.

Thanks again.

Thanks Peter.

I install jxplorer and can browse the ldap server; get the my DN as below. And list the ldap auth config as below. I still get 403 error code. Peter, please help to point out what's wrong. Thanks.


DN: uid=dickson,ou=people,o=my.com

********************************************
login-config.xml
--------------------------
<application-policy name = "testLdapExample1">

<login-module code="org.jboss.security.auth.spi.LdapLoginModule"
flag="required">
<module-option name="java.naming.factory.initial">
com.sun.jndi.ldap.LdapCtxFactory
</module-option>
<module-option name="java.naming.provider.url">
ldap://ldap.my.com/
</module-option>
<module-option name="java.naming.security.authentication">
simple
</module-option>
<module-option name="principalDNPrefix">uid=</module-option>
<module-option name="principalDNSuffix">,ou=people,o=my.com</module-option>
<module-option name="rolesCtxDN">,ou=people,o=my.com</module-option>
<module-option name="uidAttributeID">uid</module-option>
<module-option name="matchOnUserDN">true</module-option>
<module-option name="roleAttributeID">userClass</module-option>
<module-option name="roleAttributeIsDN">true</module-option>
<module-option name="searchTimeLimit">5000</module-option>
<module-option name="searchScope">ONELEVEL_SCOPE</module-option>
</login-module>
</application-policy>

*********************************************

web.xml
-----------------
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application

<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>staff</role-name>
</auth-constraint>
</security-constraint>


<login-config>
<auth-method>BASIC</auth-method>
<realm-name>JBoss</realm-name>
</login-config>

<security-role>
<role-name>staff</role-name>
</security-role>