Page History

...

We refere in this document to a public LDAP server. To configure a realm for accessing the public LDAP server please add add the following lines to the [main] section.

publicLdapRealm = com.sos.auth.shiro.SOSLdapAuthorizingRealm
publicLdapRealm.userDnTemplate = uid={0},dc=example,dc=com
publicLdapRealm.searchBase = dc=example,dc=com
publicLdapRealm.contextFactory.url = ldap://ldap.forumsys.com:389
publicLdapRealm.groupNameAttribute = ou
publicLdapRealm.userNameAttribute = uid
publicLdapRealm.userSearchFilter = (uniqueMember=uid=%s,dc=example,dc=com)
publicLdapRealm.groupRolesMap = \
  scientists : it_operator, \
  mathematics: all

Verification with ldapSearch

In all ldapSearch examples the option -x is used. It is possible that your LDAP Server does not allow this and you have to specify a user and a password like:

ldapsearch -h ldap.forumsys.com -p 389 -b "uid=gauss,dc=example,dc=com" -W -D "uid=gauss,dc=example,dc=com"

There are some configuration items that configure the ldap realm that should be used. These items can not be changed with the Account Management in JOC.

...

• username@domain
• domain\username
• username

Username The username may have blanks if they are stored in a LDAP directory. Usernames stored in the configuration file shiro.ini may not have blanks.

...

Configuration in the configuration file shiro.ini

Main section with user authentication. The roles are assigned in the [users] section.

[main]
ldapRealm = com.sos.auth.shiro.SOSLdapAuthorizingRealm
ldapRealm.userDnTemplate = uid={0},ou=People, dc=sos
ldapRealm.contextFactory.url = ldap://centos6_9_ldap.sos:389 
rolePermissionResolver = com.sos.auth.shiro.SOSPermissionResolverAdapter
rolePermissionResolver.ini = $iniRealm
ldapRealm.rolePermissionResolver = $rolePermissionResolver
securityManager.realms = $ldapRealm
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager
securityManager.sessionManager.globalSessionTimeout = 900000

Examples for the userDnTemplate: 

• Example
  • ldapRealm.userDnTemplate = uid={0},ou=People, dc=sos


• Configuration with public LDAP Server

• • publicLdapRealm.userDnTemplate = uid={0},dc=example,dc=com



• Configuration with a Microsoft AD

• • adLdapRealm.userDnTemplate = sAMAccountName={0},dc=company,dc=com


• Try this at first. 

• • ldapRealm.userDnTemplate = {}

Verification with ldapSearch

...

ldapSearch

...

ldapsearch -h ldap.forumsys.com -p 389 -b "uid=gauss,dc=example,dc=com" -W -D "uid=gauss,dc=example,dc=com"

...

You can check you userDnTemplate with this ldapSearchCommand. 

...

Code Block
title Result: ldapsearch -h localhost -p 389 -b "uid=ur,ou=People, dc=sos" -x collapse true
# ur, People, sos dn: uid=ur,ou=People,dc=sos mail: uwe.risse@sos-berlin.com uid: ur givenName: Uwe objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson sn: Risse cn: Uwe Risse preferredLanguage: de # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

Example with the public server

ldapsearch -h ldap.forumsys.com -p 389 -b "uid=gauss,dc=example,dc=com" -x

Code Block
title ldapsearch -h ldap.forumsys.com -p 389 -b "uid=gauss,dc=example,dc=com" -x collapse true
# extended LDIF # # LDAPv3 # base <uid=gauss,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # gauss, example.com dn: uid=gauss,dc=example,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top cn: Carl Friedrich Gauss sn: Gauss uid: gauss mail: gauss@ldap.forumsys.com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

 

Verification mit Softerra LDAP Browser

Search from root with the userDnTemplate as the user search filter. You should find exactly one entry.

...