[
Date Prev][
Date Next][
Thread Prev][
Thread Next][
Date Index][
Thread Index]
[
List Home]
|
Re: [jetty-users] Re: Problems configuring Jetty for LDAP authentication
|
good point
if someone wants to open an issue on it I'll take a look, maybe switch
the default (which I thought had been by bind), or maybe split it into
two different login modules
cheers,
jesse
--
jesse mcconnell
jesse.mcconnell@xxxxxxxxx
On Tue, Jun 15, 2010 at 16:59, Chad La Joie <lajoie@xxxxxxxxx> wrote:
> Well, I've worked with LDAP directories in my job for the last 10 years or
> so and worked with quite a few other folks in similar positions in other
> companies.
>
> The general consesus that I've always heard and experienced is that the
> "right" way to do LDAP authentication is to bind, search for the user's DN
> using some particular filter, and then bind again as that DN with the user's
> password.
>
> Computing the user's DN from some pattern is considered bad because it makes
> the application tightly coupled to the DIT. Having the ability to pull back
> the user's password from the directory is horrible security flaw in whatever
> directory allows it.
>
> On 6/15/10 5:26 PM, Jesse McConnell wrote:
>>
>> i wonder about that setting from time to time...theory was that you
>> could authn via the binding approach or a simple 'get pwd and verify
>> against that'
>>
>> but I think the default use case for people seems to be binding approach
>>
>> glad you got it sorted out
>>
>> jesse
>>
>> --
>> jesse mcconnell
>> jesse.mcconnell@xxxxxxxxx
>>
>>
>>
>> On Tue, Jun 15, 2010 at 15:43, Loren Cahlander
>> <loren.cahlander@xxxxxxxxx> wrote:
>>>
>>> I found my problem. If I change forceBindingLogin to true in login.conf,
>>> then everything works.
>>>
>>> On Jun 14, 2010, at 10:25 AM, Loren Cahlander wrote:
>>>
>>>> Hello,
>>>>
>>>> I am trying to configure Jetty for LDAP authentication. Can someone
>>>> tell me what is wrong in my login.conf?
>>>>
>>>> Here is an authentication that works under the Apache 2.2 configuration:
>>>>
>>>> Alias /doc/ "/usr/share/doc/"
>>>> <Directory "/usr/share/doc/">
>>>> Options Indexes MultiViews FollowSymLinks
>>>> AllowOverride None
>>>> Order allow,deny
>>>> Allow from all
>>>> AuthBasicProvider ldap
>>>> AuthUserFile /dev/null
>>>> AuthType Basic
>>>> AuthName "Subversion Authentication"
>>>> AuthBasicProvider ldap
>>>> # The distinguished name to bind to the directory server
>>>> AuthLDAPBindDN "cn=admin,dc=exist-db,dc=org"
>>>>
>>>> # The password for the user above
>>>> AuthLDAPBindPassword "1234"
>>>> AuthLDAPUrl
>>>> "ldap://127.0.0.1:389/ou=Users,dc=exist-db,dc=org?uid?sub?(objectclass=posixAccount)"
>>>> AuthLDAPGroupAttribute memberUid
>>>> AuthLDAPGroupAttributeIsDN off
>>>> AuthLDAPCompareDNOnServer off
>>>> AuthzLDAPAuthoritative on
>>>> Require ldap-group cn=dba,ou=Groups,dc=exist-db,dc=org
>>>>
>>>> </Directory>
>>>>
>>>> Here is the Authentication Login Service information in jetty.xml:
>>>>
>>>> <!-- =========================================================== -->
>>>> <!-- Configure Authentication Login Service -->
>>>> <!-- =========================================================== -->
>>>> <Call class="java.lang.System" name="setProperty">
>>>> <Arg>java.security.auth.login.config</Arg>
>>>> <Arg><SystemProperty name="jetty.home" default="."
>>>> />/etc/login.conf</Arg>
>>>> </Call>
>>>>
>>>> <Call name="addBean">
>>>> <Arg>
>>>> <New class="org.eclipse.jetty.plus.jaas.JAASLoginService">
>>>> <Set name="name">JAASLoginService</Set>
>>>> <Set name="LoginModuleName">eXistDB</Set>
>>>> </New>
>>>> </Arg>
>>>> </Call>
>>>>
>>>>
>>>> My login.conf under Jetty is:
>>>>
>>>> eXistDB {
>>>> org.eclipse.jetty.plus.jaas.spi.LdapLoginModule REQUIRED
>>>> debug="true"
>>>> useLdaps="false"
>>>> contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
>>>> hostname="127.0.0.1"
>>>> port="389"
>>>> bindDn="cn=admin,dc=exist-db,dc=org"
>>>> bindPassword="1234"
>>>> authenticationMethod="simple"
>>>> forceBindingLogin="false"
>>>> userBaseDn="ou=Users,dc=exist-db,dc=org"
>>>> userRdnAttribute="uid"
>>>> userIdAttribute="uid"
>>>> userPasswordAttribute="userPassword"
>>>> userObjectClass="posixAccount"
>>>> roleBaseDn="ou=Groups,dc=exist-db,dc=org"
>>>> roleNameAttribute="cn"
>>>> roleMemberAttribute="memberUid"
>>>> roleObjectClass="posixGroup";
>>>> };
>>>>
>>>>
>>>> And I am getting the following error:
>>>>
>>>>
>>>> 14 Jun 2010 10:20:08,143 [qtp2133251039-20] INFO (Slf4jLog.java
>>>> [info]:92) - Searching for users with filter:
>>>> '(&(objectClass={0})({1}={2}))' from base dn: ou=Users,dc=exist-db,dc=org
>>>> 14 Jun 2010 10:20:08,145 [qtp2133251039-20] INFO (Slf4jLog.java
>>>> [info]:92) - Found user?: true
>>>> 14 Jun 2010 10:20:08,152 [qtp2133251039-20] WARN (Slf4jLog.java
>>>> [warn]:124) - EXCEPTION
>>>> javax.security.auth.login.LoginException: Login Failure: all modules
>>>> ignored
>>>> at
>>>> javax.security.auth.login.LoginContext.invoke(LoginContext.java:936)
>>>> at
>>>> javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)
>>>> at
>>>> javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)
>>>> at
>>>> javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)
>>>> at java.security.AccessController.doPrivileged(Native Method)
>>>> at
>>>> javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)
>>>> at
>>>> javax.security.auth.login.LoginContext.login(LoginContext.java:594)
>>>> at
>>>> org.eclipse.jetty.plus.jaas.JAASLoginService.login(JAASLoginService.java:203)
>>>> at
>>>> org.eclipse.jetty.security.authentication.FormAuthenticator.validateRequest(FormAuthenticator.java:174)
>>>> at
>>>> org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:417)
>>>> at
>>>> org.eclipse.jetty.server.session.SessionHandler.handle(SessionHandler.java:182)
>>>> at
>>>> org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:933)
>>>> at
>>>> org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:362)
>>>> at
>>>> org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:867)
>>>> at
>>>> org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:117)
>>>> at
>>>> org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)
>>>> at
>>>> org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:113)
>>>> at org.eclipse.jetty.server.Server.handle(Server.java:334)
>>>> at
>>>> org.eclipse.jetty.server.HttpConnection.handleRequest(HttpConnection.java:559)
>>>> at
>>>> org.eclipse.jetty.server.HttpConnection$RequestHandler.content(HttpConnection.java:1007)
>>>> at
>>>> org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:747)
>>>> at
>>>> org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:209)
>>>> at
>>>> org.eclipse.jetty.server.HttpConnection.handle(HttpConnection.java:406)
>>>> at
>>>> org.eclipse.jetty.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:462)
>>>> at
>>>> org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:436)
>>>> at java.lang.Thread.run(Thread.java:636)
>>>>
>>>
>>> _______________________________________________
>>> jetty-users mailing list
>>> jetty-users@xxxxxxxxxxx
>>> https://dev.eclipse.org/mailman/listinfo/jetty-users
>>>
>> _______________________________________________
>> jetty-users mailing list
>> jetty-users@xxxxxxxxxxx
>> https://dev.eclipse.org/mailman/listinfo/jetty-users
>>
>
> --
> Chad La Joie
> http://itumi.biz
> trusted identities, delivered
> _______________________________________________
> jetty-users mailing list
> jetty-users@xxxxxxxxxxx
> https://dev.eclipse.org/mailman/listinfo/jetty-users
>
