Skip to content

Commit 7a69146

Browse files
maximthomasmaximthomas
authored
Add binding for LDAP & AD authentication (#722)
1 parent 6b0d340 commit 7a69146

File tree

7 files changed

+132
-35
lines changed

7 files changed

+132
-35
lines changed

‎openam-authentication/openam-auth-ad/src/main/java/com/sun/identity/authentication/modules/ad/AD.java

+5
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
*
2525
* $Id: AD.java,v 1.3 2008/06/25 05:41:55 qcheng Exp $
2626
*
27+
* Portions Copyrighted 2024 3A Systems LLC
2728
*/
2829

2930

@@ -77,6 +78,10 @@ public boolean initializeLDAP() throws AuthLoginException{
7778
}
7879

7980
ldapUtil.setAD(true);
81+
82+
String bindingUserDomain = CollectionHelper.getMapAttr(currentConfig, "openam-binding-user-domain");
83+
ldapUtil.setBindingUserDomain(bindingUserDomain);
84+
8085
return returnValue;
8186
}
8287
}

‎openam-authentication/openam-auth-ad/src/main/resources/amAuthAD.properties

+5-1
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
#
2828
# Portions Copyrighted 2011-2016 ForgeRock AS.
2929
# Portions Copyrighted 2012 Open Source Solution Technology Corporation
30+
# Portions Copyrighted 2024 3A Systems LLC
3031

3132
onlinehelp.doc=adauth.html
3233
authentication=Authentication Modules
@@ -68,6 +69,8 @@ server. A single entry must be in the format:<br/><br/><code>server:port</code><
6869
Multiple entries allow associations between OpenAM servers and an Active Directory server. \
6970
The format is:<br/><br/><code>local server name | server:port</code><br/><br/>\
7071
<i>NB </i>The local server name is the full name of the server from the list of servers and sites.
72+
a1021=Users Domain
73+
a1021.help=If set appended to a username via `@` symbol for authentication
7174
a103=DN to Start User Search
7275
a103.help=The search for accounts to be authenticated start from this base DN
7376
a103.help.txt=For a single server just enter the Base DN to be searched. Multiple OpenAM servers can have different base DNs for the search \
@@ -76,7 +79,8 @@ The format is as follows:<br/><br/><code>local server name | search DN</code><br
7679
a104=Bind User DN
7780
a104.help=The DN of an admin user used by the module to authentication to the LDAP server
7881
a104.help.txt=The LDAP module requires an administration account in order to perform functionality such as password reset.<br/><br/>\
79-
<i>NB </i><code>cn=Directory Manager</code> should not be used in production systems.
82+
<i>NB </i><code>cn=Directory Manager</code> should not be used in production systems.<br/><br/>\
83+
If empty, using LDAP bind request for authentication.
8084
a104.help.uri=#tbd
8185
a105=Bind User Password
8286
a105.help=The password of the administration account.

‎openam-authentication/openam-auth-ad/src/main/resources/amAuthAD.xml

+26-11
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
$Id: amAuthAD.xml,v 1.5 2008/06/25 05:45:41 qcheng Exp $
2828
2929
Portions Copyrighted 2013-2016 ForgeRock AS.
30+
Portions Copyrighted 2024 3A Systems LLC
3031
-->
3132

3233
<!DOCTYPE ServicesConfiguration
@@ -38,7 +39,7 @@
3839
<Schema
3940
serviceHierarchy="/DSAMEConfig/authentication/sunAMAuthADService"
4041
i18nFileName="amAuthAD"
41-
revisionNumber="30"
42+
revisionNumber="31"
4243
i18nKey="sunAMAuthADServiceDescription"
4344
resourceName="activedirectory">
4445

@@ -60,24 +61,31 @@
6061
order="200"
6162
resourceName="secondaryLdapServer">
6263
</AttributeSchema>
64+
<AttributeSchema name="openam-binding-user-domain"
65+
type="single"
66+
syntax="string"
67+
i18nKey="a1021"
68+
order="210"
69+
resourceName="userDomain">
70+
</AttributeSchema>
6371
<AttributeSchema name="iplanet-am-auth-ldap-base-dn"
6472
type="list"
6573
syntax="dn"
6674
i18nKey="a103"
6775
order="300"
68-
resourceName="userSearchStartDN">
76+
resourceName="userSearchStartDN">
6977
<DefaultValues>
7078
<Value>@UM_NORMALIZED_ORGBASE@</Value>
7179
</DefaultValues>
7280
</AttributeSchema>
7381
<AttributeSchema name="iplanet-am-auth-ldap-bind-dn"
7482
type="single"
75-
syntax="dn"
83+
syntax="string"
7684
i18nKey="a104"
7785
order="400"
7886
resourceName="userBindDN">
7987
<DefaultValues>
80-
<Value>@UM_DS_DIRMGRDN@</Value>
88+
<Value></Value>
8189
</DefaultValues>
8290
</AttributeSchema>
8391
<AttributeSchema name="iplanet-am-auth-ldap-bind-passwd"
@@ -94,7 +102,7 @@
94102
order="600"
95103
resourceName="userProfileRetrievalAttribute">
96104
<DefaultValues>
97-
<Value>@USER_NAMING_ATTR@</Value>
105+
<Value>sAMAccountName</Value>
98106
</DefaultValues>
99107
</AttributeSchema>
100108
<AttributeSchema name="iplanet-am-auth-ldap-user-search-attributes"
@@ -104,7 +112,7 @@
104112
order="700"
105113
resourceName="userSearchAttributes">
106114
<DefaultValues>
107-
<Value>@USER_NAMING_ATTR@</Value>
115+
<Value>sAMAccountName</Value>
108116
</DefaultValues>
109117
</AttributeSchema>
110118
<AttributeSchema name="iplanet-am-auth-ldap-search-filter"
@@ -249,7 +257,7 @@
249257
order="100"
250258
resourceName="primaryLdapServer">
251259
<DefaultValues>
252-
<Value>@UM_DIRECTORY_SERVER@:@UM_DIRECTORY_PORT@</Value>
260+
<Value></Value>
253261
</DefaultValues>
254262
</AttributeSchema>
255263
<AttributeSchema name="iplanet-am-auth-ldap-server2"
@@ -259,6 +267,13 @@
259267
order="200"
260268
resourceName="secondaryLdapServer">
261269
</AttributeSchema>
270+
<AttributeSchema name="openam-binding-user-domain"
271+
type="single"
272+
syntax="string"
273+
i18nKey="a1021"
274+
order="210"
275+
resourceName="userDomain">
276+
</AttributeSchema>
262277
<AttributeSchema name="iplanet-am-auth-ldap-base-dn"
263278
type="list"
264279
syntax="dn"
@@ -271,12 +286,12 @@
271286
</AttributeSchema>
272287
<AttributeSchema name="iplanet-am-auth-ldap-bind-dn"
273288
type="single"
274-
syntax="dn"
289+
syntax="string"
275290
i18nKey="a104"
276291
order="400"
277292
resourceName="userBindDN">
278293
<DefaultValues>
279-
<Value>@UM_DS_DIRMGRDN@</Value>
294+
<Value></Value>
280295
</DefaultValues>
281296
</AttributeSchema>
282297
<AttributeSchema name="iplanet-am-auth-ldap-bind-passwd"
@@ -293,7 +308,7 @@
293308
order="600"
294309
resourceName="userProfileRetrievalAttribute">
295310
<DefaultValues>
296-
<Value>@USER_NAMING_ATTR@</Value>
311+
<Value>sAMAccountName</Value>
297312
</DefaultValues>
298313
</AttributeSchema>
299314
<AttributeSchema name="iplanet-am-auth-ldap-user-search-attributes"
@@ -303,7 +318,7 @@
303318
order="700"
304319
resourceName="userSearchAttributes">
305320
<DefaultValues>
306-
<Value>@USER_NAMING_ATTR@</Value>
321+
<Value>sAMAccountName</Value>
307322
</DefaultValues>
308323
</AttributeSchema>
309324
<AttributeSchema name="iplanet-am-auth-ldap-search-filter"

‎openam-authentication/openam-auth-ldap/src/main/java/com/sun/identity/authentication/modules/ldap/LDAP.java

+16-7
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
*
2727
* Portions Copyrighted 2010-2016 ForgeRock AS.
2828
* Portions Copyrighted 2019 Open Source Solution Technology Corporation
29+
* Portions Copyrighted 2024 3A Systems LLC
2930
*/
3031

3132
package com.sun.identity.authentication.modules.ldap;
@@ -56,6 +57,7 @@
5657
import javax.security.auth.callback.NameCallback;
5758
import javax.security.auth.callback.PasswordCallback;
5859

60+
import org.apache.commons.lang.StringUtils;
5961
import org.forgerock.openam.ldap.LDAPAuthUtils;
6062
import org.forgerock.openam.ldap.LDAPUtilException;
6163
import org.forgerock.openam.ldap.ModuleState;
@@ -86,6 +88,8 @@ public class LDAP extends AMLoginModule {
8688
private String regEx;
8789
private String currentConfigName;
8890
private String bindDN;
91+
92+
private Boolean useBindingForAuth = false;
8993
private String protocolVersion;
9094
private int currentState;
9195
protected LDAPAuthUtils ldapUtil;
@@ -113,7 +117,7 @@ enum LoginScreen {
113117
ACCOUNT_LOCKED(5, "accountLocked");
114118

115119
private static final Map<Integer,LoginScreen> lookup =
116-
new HashMap<Integer,LoginScreen>();
120+
new HashMap<>();
117121

118122
static {
119123
for(LoginScreen ls : EnumSet.allOf(LoginScreen.class)) {
@@ -180,9 +184,6 @@ public boolean initializeLDAP() throws AuthLoginException {
180184

181185
String baseDN = CollectionHelper.getServerMapAttr(
182186
currentConfig, "iplanet-am-auth-ldap-base-dn");
183-
if (baseDN == null) {
184-
debug.error("BaseDN for search was null");
185-
}
186187

187188
String pLen = CollectionHelper.getMapAttr(currentConfig,
188189
"iplanet-am-auth-ldap-min-password-length");
@@ -193,8 +194,14 @@ public boolean initializeLDAP() throws AuthLoginException {
193194
debug.error("LDAP.initializeLDAP : " + pLen, ex);
194195
}
195196
}
196-
bindDN = CollectionHelper.getMapAttr(currentConfig,
197-
"iplanet-am-auth-ldap-bind-dn", "");
197+
198+
bindDN = CollectionHelper.getMapAttr(currentConfig, "iplanet-am-auth-ldap-bind-dn", "");
199+
200+
useBindingForAuth = StringUtils.isEmpty(bindDN);
201+
if (baseDN == null && !useBindingForAuth) {
202+
debug.error("BaseDN for search was null");
203+
}
204+
198205
char[] bindPassword = CollectionHelper.getMapAttr(
199206
currentConfig, "iplanet-am-auth-ldap-bind-passwd", "").toCharArray();
200207
String userNamingAttr = CollectionHelper.getMapAttr(
@@ -255,7 +262,7 @@ public boolean initializeLDAP() throws AuthLoginException {
255262

256263
isProfileCreationEnabled = isDynamicProfileCreationEnabled();
257264
// set the optional attributes here
258-
ldapUtil = new LDAPAuthUtils(primaryServers, secondaryServers, isSecure, bundle, baseDN, debug);
265+
ldapUtil = new LDAPAuthUtils(primaryServers, secondaryServers, isSecure, bundle, baseDN, useBindingForAuth, debug);
259266
ldapUtil.setScope(searchScope);
260267
ldapUtil.setFilter(searchFilter);
261268
ldapUtil.setUserNamingAttribute(userNamingAttr);
@@ -273,9 +280,11 @@ public boolean initializeLDAP() throws AuthLoginException {
273280
ldapUtil.setHeartBeatTimeUnit(heartBeatTimeUnit);
274281
ldapUtil.setOperationTimeout(operationTimeout);
275282
ldapUtil.setProtocolVersion(protocolVersion);
283+
ldapUtil.setUseBindingForAuth(useBindingForAuth);
276284

277285
if (debug.messageEnabled()) {
278286
debug.message("bindDN-> " + bindDN
287+
+ "\nuseBindingForAuth-> " + useBindingForAuth
279288
+ "\nrequiredPasswordLength-> " + requiredPasswordLength
280289
+ "\nbaseDN-> " + baseDN
281290
+ "\nuserNamingAttr-> " + userNamingAttr

‎openam-authentication/openam-auth-ldap/src/main/resources/amAuthLDAP.properties

+1
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
#
2727
# Portions Copyrighted 2011-2016 ForgeRock AS.
2828
# Portions Copyrighted 2012-2019 Open Source Solution Technology Corporation
29+
# Portions Copyrighted 2024 3A Systems LLC
2930

3031
onlinehelp.doc=ldapauth.html
3132
authentication=Authentication Modules

‎openam-authentication/openam-auth-ldap/src/main/resources/amAuthLDAP.xml

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
2929
Portions Copyrighted 2011-2016 ForgeRock AS.
3030
Portions Copyrighted 2019 Open Source Solution Technology Corporation
31+
Portions Copyrighted 2024 3A Systems LLC
3132
-->
3233

3334
<!DOCTYPE ServicesConfiguration

0 commit comments

Comments
 (0)