1

"How to use LDAP for authentication in Tomcat with Custom Authorization"

"LDAP authentication via web.xml in Tomcat"

"LDAP Authentication Requirements and How to do it"

I seem to not be the only one struggling with this issue. With the current configuration, I can authenticate with my LDAP users and not with system or tomcat users. The problem is that whenever I'm logged in, I'm denied access to the files I should see.

I currently have a web.xml with the following info

<security-constraint>
<web-resource-collection>
<web-resource-name>Nrt</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Home</realm-name>
</login-config>

and a server.xml with the following content

<Realm className="org.apache.catalina.realm.JNDIRealm"
             connectionURL="ldap://192.168.75.146:389"
             userPattern="uid={0},ou=people,dc=localhost,dc=localdomain"
             roleBase="cn=admin,ou=group,dc=localhost,dc=localdomain"
             roleName="cn"
             roleSearch="memberUid={1}"
             debug="99"/>

I have tried to find documentation around the net, but I'm simply stuck. So far, I've managed to access it without LDAP users, or log in with LDAP users and not access the files.

Any help would be greatly appreciated.

Community
  • 1
  • 1
Mark Jenster
  • 503
  • 3
  • 6
  • 18

1 Answers1

3

If I understand it correctly, you can authenticate via LDAP but the authorization piece is not working as expected. Based on the information you have provided, you are missing the mapping between your roles and your groups. You can find the instructions here

souser
  • 5,868
  • 5
  • 35
  • 50
  • So, as I understand it, a further download of an application manager is needed, and then configured to link roles to users? I appreciate any input, but I'd prefer to be able to create this from only LDAP and Tomcat if possible, without downloading unnecessary packages and managers. – Mark Jenster Apr 18 '12 at 09:09
  • The mapping needs to take place in web.xml ; check the "Mapping Roles to Users and Groups" section in the link. – souser Apr 18 '12 at 14:33