[ https://jira.jboss.org/jira/browse/SECURITY-476?page=com.atlassian.jira.p... ] Matthias Kopczynski updated SECURITY-476: ----------------------------------------- Attachment: cutOffDomainPatch.patch -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/jira/browse/SECURITY-476?page=com.atlassian.jira.p... ] Vladimir Ze'ev Bunich commented on SECURITY-476: ------------------------------------------------ Hi , we ran into similar problem similar problem with domain qualified principals and AdvancedLdapLoginModule while working with JBOSS EAP 4.3 , queries to AD failed since sAMAccountName doesn't include the domain part. We had to add the following code (denoted FIXME in the code snippet below) to findUserDN in org.jboss.security.negotiation.AdvancedLdapLoginModule to strip the DQN from the principals when required. The behavior is similar to "Use domain-qualified user names" available in Websphere global security. protected String findUserDN(LdapContext ctx) throws LoginException { if (baseCtxDN == null) { return getIdentity().getName(); } try { NamingEnumeration results = null; String filterPrincipalNameArg = getIdentity().getName(); // FIXME DOMAIN CUTOFF FIX - START if (isUseDomainQualifiedPrincipal) { // isUseDomainQualifiedPrincipal is a property exposed as a module option default is false Object[] filterArgs = {getIdentity().getName()}; } else { if (filterPrincipalNameArg != null && filterPrincipalNameArg.trim().length() > 0 && filterPrincipalNameArg.contains("@")) { filterPrincipalNameArg = filterPrincipalNameArg.substring(0, filterPrincipalNameArg.indexOf("@")); } Object[] filterArgs = { filterPrincipalNameArg }; } // FIXME DOMAIN CUTOFF - END // FIXME original: Object[] filterArgs = {getIdentity().getName()}; results = ctx.search(baseCtxDN, baseFilter, filterArgs, userSearchControls); if (results.hasMore() == false) { results.close(); throw new LoginException("Search of baseDN(" + baseCtxDN + ") found no matches"); } SearchResult sr = (SearchResult) results.next(); String name = sr.getName(); String userDN = null; if (sr.isRelative() == true) userDN = name + "," + baseCtxDN; else throw new LoginException( "Can't follow referal for authentication: " + name); results.close(); results = null; if (log.isTraceEnabled()) { log.trace("findUserDN - " + userDN); } return userDN; } catch (NamingException e) { LoginException le = new LoginException("Unable to find user DN"); le.initCause(e); throw le; } } // FIXME DOMAIN CUTOFF - END // FIXME original: Object[] filterArgs = {getIdentity().getName()}; results = ctx.search(baseCtxDN, baseFilter, filterArgs, userSearchControls); if (results.hasMore() == false) { results.close(); throw new LoginException("Search of baseDN(" + baseCtxDN + ") found no matches"); } SearchResult sr = (SearchResult) results.next(); String name = sr.getName(); String userDN = null; if (sr.isRelative() == true) userDN = name + "," + baseCtxDN; else throw new LoginException( "Can't follow referal for authentication: " + name); results.close(); results = null; if (log.isTraceEnabled()) { log.trace("findUserDN - " + userDN); } return userDN; } catch (NamingException e) { LoginException le = new LoginException("Unable to find user DN"); le.initCause(e); throw le; } } Since the Negotiation component was not a part of EAP in version 4.3 we had to implement this code , currently we are migrating to EAP v5 which has Negotiation 2.0.3 SP2/SP3 integrated thus we would like to have this FIX applied in the enterprise version for EAP 5. Thank you. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/browse/SECURITY-476?page=com.atlassian.jira.plugin... ] Darran Lofthouse resolved SECURITY-476. --------------------------------------- Resolution: Done Added an option 'removeRealmFromPrincipal' to the SPNEGOLoginModule which when set to true will cause the realm to be chopped off the username. When this option is set to true login modules chained after the SPNEGOLoginModule may need their configuration adjusted to work with a principal without the realm. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira