[jboss-jira] [JBoss JIRA] (ELY-857) Elytron ldap-realm is able to obtain username only from rdn-identifier attribute

[Jan Kalina (JIRA)]

    [ https://issues.jboss.org/browse/ELY-857?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13345701#comment-13345701 ] 

Jan Kalina edited comment on ELY-857 at 1/10/17 1:27 PM:
---------------------------------------------------------

Notes: result of WhoAmIOperation is obtained as:
{code:java}securityIdentity.getPrincipal().getName(){code}
The principal is really output of realm: (see ServerAuthenticationContext class)
{code:java}principal = getSecurityRealm().getRealmIdentity(evidence).getRealmIdentityPrincipal(){code}
But in LdapRealm (and FileSystem and Jdbc too) it is currently hardcoded as username - input of the realm.
*Possible solution:*
a) add mapping from identity attribute to identity principal into LdapRealm (add "username-attribute into ldap-realm and map this identity attribute to NamePrincipal when defined)
b) to use identity attribute instead of special method for principal to add this possibility into all realms at once?
[~dlofthouse] do you think this should be solved for LDAP only, or on higher level?


was (Author: honza889):
Notes: result of WhoAmIOperation is obtained as:
{code:java}securityIdentity.getPrincipal().getName(){code}
The principal is really output of realm: (see ServerAuthenticationContext class)
{code:java}principal = getSecurityRealm().getRealmIdentity(evidence).getRealmIdentityPrincipal(){code}
But in LdapRealm it is currently hardcoded as username - input of the realm.
*Possible solution:*
a) add mapping from identity attribute to identity principal into LdapRealm (add "username-attribute into ldap-realm and map this identity attribute to NamePrincipal when defined)
b) to use identity attribute instead of special method for principal to add this possibility into all realms at once?
[~dlofthouse] do you think this should be solved for LDAP only, or on higher level?

> Elytron ldap-realm is able to obtain username only from rdn-identifier attribute
> --------------------------------------------------------------------------------
>
>                 Key: ELY-857
>                 URL: https://issues.jboss.org/browse/ELY-857
>             Project: WildFly Elytron
>          Issue Type: Bug
>          Components: Realms
>    Affects Versions: 1.1.0.Beta16
>            Reporter: Ondrej Lukas
>            Assignee: Jan Kalina
>            Priority: Blocker
>
> In Elytron ldap-realm is currently not possible to obtain username from LDAP attribute which is different than rdn-identifier. It means that username of identity is always the same as value of rdn-identifier attribute.
> It can cause issues when ldap-realm is used for authentication and another realm is used for authorization since data for realm authorization can depend on assigned name during authentication.
> Example:
> It seems that ldap-realm cannot be configured for following scenario: User with credentials {{someUser}}/{{Password}} is authenticated and name {{AuthenticatedUser}} is assigned to them (e.g. when calling {{./jboss-cli.sh -c -u=someUser -p=Password ':whoami'}}, then {{AuthenticatedUser}} should be printed). Following ldif is used:
> {code}
> dn: ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: organizationalUnit
> ou: People
> dn: uid=someUser,ou=People,dc=jboss,dc=org
> objectclass: top
> objectclass: person
> objectclass: inetOrgPerson
> uid: someUser
> cn: some User
> sn: AuthenticatedUser
> userPassword: Password
> {code}
> Mentioned ldif works correctly with legacy security solution.
> This missing feature can cause that migration from legacy security solution will not be possible -> we request blocker.



--
This message was sent by Atlassian JIRA
(v7.2.3#72005)