Chapter 8. LDAP Authentication Tutorial

On Red Hat Enterprise Linux and Fedora platforms, use the standard dnf package management utility to install 389 Directory Server. Enter the following command at a command prompt (you must have administrator privileges on your machine):

sudo dnf install 389-ds

After installing the 389 directory server packages, enter the following command to configure the directory server:

sudo setup-ds-admin.pl

The script is interactive and prompts you to provide the basic configuration settings for the 389 directory server. When the script is complete, it automatically launches the 389 directory server in the background.

Enter the following command to start up the 389 Management Console:

389-console

A login dialog appears. Fill in the LDAP login credentials in the User ID and Password fields, and customize the hostname in the Administration URL field to connect to your 389 management server instance (port 9830 is the default port for the 389 management server instance).

In the left-hand pane, drill down to the Directory Server icon.

Expand the root node, YourDomain (usually named after a hostname, and shown as localdomain in the following screenshot), to view the DIT.

In the Directory Server Console, click on the Directory tab, and drill down to the People node, under the YourDomain node (where YourDomain is shown as localdomain in the following screenshots).

Fill in the fields of the User tab, as follows:

Add a user Jane Doe by following Step 3 to Step 6.

In Step 5.e, use janedoe for the new user’s User ID and use the password, secret, for the password fields.

Add a user Camel Rider by following Step 3 to Step 6.

In Step 5.e, use crider for the new user’s User ID and use the password, secret, for the password fields.

Fill in the fields of the General tab, as follows:

Select the Members tab in the left-hand pane of the Create New Group dialog.

In the Search field, select Users from the drop-down menu, and click the Search button.

Add a manager role by following Step 2 to Step 10.

In Step 4, enter manager in the Group Name field.

In Step 8, select Jane Doe.

Add a viewer role by following Step 2 to Step 10.

In Step 4, enter viewer in the Group Name field.

In Step 8, select Camel Rider.

Add an ssh role by following Step 2 to Step 10.

In Step 4, enter ssh in the Group Name field.

In Step 8, select all of the users, John Doe, Jane Doe, and Camel Rider.

Start the Karaf container by entering the following command in a terminal window:

./bin/fuse

Copy Example 8.1, “JAAS Realm for Standalone” into ldap-module.xml.

<?xml version="2.0" encoding="UTF-8"?>
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
  xmlns:jaas="http://karaf.apache.org/xmlns/jaas/v1.0.0"
  xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.0.0">

  <jaas:config name="karaf" rank="200">
    <jaas:module className="org.apache.karaf.jaas.modules.ldap.LDAPLoginModule"
                 flags="required">
      initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory
      connection.url=ldap://localhost:389
      connection.username=cn=Directory Manager
      connection.password=DIRECTORY_MANAGER_PASSWORD
      connection.protocol=
      user.base.dn=ou=People,dc=localdomain
      user.filter=(&amp;(objectClass=inetOrgPerson)(uid=%u))
      user.search.subtree=true
      role.base.dn=ou=Groups,dc=localdomain
      role.name.attribute=cn
      role.filter=(uniquemember=%fqdn)
      role.search.subtree=true
      authentication=simple
    </jaas:module>
  </jaas:config>
</blueprint>

You must customize the following settings in the ldap-module.xml file:

To deploy the new LDAP module, copy the ldap-module.xml into the Karaf container’s deploy/ directory (hot deploy).

The LDAP module is automatically activated.

Enter the following command to log on to the running container instance using the identity jdoe:

./client -u jdoe -p secret

You should successfully log into the container’s remote console. At the command console, type jaas: followed by the [Tab] key (to activate content completion):

jdoe@root()> jaas:
Display all 31 possibilities? (31 lines)?
jaas:cancel
jaas:group-add
...
jaas:whoami

You should see that jdoe has access to all of the jaas commands (consistent with the admin role).

Enter the following command to log on to the running container instance using the identity janedoe:

./client -u janedoe -p secret

You should successfully log into the container’s remote console. At the command console, type jaas: followed by the [Tab] key (to activate content completion):

janedoe@root()> jaas:
Display all 25 possibilities? (25 lines)?
jaas:cancel
jaas:group-add
...
jaas:users

You should see that janedoe has access to almost all of the jaas commands (consistent with the manager role).

Enter the following command to log on to the running container instance using the identity crider:

./client -u crider -p secret

You should successfully log into the container’s remote console. At the command console, type jaas: followed by the [Tab] key (to activate content completion):

crider@root()> jaas:
jaas:manage
jaas:realm-list
jaas:realm-manage
jaas:realms
jaas:user-list
jaas:users

You should see that crider has access to only five of the jaas commands (consistent with the viewer role).

From the Karaf console, enter the following command to increase the logging level to DEBUG:

log:set DEBUG

Observe the Karaf log in real time:

log:tail

To escape from the log listing, type Ctrl-C.