[[Mathias Chauvin]] - IT stuff

Using Tomcat6 (Tomcat 6.0.13 to be precise ) on CentOS 4.5, a LDAP authentication can be set up using the JNDI Realm.

1/ Tomcat server configuration

Edit the $CATALINA_HOME/conf/server.xml configuration file and modify the <Realm /> tag to match the following:

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
       connectionName="uid=bindingproxyname,ou=profile,dc=domain,dc=com"
       connectionPassword="bindingproxypasswd"
       connectionURL="ldap://ldap.domain.com:389"
       userPattern="uid={0},ou=people,dc=domain,dc=com"
       roleBase="ou=group,dc=domain,dc=com"
       roleName="cn"
       roleSearch="memberUid={1}"
/>

The connectionName and connectionPassword are optionals. They stand for the binding credentials to access the LDAP.

The connectionURL is the URL to access the LDAP server.

The userPattern describes where users are stored in the LDAP.

The roleBase describes where roles (in my case, LDAP groups) are stored.
The roleName is the name of the attribute that contains the name of the role (group).

The roleSearch defines the LDAP filter to verify for searching roles.
In this case, members of a group are defined by the memberUid attribute in each group cn. So to get the list of roles a user belongs to, the filter must get only roles which has the user defined as a member (memberUid=username).

2/ Tomcat application configuration

But… that was only the first part of authentication.

...

Now, if you want to secure a tomcat application, asking your users to authenticate, you’ll also have to modify the $CATALINA_HOME/webapps/yourapplication/WEB-INF/web.xml file of your application. I have added the following to the file:

   
<security-constraint>
   <display-name>Security Constraint</display-name>
   <web-resource-collection>
      <web-resource-name>Protected Area</web-resource-name>
      <!-- Define the context-relative URL(s) to be protected -->
      <url-pattern>/*</url-pattern>
      <!-- If you list http methods, only those methods are protected -->
   </web-resource-collection>
   <auth-constraint>
      <!-- Anyone with one of the listed roles may access this area -->
      <role-name>source</role-name>
   </auth-constraint>
</security-constraint>

<!-- Default login configuration uses form-based authentication -->
<login-config>
   <auth-method>FORM</auth-method>
   <realm-name>Form-Based Authentication Area</realm-name>
   <form-login-config>
     <form-login-page>/security/protected/index.jsp</form-login-page>
     <form-error-page>/security/protected/error.jsp</form-error-page>
   </form-login-config>
</login-config>

<!-- Security roles referenced by this web application -->
<security-role>
   <role-name>source</role-name>
</security-role>

This means that any page of the yourapplication application requires to be authenticated to be displayed.
The authentication is done using the /security/protected/index.jsp
Moreover, people need to be member of the source role (in my case, in the source ldap group) to be granted the access.

The /security/protected/index.jsp file contains the following html form:

<form method="POST" action='<%= response.encodeURL("j_security_check") %>' >
  <table cellpadding="2" border="0" cellspacing="0">
    <tr>
      <td align="right">Username:</td>
      <td align="left"><input type="text" name="j_username" size="9"></td>
    </tr>
    <tr>
      <td align="right">Password:</td>
      <td align="left"><input type="password" name="j_password" size="9"></td>
    </tr>
    <tr>
      <td align="right"><input type="submit" value="Log In"></td>
      <td align="left"><input type="reset"></td>
    </tr>
  </table>
</form>

This should be enough!!! Enjoy it!