[jboss-jira] [JBoss JIRA] Reopened: (JBAS-2681) Add real support for password-stacking (useFirstPass) in LDAPExtLoginModule

[ https://jira.jboss.org/jira/browse/JBAS-2681?page=com.atlassian.jira.plug... ] Andrew Oliver reopened JBAS-2681: --------------------------------- Assignee: Andrew Oliver There were configs of LdapExtLoginModule that didn't require binding in stacking. Attached is a patch that restores that and adds other features useful for using client certificates with Active directory (oddly Microsoft's certificates have DNs that don't match AD). <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="optional" > <module-option name="java.naming.provider.url">ldap://REDACTED-servername:389</module-option> <module-option name="java.naming.security.authentication">simple</module-option> <module-option name="bindDN">CN=REACTED-username,OU=Standard,OU=Users,OU=Corporate,DC=REDACTED-company,DC=REDACTED-sub,DC=com</module-option> <module-option name="bindCredential">REDACTED-password</module-option> <module-option name="removePrincipalElements">EMAILADDRESS</module-option> <module-option name="rolesCtxDN">OU=REDACTED-base,OU=Standard,OU=Groups,OU=Corporate,DC=REDACTED-company,DC=REDACTED-sub,DC=com</module-option> <module-option name="roleFilter">(member={1})</module-option> <module-option name="roleAttributeID">CN</module-option> <module-option name="roleRecursion">-1</module-option> <module-option name="authorizeOnly">true</module-option> <module-option name="principalIsDN">true</module-option> </login-module> THIS PATCH ADDS: principalIsDN - says that the passed in password (generally from the stack) is an actual DN not a username authorizeOnly - don't bind as the user, bind as only the bindDN. removePrincipalElements - also requires principalIsDN. if the principal is a DN but contains elements that are NOT part of LDAP then we remove those parts. (I.e. microsoft certificate server prefixes &quot;EMAILADDRESS=user(a)company.com,&quot; to the principal in the certificate but it ISNT part of the user's DN in ActiveDirectory). This is a comma delemeted list of just the keys, but both the key and value are removed from the principal (which is really a DN as specified) the total config for MS client certs with LdapExt against ActiveDirectory would be: <application-policy name = "jmx-console"> <authentication> <login-module code="org.jboss.security.auth.spi.BaseCertLoginModule" flag = "optional"> <module-option name="password-stacking">useFirstPass</module-option> <module-option name="securityDomain">java:/jaas/jmx-console</module-option> <module-option name="verifier">org.jboss.security.auth.certs.AnyCertVerifier</module-option> <!--anything signed that Tomcat likes, we like too and thus you're authenticated --> </login-module> <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="optional" > <module-option name="java.naming.provider.url">ldap://REDACTED-servername:389</module-option> <module-option name="java.naming.security.authentication">simple</module-option> <module-option name="bindDN">CN=REACTED-username,OU=Standard,OU=Users,OU=Corporate,DC=REDACTED-company,DC=REDACTED-sub,DC=com</module-option> <module-option name="bindCredential">REDACTED-password</module-option> <module-option name="removePrincipalElements">EMAILADDRESS</module-option> <module-option name="rolesCtxDN">OU=REDACTED-base,OU=Standard,OU=Groups,OU=Corporate,DC=REDACTED-company,DC=REDACTED-sub,DC=com</module-option> <module-option name="roleFilter">(member={1})</module-option> <module-option name="roleAttributeID">CN</module-option> <module-option name="roleRecursion">-1</module-option> <module-option name="authorizeOnly">true</module-option> <module-option name="principalIsDN">true</module-option> </login-module> </authentication> </application-policy> with conf/jboss-service.xml having: <mbean code="org.jboss.security.plugins.JaasSecurityDomain" name="jboss.security:service=SecurityDomain"> <constructor> <arg type="java.lang.String" value="jmx-console"></arg> </constructor> <attribute name="KeyStoreURL">${jboss.server.home.dir}/conf/mystore.keysto re</attribute> <attribute name="KeyStorePass">changeit</attribute> <depends>jboss.security:service=JaasSecurityManager</depends> </mbean> and tomcat having: <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" keystoreFile="${jboss.server.home.dir}/conf/mystore.keystore" truststoreFile="${jboss.server.home.dir}/conf/mystore.keystor e" clientAuth="true" sslProtocol="TLS" /> Thus you have MS client-certs authentication, active directory auth via LDAP. A dedicated LDAP user is used for the bind (not same as userid) This version is against 4.3. After discussed in the forum I'll commit against the active branch. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira