You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@activemq.apache.org by Luis Gonzalez <lu...@mzero.com> on 2012/11/01 17:33:18 UTC
Using Apollo with LDAP/Active Directory
Hi,
I have been trying to configure Apollo to use Active Directory through LDAP
for authentication and group membership, much like the default file-based
configuration works.
I managed to configure authentication using
com.sun.security.auth.module.LdapLoginModule, but I'm missing group
membership and I don't see how to configure that module so it knows what to
do.
org.apache.activemq.jaas.LDAPLoginModule has options for querying the groups
but I haven't been able to get it to talk to Active Directory.
So the questions are:
- Is org.apache.activemq.jaas.LDAPLoginModule the right LoginModule to use
for LDAP in Apollo?
- Are there other LoginModules better suited for this?
Thanks!
--
View this message in context: http://activemq.2283324.n4.nabble.com/Using-Apollo-with-LDAP-Active-Directory-tp4658601.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: Using Apollo with LDAP/Active Directory
Posted by Christian Posta <ch...@gmail.com>.
Excellent!
Thanks for posting back your results.
On Mon, Nov 5, 2012 at 2:49 PM, Luis Gonzalez <lu...@mzero.com>wrote:
> Chirino, thank you very much!
>
> With your confirmation and help from Wireshark, Apache Directory Studio and
> JAAS LDAP Authentication Plugin
> <
> http://fusesource.com/docs/broker/5.3/security/Auth-JAAS-LDAPAuthentPlugin.html
> >
> , org.apache.activemq.jaas.LDAPLoginModule is finally working.
>
> The critical parts in apollo.xml were:
>
>
> ...and in login.config:
>
> ...and again, the queries depend on the directory organization. This one
> has
> an ApolloRoles subtree whose nodes are the role names.
>
>
>
>
>
> --
> View this message in context:
> http://activemq.2283324.n4.nabble.com/Using-Apollo-with-LDAP-Active-Directory-tp4658601p4658809.html
> Sent from the ActiveMQ - User mailing list archive at Nabble.com.
>
--
*Christian Posta*
http://www.christianposta.com/blog
twitter: @christianposta
Re: Using Apollo with LDAP/Active Directory
Posted by Luis Gonzalez <lu...@mzero.com>.
Chirino, thank you very much!
With your confirmation and help from Wireshark, Apache Directory Studio and
JAAS LDAP Authentication Plugin
<http://fusesource.com/docs/broker/5.3/security/Auth-JAAS-LDAPAuthentPlugin.html>
, org.apache.activemq.jaas.LDAPLoginModule is finally working.
The critical parts in apollo.xml were:
...and in login.config:
...and again, the queries depend on the directory organization. This one has
an ApolloRoles subtree whose nodes are the role names.
--
View this message in context: http://activemq.2283324.n4.nabble.com/Using-Apollo-with-LDAP-Active-Directory-tp4658601p4658809.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: Using Apollo with LDAP/Active Directory
Posted by chirino <hi...@hiramchirino.com>.
Try using the org.apache.activemq.jaas.LDAPLoginModule. Apollo redistributes
all of ActiveMQ 5.x's login modules.
--
View this message in context: http://activemq.2283324.n4.nabble.com/Using-Apollo-with-LDAP-Active-Directory-tp4658601p4658724.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: Using Apollo with LDAP/Active Directory
Posted by Luis Gonzalez <lu...@mzero.com>.
Thanks rektide, I don't have further experience with ldap either But I
certainly learnt that the LDAP queries below depend on your server
configuration and will very likely need tweaking beyond the domain name
("somecompany.com").
My only test so far consisted of having a new admin user, apolloadmin (name
"Apollo Admin") in Active Directory logging in to Apollo's local web_admin
site.
It worked but since I didn't see group information coming back (the Sun
login module writes to stdout in debug mode), no option to tell it to
retrieve it (like org.apache.activemq.jaas.LDAPLoginModule has), and having
failed in my attempts to get org.apache.activemq.jaas.LDAPLoginModule off
the ground, I thought of asking if this is the right approach.
Here is the relevant part inside apollo.xml:
And here is login.config:
So far, my impression is that I need to use (or create) another LoginModule.
Any help is welcome.
Thanks again!
--
View this message in context: http://activemq.2283324.n4.nabble.com/Using-Apollo-with-LDAP-Active-Directory-tp4658601p4658720.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.
Re: Using Apollo with LDAP/Active Directory
Posted by rektide <re...@voodoowarez.com>.
Hey Luis;
I don't have any experience with this topic, but I'd be interested in trying to replicate
your progress & see for myself if I can surmount this. Is there anything particular you had
to do for LdapLoginModule? If you can push a sanitized configuration that you're using to
the list, that would be a great starting place for me, and I'd love see how far I can get.
Cheers,
M
On Thu, Nov 01, 2012 at 09:33:18AM -0700, Luis Gonzalez wrote:
> Hi,
>
> I have been trying to configure Apollo to use Active Directory through LDAP
> for authentication and group membership, much like the default file-based
> configuration works.
>
> I managed to configure authentication using
> com.sun.security.auth.module.LdapLoginModule, but I'm missing group
> membership and I don't see how to configure that module so it knows what to
> do.
>
> org.apache.activemq.jaas.LDAPLoginModule has options for querying the groups
> but I haven't been able to get it to talk to Active Directory.
>
> So the questions are:
>
> - Is org.apache.activemq.jaas.LDAPLoginModule the right LoginModule to use
> for LDAP in Apollo?
>
> - Are there other LoginModules better suited for this?