Hi,
I'm trying to change the authentication mode of
my application from JDBC-REALM to JNDI-REALM.
I configured the following section inside the Server.xml
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99" connectionURL="ldap://****:389/DC=onsetinc,DC=com??sAMccountName?sub?(objectClass=*)" connectionName="
[email protected]" connectionPassword="password" userBase="CN=Users" referrals="follow" userSearch="(sAMAccountName={0})" userSubtree="true" roleBase="CN=Users" roleName="name" roleSubtree="true" roleSearch="(member={1})"/>
I have also configured the web.xml under
my appfolder to contain the following:
<security-role>
<role-name>Admin</role-name>
</security-role>
<security-role>
<role-name>WaterlooUsers</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>Tube</web-resource-name>
<url-pattern>/ComposeMessage.jsp</url-pattern>
<url-pattern>/PageStatus.jsp</url-pattern>
<url-pattern>/UserStatus.jsp</url-pattern>
<url-pattern>/SearchEC.jsp</url-pattern>
<url-pattern>/SearchEC2.jsp</url-pattern>
<url-pattern>/SearchMessageStatisticsEC.jsp</url-pattern>
<url-pattern>/SearchMessageStatus.jsp</url-pattern>
<url-pattern>/SearchMessageStatisticsPager.jsp</url-pattern>
<url-pattern>/SearchPageStatus.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>WaterlooUsers</role-name>
</auth-constraint>
</security-constraint>
In
my Active directory i have created a new group called WaterlooUsers
It's distinguish name is :
distinguishedName: CN=WaterlooUsers,CN=Users,DC=onsetinc,DC=com
It has a property member which contains the following user:
member: CN=Itay Levin,CN=Users,DC=onsetinc,DC=com (which is
my user)
My record on the active directory looks like that:
sAMAccountName: itayL
distinguishedName: CN=Itay Levin,CN=Users,DC=onsetinc,DC=com
memberOf: CN=WaterlooUsers,CN=Users,DC=onsetinc,DC=com
and when i get the popup for user/password i enter the username "ItayL" in the authentication message box (and
my password)
I have 2 questions:
How do i configure correctly the roles parameters correctly in the Realm section in the server.xml to enable me to both authenticate and authorize both this group of users WaterlooUsers and also assign them to the appropriate role so that they can see all the relevant pages in
my website. - currently it seems that all the Users in
my domain are authenticated to the site but get the http-403 Error and can't access any of the pages in the site.
I also want to be able to create 2 different set of roles in
my site - which can both have access to the same pages - but will see different things on the page. (for instance adding some administrative ability to the admin)
Hope it was clear enough and not too long.
Thanks in advance,
Itay
