tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Felix Schumacher <felix.schumac...@internetallee.de>
Subject RE: How to authenticate user against ldap grouper / role
Date Fri, 01 Oct 2010 18:23:33 GMT
On Fri, 1 Oct 2010 10:50:53 -0700, "Manish Kashikar -X (mkashika - Zensar
at Cisco)" <mkashika@cisco.com> wrote:
> Appreciate if someone can help us in  doing the setup to validate user
> against ldap role / grouper
I would start reading the documentation at
http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html#JNDIRealm

After that I would switch from userPattern="cn={0},..." to
userSearch="cn={0}" and adding a userBase="...". 
If you really have all your persons directly under that base, than you can
leave userSubtree at its default value, otherwise set it to true, to allow
subtree searches.

Now, having switched to userSearch, you are able to setup a filter on
attributes, such as 
  userSearch="&(cn={0})(specialRole=admin)"
That way you will find only users, which have set the attribute
"specialRole" to "admin".

Next I would configure roles. For that you will have to specify
roleSearch, roleBase and roleName.

After you are done, you could use those roles to setup a security
constraint in your web.xml.

bye
 Felix
> 
> -----Original Message-----
> From: Manish Kashikar -X (mkashika - Zensar at Cisco) 
> Sent: Thursday, September 30, 2010 1:38 PM
> To: users@tomcat.apache.org
> Subject: How to authenticate user against ldap grouper / role
> 
> Hi Team,
> 
>  
> 
> We are able to do tomcat + ldap configuration for authentication. But
> our requirement is to allow only set of users who are part of ldap
> grouper/role. How to do this setup.
> 
>  
> 
> <Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
> 
>  
> connectionURL=<ldap URL>
> 
>  
> contextFactory="com.sun.jndi.ldap.LdapCtxFactory" 
> 
>  
> userPattern="uid={0},ou=active,ou=employees,ou=people,o=cisco.com" 
> 
>                                 />
> 
>  
> 
>  
> 
> Thanks
> 
> Manish K
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Mime
View raw message