Mailing-List: contact users-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@activemq.apache.org
Received-SPF: pass (athena.apache.org: domain of torsten@fusesource.com
 designates 74.125.245.76 as permitted sender)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1084)
Subject: Re: LDAPAuthorizationMap and Active Directory
From: Torsten Mielke <torsten@fusesource.com>
In-Reply-To: 
 <CACpOGk_CqaXEHBUpC=pvKGLgbg1vchudv0KAg-CBqVWYt0E6mw@mail.gmail.com>
Date: Fri, 3 Feb 2012 10:48:46 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <0F1EDD44-E402-4BCC-882D-739821ADEFD9@fusesource.com>
References: 
 <CACpOGk_CqaXEHBUpC=pvKGLgbg1vchudv0KAg-CBqVWYt0E6mw@mail.gmail.com>
To: users@activemq.apache.org

> Has anyone been able to use the LDAPAuthorizationMap successfully with
> Active Directory?=20

Not with ActiveDirectory but when following the LDAP tutorial of the =
ActiveMQ Security Guide from FuseSource, the LDAPAuthorizationMap works =
fine against Apache Directory Server.
http://fusesource.com/docs/broker/5.5/security/LDAP.html

Perhaps this tutorial can help?


Torsten Mielke
torsten@fusesource.com
tmielke@blogspot.com

On Feb 2, 2012, at 10:13 PM, Chris Robison wrote:

> Has anyone been able to use the LDAPAuthorizationMap successfully with
> Active Directory? In my investigation, I don't think it will ever work =
in
> its current state. When looking at the code, it is making the =
assumption
> that the value of the member attribute (or what ever attribute you are
> using) is always going to be in the form "{0}=3D{1}" (a RDN). But, =
according
> to the OpenLDAP spec, the member attribute value is a distinguished =
name.
> That means values are a comma delimited list of RDNs. So, for example =
I
> have AD groups that represent MQ roles. Here's one I use:
> "CN=3DMQUser,OU=3DGroups,OU=3DActiveMQ,DC=3Dcdr,DC=3Dcorp". The =
LDAPAuthorizationMap
> considers the name of the
> role "MQUser,OU=3DGroups,OU=3DActiveMQ,DC=3Dcdr,DC=3Dcorp". Is this by =
design? I
> would be happy to submit a patch to change this behavior. Thoughts?
>=20
> Chris Robison