public class LdapLoginModule extends UsernamePasswordLoginModule
The LoginModule options include whatever options your LDAP JNDI provider supports. Examples of standard property names are:
Context.INITIAL_CONTEXT_FACTORY = "java.naming.factory.initial"
Context.SECURITY_PROTOCOL = "java.naming.security.protocol"
Context.PROVIDER_URL = "java.naming.provider.url"
Context.SECURITY_AUTHENTICATION = "java.naming.security.authentication"
The Context.SECURITY_PRINCIPAL is set to the distinguished name of the user as obtained by the callback handler and the Context.SECURITY_CREDENTIALS property is either set to the String password or Object credential depending on the useObjectCredential option.
Additional module properties include:
String userDN = principalDNPrefix + username + principalDNSuffix;
org.jboss.security.plugins.ObjectCallback
type
of Callback rather than as a char[] password using a JAAS PasswordCallback.
testLdap { org.jboss.security.auth.spi.LdapLoginModule required java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory java.naming.provider.url="ldap://ldaphost.jboss.org:1389/" java.naming.security.authentication=simple principalDNPrefix=uid= uidAttributeID=userid roleAttributeID=roleName principalDNSuffix=,ou=People,o=jboss.org rolesCtxDN=cn=JBossSX Tests,ou=Roles,o=jboss.org }; testLdap2 { org.jboss.security.auth.spi.LdapLoginModule required java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory java.naming.provider.url="ldap://ldaphost.jboss.org:1389/" java.naming.security.authentication=simple principalDNPrefix=uid= uidAttributeID=userid roleAttributeID=roleName principalDNSuffix=,ou=People,o=jboss.org userRolesCtxDNAttributeName=ou=Roles,dc=user1,dc=com }; testLdapToActiveDirectory { org.jboss.security.auth.spi.LdapLoginModule required java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory java.naming.provider.url="ldap://ldaphost.jboss.org:1389/" java.naming.security.authentication=simple rolesCtxDN=cn=Users,dc=ldaphost,dc=jboss,dc=org uidAttributeID=userPrincipalName roleAttributeID=memberOf roleAttributeIsDN=true roleNameAttributeID=name };
callbackHandler, log, loginOk, options, principalClassName, sharedState, subject, trace, unauthenticatedIdentity, useFirstPass
Constructor and Description |
---|
LdapLoginModule() |
Modifier and Type | Method and Description |
---|---|
protected Group[] |
getRoleSets()
Overridden by subclasses to return the Groups that correspond to the
to the role sets assigned to the user.
|
protected String |
getUsersPassword()
Overridden to return an empty password string as typically one cannot
obtain a user's password.
|
protected boolean |
validatePassword(String inputPassword,
String expectedPassword)
Validate the inputPassword by creating a ldap InitialContext with the
SECURITY_CREDENTIALS set to the password.
|
createPasswordHash, getCredentials, getIdentity, getUnauthenticatedIdentity, getUsername, getUsernameAndPassword, getValidateError, initialize, login, setValidateError
abort, commit, createGroup, createIdentity, getCallerPrincipalGroup, getUseFirstPass, logout
protected String getUsersPassword() throws LoginException
getUsersPassword
in class UsernamePasswordLoginModule
LoginException
protected Group[] getRoleSets() throws LoginException
getRoleSets
in class AbstractServerLoginModule
LoginException
protected boolean validatePassword(String inputPassword, String expectedPassword)
validatePassword
in class UsernamePasswordLoginModule
inputPassword
- the password to validate.expectedPassword
- ignoredCopyright © 2013 JBoss Inc.. All Rights Reserved.