Chapter 19. Using LdapExtLoginModule with JaasSecurityDomain
This chapter provides guidance on how the LdapExtLoginModule can be used with an encrypted password to be decrypted by a JaasSecurityDomain. This chapter assumes that the LdapExtLoginModule is already running correctly with a non-encrypted password. For more information about LdapExtLoginModule, refer to Section 12.1.2, “LdapExtLoginModule”
Procedure 19.1.
Define JaasSecurityDomain MBean
Define the JaasSecurityDomain MBean used to decrypt the encrypted version of the password. You can add the MBean toJBOSS_HOME/server/PROFILE/conf/jboss-service.xml
, or to a *-service.xml
deployment descriptor in theJBOSS_HOME/server/
folder.PROFILE
/deploy<mbean code="org.jboss.security.plugins.JaasSecurityDomain" name="jboss.security:service=JaasSecurityDomain,domain=jmx-console"> <constructor> <arg type="java.lang.String" value="jmx-console"></arg> </constructor> <attribute name="KeyStorePass">some_password</attribute> <attribute name="Salt">abcdefgh</attribute> <attribute name="IterationCount">66</attribute> </mbean>
Note
The default cipher algorithm used by the JaasSecurityDomain implementation isPBEwithMD5andDES
. Other cipher algorithms includeDES
,TripleDES
,Blowfish
, andPBEWithMD5AndTripleDES
. All algorithms are symmetric algorithms. You specify a cipher algorithm by appending an <attribute> element with theCypherElement
attribute set to one of these values.Adjust password, salt, and iteration count
Step One contains a simple configuration where the required password, Salt, and Iteration Count used for the encryption or decryption are contained within the MBean definition.Ensure you change the KeyStorePass, Salt, and IterationCount values suitable for your own deployment.Start the platform
Start the server after configuring the MBean, password, salt, and iteration counts. Ensure you start the platform by specifying the server profile containing the configuration.[bin]$ ./run.sh -c PROFILE
Open the JMX Console
Navigate to the JMX Console (http://localhost:8080/jmx-console/ by default) and select theorg.jboss.security.plugins.JaasSecurityDomain
MBean.Invoke the LdapExtLoginModule
- On the
org.jboss.security.plugins.JaasSecurityDomain
page, find theencode64(String password)
method. - Pass the plain text version of the
password
the LdapExtLoginModule will use to this method. - Invoke the
encode64(String password)
method. - The return value is the encrypted version of the password encoded as Base64.
Configure Login Module
Within the login module configuration, the following module-options should be set:<module-option name="jaasSecurityDomain">jboss.security:service=JaasSecurityDomain,domain=jmx-console</module-option> <module-option name="bindCredential">2gx7gcAxcDuaHaJMgO5AVo</module-option>
The first option specifies the JaasSecurityDomain configured in Step 1 is used to decrypt the password.ThebindCredential
is replaced with the encrypted Base64 password obtained in Step 5.