The following allows you to use JNDIRealm's LDAP authentication to authenticate users of OpenXava application with Active Directory. The users will be prompt to enter their windows credentials, when entering the usernames they need to avoid entering the domain name; they just need to enter the username.
If you have multiple Active Directory domains to authenticate against, you can use org.apache.catalina.realm.CombinedRealm to allow Tomcat to search on both.
In the web.xml you will need to specify the security-constraint setting. This will force the user to authenticate when they reach any OpenXava module. in role-name, you have to enter the Windows Group name of that is allow to access the application. If you need finer restrictions, you can use OpenXava's Users.getCurrent() to get the username of the current user in your Java code. For example, you could have a validation logic to prevent a certain user from creating a new record.
Please note that you must use a security-constraint setting in web.xml in order to use Users.getCurrent() in your Java code.
web.xml in app folder
<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<!-- Define the context-relative URL(s) to be protected -->
<url-pattern>/modules/*</url-pattern>
<!-- If you list http methods, only those methods are protected -->
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>THE NAME OF A WINDOWS GROUP (NO NEED TO SPECIFY DOMAIN NAME)</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Windows Login</realm-name>
</login-config>
<security-role>
<role-name>THE NAME OF A WINDOWS GROUP (NO NEED TO SPECIFY DOMAIN NAME)</role-name>
</security-role>
In the server.xml file, you need to add the JNDIRealm that will allow Tomcat to connect to Active Directory via LDAP. The example below uses the CombinedRealm class to combine two Active Directory domains.
server.xml in tomcat's conf folder
<!-- make sure to remove the existing realms –>
<Realm className="org.apache.catalina.realm.CombinedRealm" >
<Realm
className="org.apache.catalina.realm.JNDIRealm"
debug="99"
connectionURL="ldap://DOMAIN-CONTROLLER-NAME.YOUDOMAIN.local:389"
connectionName="SOMEUSER@YOUDOMAIN.local"
connectionPassword="YOURPASSWORD"
referrals="follow"
userBase="DC=YOUDOMAIN,DC=local"
userSearch="(sAMAccountName={0})"
userSubtree="true"
roleBase="DC=YOUDOMAIN,DC=local"
roleName="cn"
roleSearch="(member={0})"
roleSubtree="true"/>
<Realm
className="org.apache.catalina.realm.JNDIRealm"
debug="99"
connectionURL="ldap://OTHERSERVER.YOUSECONDDOMAIN.LOCAL:389"
connectionName="SOMEUSER@YOUDOMAIN.local"
connectionPassword="YOURPASSWORD"
referrals="follow"
userBase="DC=YOUSECONDDOMAIN,DC=local"
userSearch="(sAMAccountName={0})"
userSubtree="true"
roleBase="DC=YOUSECONDDOMAIN,DC=local"
roleName="cn"
roleSearch="(member={0})"
roleSubtree="true"/>
</Realm>
In your OpenXava java code, you can obtain the username (no domain name) of the user visiting the page by calling Users.getCurrent(). The Users class lives in the org.openxava.util package
This approach works inside of a secure Intranet, hence the sending of credentials in plain text (BASIC in auth-method). To improve security, please configure Tomcat to use HTTPS only.
You can use a similar configuration to allow other Java web based application to authenticate users with Active Directory. You would probably have to modify the web.xml of the app and use the same server.xml configuration shown here.
Comments