Skip to main content

Authenticate OpenXava users with ActiveDirectory

The following allows you to use JNDIRealm's LDAP authentication to authenticate users of OpenXava application with Active Directory. The users will be prompt to enter their windows credentials, when entering the usernames they need to avoid entering the domain name; they just need to enter the username.

If you have multiple Active Directory domains to authenticate against, you can use  org.apache.catalina.realm.CombinedRealm to allow Tomcat to search on both.

In the web.xml you will need to specify the security-constraint setting. This will force the user to authenticate when they reach any OpenXava module. in role-name, you have to enter the Windows Group name of that is allow to access the application. If you need finer restrictions, you can use OpenXava's Users.getCurrent() to get the username of the current user in your Java code. For example, you could have a validation logic to prevent a certain user from creating a new record.

Please note that you must use a security-constraint setting in web.xml in order to use Users.getCurrent() in your Java code.

web.xml in app folder

<security-constraint>
<display-name>Example Security Constraint</display-name>
<web-resource-collection>
  <web-resource-name>Protected Area</web-resource-name>
  <!-- Define the context-relative URL(s) to be protected -->
  <url-pattern>/modules/*</url-pattern>
  <!-- If you list http methods, only those methods are protected -->
  <http-method>DELETE</http-method>
  <http-method>GET</http-method>
  <http-method>POST</http-method>
  <http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
  <role-name>THE NAME OF A WINDOWS GROUP (NO NEED TO SPECIFY DOMAIN NAME)</role-name>
</auth-constraint>
</security-constraint>

<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Windows Login</realm-name>
</login-config>
<security-role>
    <role-name>THE NAME OF A WINDOWS GROUP (NO NEED TO SPECIFY DOMAIN NAME)</role-name>
</security-role> 

In the server.xml file, you need to add the JNDIRealm that will allow Tomcat to connect to Active Directory via LDAP. The example below uses the CombinedRealm class to combine two Active Directory domains.

server.xml in tomcat's conf folder


<!-- make sure to remove the existing realms –>
  <Realm className="org.apache.catalina.realm.CombinedRealm" >
<Realm
        className="org.apache.catalina.realm.JNDIRealm"
        debug="99"
        connectionURL="ldap://DOMAIN-CONTROLLER-NAME.YOUDOMAIN.local:389"
        connectionName="SOMEUSER@YOUDOMAIN.local"
        connectionPassword="YOURPASSWORD"
        referrals="follow"
        userBase="DC=YOUDOMAIN,DC=local"
        userSearch="(sAMAccountName={0})"
        userSubtree="true"
        roleBase="DC=YOUDOMAIN,DC=local"
        roleName="cn"
        roleSearch="(member={0})"
        roleSubtree="true"/>
       
   <Realm
        className="org.apache.catalina.realm.JNDIRealm"
        debug="99"
        connectionURL="ldap://OTHERSERVER.YOUSECONDDOMAIN.LOCAL:389"
        connectionName="SOMEUSER@YOUDOMAIN.local"
        connectionPassword="YOURPASSWORD"
        referrals="follow"
        userBase="DC=YOUSECONDDOMAIN,DC=local"
        userSearch="(sAMAccountName={0})"
        userSubtree="true"
        roleBase="DC=YOUSECONDDOMAIN,DC=local"
        roleName="cn"
        roleSearch="(member={0})"
        roleSubtree="true"/>
       
 
</Realm>

In your OpenXava java code, you can obtain the username (no domain name) of the user visiting the page by calling Users.getCurrent(). The Users class lives in the org.openxava.util package

This approach works inside of a secure Intranet, hence the sending of credentials in plain text (BASIC in auth-method). To improve security, please configure Tomcat to use HTTPS only.

You can use a similar configuration to allow other Java web based application to authenticate users with Active Directory. You would probably have to modify the web.xml of the app and use the same server.xml configuration shown here.

Comments

JohnMiller said…
Just checked back here (to look again at your excellent 'How to create online multiplayer HTML5 games in Construct2') and discovered that you've changed your blog title. I like it! Very apprpriate for a thoughtful software developer!
8:40 PM
Post a Comment

Popular posts from this blog

Mail labels and letter templates for jasperreports

The following are free (MIT license) mailing labels and letter templates for jasperreports that you can download and use in jasperserver and/or ireport: Update 3/15/2011 : I moved the Mail templates zip file here . Please consider making a small donation if the templates are of help to you, Thank you! If you need more information on how to use those templates please leave a comment in the blog.
14 comments
Read more

How to create online multiplayer HTML5 games in Contruct2

  Construct2 can use websockets to send and receive messages between games. By using socket-io , we can use a Node.js script as the server and my modification to the socket-io plugin for Construct2 to allow the games to synchronize data between them in real-time. There are two parts to this design: the Node.js server and the Construct2 clients (the games playing). The main part of building an online multiplayer HTML5 game is to plan: how the clients will communicate how often and what to communicate how much of the logic will go into the server and how much to the client. In my sample game, I chose to have each client own a player and have the server just relay messages: Use string messages in the form TypeOfMessage, Parameter1, Paremeter2, Parater3, etc to communicate. Have the clients send their player position about 16 times a second. Whenever their player shoots, the client needs to send a message immediately. Almost all of the game logic will...
9 comments
Read more

How to get the raw data posted to a Java Servlet

While working in porting GeneCMS to Google App Engine and Silverlight , I stumble at one annoying problem: how to get the raw data that was sent by the browser via a POST. In this GeneCMS port, the silverlight client actually generates all the HTML that the server used to generate. The raw generated HTML is then sent to the GAE application, with some metadata about the generated pages. The GAE servlet then reads the posted data as a string and extract the individual generated pages. Each generated page is then saved into the GAE database to allow the CMS to server the pages. After tweking around in the wrong places, I finally found out that HttpServletRequest’s getInputStream method is an input stream to the raw data posted. So I modified my servlet to get the POST data into a string like this: String posted_data = ""; BufferedReader in = new BufferedReader(new InputStreamReader( request.getInputStream())); String line = in.readLine(); while (line != null) { posted...
2 comments
Read more