«
»

JAAS with active directory authentication in a web application

15.10.2007 09:23

This is a sample to use JAAS authentication with a windows active directory server. I use a Sun Java System Application Server, so the steps with other servers could be different.

Step 1: Defining LDAP realm

In this example you must define a LDAP realm named «ads-realm» with the following parameters:

Realm class:

com.sun.enterprise.security.auth.realm.ldap.LDAPReam

Properties:

directory            = ldap://ads.host.name:389
base-dn              = DC=ads,DC=domain,DC=com
search-bind-dn       = user
search-bind-password = password
search-filter        = (&(objectClass=user)(sAMAccountName=%s))
group-search-filter  = (&(objectClass=group)(member=%d))
jaas-context         = ldapRealm

You must change directory, base-dn, search-bind-dn and search-bind-password to your active directory configuration. The «search-bind-dn» and «search-bind-password» parameters are needed, because with default settings active directory doesn't allow anonymous users to browse the directory.

Step 2: Setting the following JVM Switch for refferals

The following JVM switch is needed with active directory LDAP servers:

-Djava.naming.referral=follow

Add this switch to your server startup script or with the admin console.

Step 3a: Basic authentication

Add the following section to your web.xml or go to Step 3b for form
based authentication.

<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>ads-realm</realm-name>
</login-config>

Step 3b: Form based authentication

Add the following section to your web.xml:

<login-config>
  <auth-method>FORM</auth-method>
  <realm-name>ads-realm</realm-name>
  <form-login-config>
    <form-login-page>/login.html</form-login-page>
    <form-error-page>/login.html</form-error-page>
  </form-login-config>
</login-config>

Create the page /login.html with a least the following code:

<html>
  <head/>
  <body>
    <form action="j_security_check" method="post">
      Username: <input type="text" name="j_username"><br/>
      Password: <input type="password" name="j_password"><br/>
      <input type="submit" value="Login"/>
    </form>
  </body>
</html>

Step 4: Adding security role to web.xml

Add at least one security role to your web.xml, in this example «userRole».

<security-role>
  <role-name>userRole</role-name>
</security-role>

Step 5: Adding security constraint to web.xml

Now we must create a security constraint and the path to the pages we want to allow only authenticated access. In this sample the access to the folder /pages/ is resticted to authenticated users in role «userRole».

<security-constraint>
  <display-name>SecurityConstraint</display-name>
  <web-resource-colletion>
    <web-resource-name>SecuredFolder</web-resource-name>
      <url-pattern>/pages/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>userRole</role-name>
    </auth-constraint>
  <user-data-constraint>
    <transport-guarantee>NONE</transport-guarantee>
  </user-data-constraint>
</security-constraint>

Step 6: Create role mapping between active directory group and role

Role mappings are defined in sun-web.xml for the Sun Java System Application Server, so add the following section:

<security-role-mapping>
  <role-name>userRole</role-name>
  <group-name>users</group-name>
</security-role-mapping>

This maps the active directory group «users» to our role «userRole»,
so only users in the group «users» can access our secured folder.

Tags: ,
Category: Java EE, NetBeans  |  Comment (RSS)  |  Trackback

5 Comments

  1. omasp:

    Good afternnoon Jaas,

    I would really appreciate if you can help me with follwoing:

    I am planning to design the intranet website for internal purpose ofcourse.

    Where user need to authenticate their username/passwd with W2K3 Active directory.

    If user is authenticated on ADs than this will redirected to Intranet site else

    “Incorrect username / passwd, Please re-enter”

    Thank you so much,

    Regards,
    Omasp

    03.01.2008, 07:24

  2. Felipe Campos Vega:

    group-search-filter = (&(objectClass=group)(member=%d)) —> get a stack trace when the LDAPRealm performs a “dynamic group search”.
    Glassfish issue 4769 – LDAPRealm (bound to ActiveDirectory) groupmembership error.

    Partial solution: Just search for a specific group (&(objectClass=group)(name=Guests)) in order to be logged in.

    12.02.2009, 17:06

  3. Johnny:

    Hey thanks for that info
    It has really proven to be helpful. I really enjoy reading easy articles leading straight to the point.

    Thanks allot.

    22.01.2010, 17:27

  4. c____g:

    Hi! thanks, that’s very helpfull
    I’ve got one more question about groups or rather OU in AD.
    Could anybody help me understand how to make a filter query to
    find particular – one – user from known OU [Organizational Unit] in AD ?
    I can’t make it to work. Is this supposed to be in group-search-filter, i’ve tried ‘memeberOf’ and some combinations i’ve found in google.
    Also as far as I understand sun-web.xml mapping defines which AD group will be permitted/authenticated. If I choose my OU, that means when I’ll find a user from different OU he won’t be authenticated – I would like that to work like this ;)

    05.07.2011, 13:36

  5. Raphael Tagliani:

    Hello,

    I think you should replace your filter by :

    (&(objectClass=user)(sAMAccountName=%s)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

    Otherwise, users with a disabled account in AD will be able to log in.

    10.11.2011, 22:47

Leave a comment