Mailing-List: contact users-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@activemq.apache.org
Received-SPF: pass (athena.apache.org: domain of chrisdrobison@gmail.com
 designates 209.85.212.171 as permitted sender)
MIME-Version: 1.0
Date: Thu, 2 Feb 2012 14:13:16 -0700
Message-ID: 
 <CACpOGk_CqaXEHBUpC=pvKGLgbg1vchudv0KAg-CBqVWYt0E6mw@mail.gmail.com>
Subject: LDAPAuthorizationMap and Active Directory
From: Chris Robison <chrisdrobison@gmail.com>
To: users@activemq.apache.org
Content-Type: multipart/alternative; boundary=f46d043c7ec02cf2a804b801aac4

--f46d043c7ec02cf2a804b801aac4
Content-Type: text/plain; charset=ISO-8859-1

Has anyone been able to use the LDAPAuthorizationMap successfully with
Active Directory? In my investigation, I don't think it will ever work in
its current state. When looking at the code, it is making the assumption
 that the value of the member attribute (or what ever attribute you are
using) is always going to be in the form "{0}={1}" (a RDN). But, according
to the OpenLDAP spec, the member attribute value is a distinguished name.
That means values are a comma delimited list of RDNs. So, for example I
have AD groups that represent MQ roles. Here's one I use:
"CN=MQUser,OU=Groups,OU=ActiveMQ,DC=cdr,DC=corp". The LDAPAuthorizationMap
considers the name of the
role "MQUser,OU=Groups,OU=ActiveMQ,DC=cdr,DC=corp". Is this by design? I
would be happy to submit a patch to change this behavior. Thoughts?

Chris Robison

--f46d043c7ec02cf2a804b801aac4--