LDAP + Active Directory

[Florian Theurich <fl...@x-cell.com>]

Hi all,

we are currently trying to authorize users via Active Directory. The
authentication is successfully handled by NTLM (jCIFS) and the username
indeed shows up on the portal login page. However this only works when we
'deactivate' the page.security file. 

1) Where shall we put our security constraints if there is no page.security?
Do we have to decentralize them and put them in various folder.metadata
files? 

2) Does someone successfully modified the LdapSecurityHandlers (or other
files?) in order to get all groups and roles for a particular user from
Active Directory?

What we're aiming at is the following:

A user authenticates himself to the domain via windows login. When opening
the browser the portal recognizes him (SSO) and should be able to
automatically look up his groups, roles and other attributes from Active
Directory in order to display the menu items and portlets the user is
allowed to see.

What we've already found the LDAP Authentication in M2 does not work
properly but with the help of a patch
(http://issues.apache.org/jira/browse/JS2-188#action_59540) the portal at
least manages to authenticate itself to the Active Directory. But now we
need information about the user...

Any help is highly appreciated!

Cheers
Florian




---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org

Re: LDAP + Active Directory

[Roel van Dijk <rd...@gmail.com>]

Florian,

We have implemented part of what you propose here, in Jetspeed 1.6. In
our situation, a user logs in to a Windows XP machine which is part of
the company's domain. Using a Kerberos module for Apache, the user is
authenticated (SSO) on the web server against the Active Directory
(AD), and this information is used in the portal. The Windows logon
name can be used to perform LDAP queries on the AD. For example, query
for the user's displayName etc..

For now we have ignored the 'roles' in Jetspeed, and are just working
with groups. We retrieve these groups from the AD using LDAP queries.
Note that the a user's "primary group" in the AD does not show up in
the memberOf properties of the user's object, and you need to figure
that out (Microsoft has some good documentation about that). You need
to do some additional recursive queries on the AD if you have nested
groups.

All of this is implemented 'read only', so only simple queries are
performed on the AD, and no properties can be changed using the portal
itself (so, leaving all that registration to the AD-maintainers).

This will be a portal for 3000+ people, I wonder how Jetspeed (and the
AD!) will hold up when more and more people start using it.

Hope this helps, feel free to ask me any questions.

-- 
Roel -- rdvdijk@gmail.com


On 5/27/05, Florian Theurich <fl...@x-cell.com> wrote:
> Hi all,
> 
> we are currently trying to authorize users via Active Directory. The
> authentication is successfully handled by NTLM (jCIFS) and the username
> indeed shows up on the portal login page. However this only works when we
> 'deactivate' the page.security file.
> 
> 1) Where shall we put our security constraints if there is no page.security?
> Do we have to decentralize them and put them in various folder.metadata
> files?
> 
> 2) Does someone successfully modified the LdapSecurityHandlers (or other
> files?) in order to get all groups and roles for a particular user from
> Active Directory?
> 
> What we're aiming at is the following:
> 
> A user authenticates himself to the domain via windows login. When opening
> the browser the portal recognizes him (SSO) and should be able to
> automatically look up his groups, roles and other attributes from Active
> Directory in order to display the menu items and portlets the user is
> allowed to see.
> 
> What we've already found the LDAP Authentication in M2 does not work
> properly but with the help of a patch
> (http://issues.apache.org/jira/browse/JS2-188#action_59540) the portal at
> least manages to authenticate itself to the Active Directory. But now we
> need information about the user...
> 
> Any help is highly appreciated!
> 
> Cheers
> Florian
> 
> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
> For additional commands, e-mail: jetspeed-user-help@portals.apache.org
> 
>

---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-user-unsubscribe@portals.apache.org
For additional commands, e-mail: jetspeed-user-help@portals.apache.org