tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Daniel Mikusa <dmik...@vmware.com>
Subject Re: documentation comment about jndi realms
Date Fri, 19 Oct 2012 15:23:24 GMT
On Oct 19, 2012, at 11:07 AM, Robert J. Carr wrote:

> I've been using tomcat for many years (so thanks to the devs!) but
> this is the first time I've had to use LDAP for authentication.
> Reading over the docs on this page were very useful:
> 
> http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html#JNDIRealm
> 
> However, at the bottom of the section where it talks about using 'userRoleName':
> 
> This realm configuration would satisfy the new requirements:
> <Realm   className="org.apache.catalina.realm.JNDIRealm"
>     connectionURL="ldap://localhost:389"
>          userBase="ou=people,dc=mycompany,dc=com"
>        userSearch="(mail={0})"
>      userRoleName="memberOf"
>          roleBase="ou=groups,dc=mycompany,dc=com"
>          roleName="cn"
>        roleSearch="(uniqueMember={0})"
> />
> 
> I think the last 3 attributes for role are unnecessary, and if so,
> then they're confusing.  In my test, which is similar to the LDIF
> right above it:
> 
> dn: uid=jjones,ou=people,dc=mycompany,dc=com
> objectClass: inetOrgPerson
> uid: jjones
> sn: jones
> cn: janet jones
> mail: j.jones@mycompany.com
> memberOf: role2
> memberOf: role3
> userPassword: janet
> 
> I didn't need those last 3 role entries and everything worked fine.

You may not need all of the settings.  It really depends on the way your LDAP server is structured.
 In your particular case you didn't need them.  Some people will though.  For an example of
when you will need them see the LDIF used by the documentation.

Dan


> Just a note because this section is already confusing enough and I
> thought that made it worse.
> 
> Sorry if I'm wrong in my assumptions.
> 
> Thanks-
> Robert
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message