Form-based authentication with open LDAP and servlet

In this section we will see how we can authenticate users by retrieving the user information stored in open LDAP and JAAS. Open LDAP, as its name suggests, is a free version of the lightweight user directory protocol, which allows us to create groups and add users to it.

Getting ready

Download open LDAP, create roles, groups, and user.

In the JBoss application server, edit the login-config.xml file.

How to do it...

Perform the following steps to configure the application server to retrieve users from Open LDAP:

1. In the login-config.xml file provide the LDAP port with the URL, credentials, and the domain that needs to be searched to find the username and password provided by the application:

   <application-policy name="example">
    <authentication>
    <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required" >
    <module-option name="java.naming.factory.initial">com.sun.jndi.ldap.LdapCtxFactory</module-option>
    <module-option name="java.naming.provider.url">ldap://localhost:389</module-option>
    <module-option name="java.naming.security.authentication">simple</module-option>
    <module-option name="bindDN">cn=Manager,dc=maxcrc,dc=com</module-option>
    <module-option name="bindCredential">secret</module-option>
    <module-option name="baseCtxDN">ou=People,dc=maxcrc,dc=com</module-option>
    <module-option name="baseFilter">(uid={0})</module-option>
   
    <module-option name="rolesCtxDN">ou=Roles,dc=maxcrc,dc=com</module-option>
     <module-option name="rolesCtxDN">ou=Department,dc=maxcrc,dc=com</module-option>
    <module-option name="roleFilter">(member={1})</module-option>
    <module-option name="roleAttributeID">cn</module-option>
    <module-option name="searchScope">ONELEVEL_SCOPE</module-option>
    <module-option name="allowEmptyPasswords">true</module-option>
    </login-module>
   </authentication>
   </application-policy>

2. In the jboss-web.xml file, we will specify the lookup name for JAAS:

   jboss-web.xml
   <?xml version="1.0" encoding="UTF-8"?>
   <jboss-web>
   <security-domain>java:/jaas/example</security-domain>
   </jboss-web>

How it works...

Build and deploy the WAR on JBoss, restart the server, and access the browser.

You will be prompted with a login form and JBoss authenticates the user based on the open LDAP credentials provided. The user is retrieved and is authorized with roles mentioned in the application policy. The container provides built-in APIs for authentication. The module org.jboss.security.auth.spi.LdapExtLoginModule handles the LDAP authentication process.

See also

• The Hashing/Digest Authentication on servlet recipe
• The Basic authentication for JAX-WS and JAX-RS recipe
• The Enabling and disabling the file listing recipe