JBoss and LdapDomain

check this https://developer.jboss.org/thread/274715?_sscc=t


in standalone.xml you should have:

<security-domain name="LdapDomain" cache-type="default">
 <authentication>
  <login-module code="LdapExtended" flag="required">
   <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
   <module-option name="java.naming.provider.url" value="ldap://localhost:10389"/>
   <module-option name="java.naming.security.authentication" value="simple"/>
   <module-option name="bindDN" value="uid=admin,ou=system"/>
   <module-option name="bindCredential" value="secret"/>
   <module-option name="baseCtxDN" value="ou=People,dc=example,dc=com"/>
   <module-option name="baseFilter" value="(uid={0})"/>
   <module-option name="rolesCtxDN" value="ou=Roles,dc=example,dc=com"/>
   <module-option name="roleFilter" value="(member={1})"/>
   <module-option name="roleAttributeID" value="cn"/>
   <module-option name="searchScope" value="ONELEVEL_SCOPE"/>
   <module-option name="allowEmptyPasswords" value="true"/>
  </login-module>
 </authentication>
</security-domain>

How to secure your web.xml: http://www.javamonamour.org/2012/06/tomcat-web-application-security-in-20.html

<security-constraint>
 <web-resource-collection>
  <web-resource-name>HtmlAuth</web-resource-name>
  <description>application security constraints
  </description>
  <url-pattern>/*</url-pattern>
  <http-method>GET</http-method>
  <http-method>POST</http-method>
  <http-method>PUT</http-method>
  <http-method>DELETE</http-method>
 </web-resource-collection>
 <auth-constraint>
  <role-name>Manager</role-name>
 </auth-constraint>
</security-constraint>
<login-config>
 <auth-method>BASIC</auth-method>
 <realm-name>Sample Realm</realm-name>
</login-config>
<security-role>
 <role-name>Manager</role-name>
</security-role>

jboss-web.xml :

<jboss-web>
<security-domain>java:/jaas/LdapDomain</security-domain>
</jboss-web>

In order to use FORM login, instead of BASIC:

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>OsbReports Application</realm-name>
    <form-login-config>
      <form-login-page>/login.jsp</form-login-page>
      <form-error-page>/error.jsp</form-error-page>
    </form-login-config>
  </login-config>

with login.jsp :

<form method="POST" action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">
</form>

See also




https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1/html/how_to_configure_identity_management/legacy_security_subsystem#configure_a_security_domain_to_use_ldap

https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html-single/login_module_reference/index#ldapextended_login_module




All JBoss login modules: https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1/html-single/login_module_reference/

JBOSS LDAP Examples https://developer.jboss.org/wiki/LDAPSecurityRealmExamples , shows how to use username-filter and advanced-filter to query onsAMAccountName and memberOf )

Apache DS in docker

https://github.com/greggigon/apacheds

docker run -d --rm --name apacheds -p 10389:10389 greggigon/apacheds

docker exec -ti apacheds bash

ps -ef

UID PID PPID C STIME TTY TIME CMD
root 1 0 0 18:48 ? 00:00:00 /bin/bash /usr/local/bin/apacheds.sh
apacheds 93 1 0 03:40 ? 00:00:01 /opt/apacheds-2.0.0_M24/bin/wrapper /var/lib/apacheds-2.0.0_M24/default/conf/wrapper-instance.conf set.INSTANCE_DIRECTORY=/var/lib/apacheds-2.0.0_M24/default set.A
apacheds 95 93 1 03:40 ? 00:00:10 java -Dlog4j.configuration=file:////var/lib/apacheds-2.0.0_M24/default/conf/log4j.properties -Dapacheds.var.dir=/var/lib/apacheds-2.0.0_M24/default -Dapacheds.log.



binaries are in /opt/apacheds-2.0.0_M24/ , logs in /var/lib/apacheds-2.0.0_M24/default/log/apacheds.log

you can use this Bind DN:
uid=admin,ou=system
with password:
secret

this should give you ldapmodify :
sudo yum install openldap-clients

You can connect with ldapmodify https://cwiki.apache.org/confluence/display/DIRxSRVx10/2.2.2.+Command+line+tools

ldapmodify -p 10389 -h 127.0.0.1 -D "uid=admin,ou=system" -w secret
#search all
ldapsearch -h 127.0.0.1 -p 10389  -D "uid=admin,ou=system" -w secret "(objectClass=*)"
#search only one domain
ldapsearch -x -h 127.0.0.1 -p 10389  -D "uid=admin,ou=system" -w secret -b 'dc=example,dc=com' '(objectclass=*)'

(see page 312 of the Wildfly Configuration Deployment Administration 2nd Edition" book)

here a sample LDIF file you can import with
ldapmodify -p 10389 -h 127.0.0.1 -D "uid=admin,ou=system" -w secret -a -f example.ldif

dn: dc=example,dc=com
objectclass: top
objectclass: dcObject
objectclass: organization
dc: example
o: MCC

dn: ou=People,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: People

dn: uid=admin,ou=People,dc=example,dc=com
objectclass: top
objectclass: uidObject
objectclass: person
uid: admin
cn: Manager
sn: Manager
userPassword: secret

dn: ou=Roles,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: Roles

dn: cn=Manager,ou=Roles,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
cn: Manager
description: the JBossAS7 group
member: uid=admin,ou=People,dc=example,dc=com

You can download jxplorer (see https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=29757) , login as "uid=admin,ou=system" password secret, then Tool/Import

I am using now Apache Directory Studio, it seems more advanced than jxplorer.

https://cwiki.apache.org/confluence/download/attachments/29756/apache_ds_tutorial.ldif?version=1&modificationDate=1164515728000&api=v2&download=true

but it fails.... totally broken it seems...

Better start reading the ApacheDS Basic User Guide http://directory.apache.org/apacheds/basic-user-guide.html


LDAP basic tutorial







let me quickly say that LDAP SUCKS big time, this technology is Stone-Age old and pathetically complex and brittle.


http://directory.apache.org/apacheds/basic-ug/1.4.3-adding-partition.html how to add a partition o=sevenSeas


Excellent basic intro to LDAP concepts https://www.digitalocean.com/community/tutorials/understanding-the-ldap-protocol-data-hierarchy-and-entry-components


Complete code to connect to LDAP and run a query

package org.pierre.pvldapconnect;

import java.util.Hashtable;
import java.util.Properties;

import javax.naming.*;
import javax.naming.directory.*;
import javax.naming.ldap.*;

public class LDAPConnect {
 public static void main(String[] args) throws Exception {
  //build a hashtable containing all the necessary configuration parameters
  Hashtable<String, String> environment = new Hashtable<String, String>();

  Properties conf;
  environment.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
  environment.put(Context.PROVIDER_URL, "ldap://localhost:10389");
  environment.put(Context.SECURITY_AUTHENTICATION, "simple");
  environment.put(Context.SECURITY_PRINCIPAL, "uid=admin,ou=system");
  environment.put(Context.SECURITY_CREDENTIALS, "secret");

  // connect to LDAP
  DirContext context = new InitialDirContext(environment);
  System.out.println("Connected..");
        System.out.println(context.getEnvironment());
    
        

  // Specify the search filter
  String FILTER = "(&(objectClass=person) ((cn=\"pierluigivernetto\")))";

  // limit returned attributes to those we care about
  String[] attrIDs = { "sn", "cn" };

  SearchControls ctls = new SearchControls();
  ctls.setReturningAttributes(attrIDs);
  ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

  // Search for objects using filter and controls
  final String ldapSearchBase = "dc=example,dc=com";
  NamingEnumeration<SearchResult> answer = context.search(ldapSearchBase, FILTER, ctls);
  while (answer.hasMore()) {
   SearchResult result = answer.next();
   System.out.println(result.toString());
  }

 }

}

Apache Directory Service LDAP

http://directory.apache.org/

install "Apache DS" and "Apache Directory Studio"

DS logs are in D:\apps\ApacheDS\instances\default\log

Open Studio, LDAP / new Connection, port 10389, host localhost, username uid=admin,ou=system password secret
(see http://directory.apache.org/apacheds/basic-ug/1.4.2-changing-admin-password.html )

if you see this in apacheds logs, no worries:
"[org.apache.directory.server.core.DefaultDirectoryService] - You didn't change the admin password of directory service instance 'default'. Please update the admin password as soon as possible to prevent a possible security breach."

DS conf is in D:\apps\ApacheDS\conf\wrapper.conf

To find out at which port the ActiveDS is actually listening (NOT on the default 389 port, but on 10389) I recommend using TCPVIEW.

dn: dc=example,dc=com
objectclass: top
objectclass: dcObject
objectclass: organization
dc: example
o: MCC
dn: ou=People,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: People
dn: uid=admin,ou=People,dc=example,dc=com
objectclass: top
objectclass: uidObject
objectclass: person
uid: admin
cn: Manager
sn: Manager
userPassword: secret
dn: ou=Roles,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: Roles
dn: cn=Manager,ou=Roles,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
cn: Manager
description: the JBossAS7 group
member: uid=admin,ou=People,dc=example,dc=com

name="bindDN" value="uid=admin,ou=system"
name="baseCtxDN" value="ou=People,dc=example,dc=com"
name="rolesCtxDN" value="ou=Roles,dc=example,dc=com"

SBConsoleAccessException

I had to start admin on a different machine, and I was getting

com.bea.alsb.console.common.base.SBConsoleAccessException: The current login role is not authorized to use the console action: "/sbSubModules"

The only way I managed to make it work is by replacing DOMAIN_HOME/servers/osbpp1ms2/data/ldap/ with the content of another server:

cd opt/oracle/domains/osbpp1do/servers/osbpp1as/data/
cp -R ldap/ ldapOLD/ 
cp -R /opt/oracle/domains/osbpp1do/servers/osbpp1ms2/data/ldap/* ldap/

JXPlorer and Active Directory

Open Windows Registry

if you use IPass for security, you will find this entry:

HKEY_CURRENT_USER\Software\IPass\ACME Remote Access\USID_ESP\Duplicates

my content is:

Pierluigi.Vernetto
acme.com
AQAAANDMnd8FFdERjHoAwE/Cl+sBAAAA blablablablablabla aplNL6C4QAAAAOVJbIYXyfadpr8WyifmtdhQAAADle2E4j9MsqLzd5hcZQE2+khYIlwA=

pirillo
LDAP://CN=pirillo,OU=HQ-Acme-Corporate,OU=Users and Groups,OU=HQ,OU=CTR,OU=Organizations,DC=acme,DC=com
ACMEUserAuthKey


copy the part in BOLD: CN=pirillo,OU=HQ-Acme-Corporate,OU=Users and Groups,OU=HQ,OU=CTR,OU=Organizations,DC=acme,DC=com

Download JXplorer

Address is ldap.hq.acme.com , port 389


Base DN: dc=acme,dc=com

for password, use your own password

WebLogic Authentication denied: Boot identity not valid

This can easily solved by throwing to it all the possible tricks. The safest is:

delete $DOMAIN_HOME/servers/ms1/data/ldap folder
delete $DOMAIN_HOME/servers/ms1/security/boot.properties folder
cd $DOMAIN_HOME/bin
./startManagedWebLogic.sh ms1
provide username and password
Make also sure you have activated domain/security/embedded LDAP/Refresh Replica At Startup

WebLogic embedded LDAP, Refresh Replica At Startup

When using Whole Server Migration, LDAP files MIGHT not be properly synchronized, and you end up in "Authentication Failed" :

javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User ser_nesoav2gxs javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User ser_nesoav2gxs denied
        at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:261)

http://docs.oracle.com/cd/E17904_01/web.1111/e13707/ldap.htm

in WebLogic console, go to Domain / Security / Embedded LDAP , there is an option "Refresh Replica At Startup".

Examining WebLogic embedded LDAP files with Apache Active Directory

Install Apache Active Directory

You can open either

C:\bea1035\user_projects\domains\prod_domain\servers\osb_server1\data\ldap\osb_server1.ldif

or

C:\bea1035\user_projects\domains\prod_domain\servers\AdminServer\data\ldap\osb_server1.ldif

they should be identical (if they are not, be worried)

you will find something along this line:

(domain, realm, groups, people)


dn: dc=prod_domain
dc: prod_domain
objectclass: top
objectclass: domain
orclguid: D4F9FF20F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin

dn: ou=myrealm,dc=prod_domain
ou: myrealm
objectclass: top
objectclass: organizationalUnit
orclguid: D4FD8190F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin

dn: ou=groups,ou=myrealm,dc=prod_domain
ou: groups
objectclass: organizationalUnit
objectclass: top
orclguid: D4FDCFB0F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin

dn: ou=people,ou=myrealm,dc=prod_domain
ou: people
objectclass: organizationalUnit
objectclass: top
orclguid: D4FDF6C0F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin

dn: cn=ALSBSystemGroup,ou=groups,ou=myrealm,dc=prod_domain
memberURL: ldap:///ou=groups,ou=myrealm,dc=prod_domain??sub?(&(objectclass=person)(wlsMemberOf=cn=ALSBSystemGroup,ou=groups,ou=myrealm,dc=prod_domain))
description: The ALSBSystemGroup is a built-in group which has access to ALSBs internals artifacts
objectclass: top
objectclass: groupOfUniqueNames
objectclass: groupOfURLs
cn: ALSBSystemGroup
orclguid: D4FF0830F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin


follow list of all groups

then the users will appear:


dn: uid=OracleSystemUser,ou=people,ou=myrealm,dc=prod_domain
description: Oracle application software system user.
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
objectclass: top
objectclass: wlsUser
cn: OracleSystemUser
sn: OracleSystemUser
userpassword:: e3NzaGF9dEFnSFNTS25IMk54WjJhOUNkUGNGaGdTMm1LWUFxcms=
uid: OracleSystemUser
wlsMemberOf: cn=OracleSystemGroup,ou=groups,ou=myrealm,dc=prod_domain
orclguid: D508CC30F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin

dn: uid=alsb-system-user,ou=people,ou=myrealm,dc=prod_domain
description: The ALSB system user is a built-in system account which belongs to the ALSBSystem role. As such it has access to ALSBs internal artifacts. The password for this account is automatically changed when the admin server boots to prevent direct access to this account.
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
objectclass: top
objectclass: wlsUser
cn: alsb-system-user
sn: alsb-system-user
uid: alsb-system-user
wlsMemberOf: cn=ALSBSystemGroup,ou=groups,ou=myrealm,dc=prod_domain
orclguid: D5091A50F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin
userpassword:: e3NzaGF9UVhWVUVOSzN4VFRsUSs1REVWdWpvRFhKbU83K29VMXo=
modifyTimeStamp: 201110231247Z
modifiersName: cn=Admin

dn: uid=weblogic,ou=people,ou=myrealm,dc=prod_domain
description: This user is the default administrator.
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
objectclass: top
objectclass: wlsUser
cn: weblogic
sn: weblogic
userpassword:: e3NzaGF9bVo2RlJqazM1cXJFOFpSbXVlVUdRWUNwQmluUXptUFE=
uid: weblogic
wlsMemberOf: cn=Administrators,ou=groups,ou=myrealm,dc=prod_domain
orclguid: D5096870F2B911E0BF1ED596F66B2A93
createTimestamp: 201109092101Z
creatorsName: cn=Admin



how fascinating...just kidding.

BEA-000386 LDAP file (maybe) corrupted

We had some OutOfMemory errors in our server, and finally - after fixing the memory problems - we were unable to start the Admin because of this problem:

####<Nov 21, 2011 1:12:20 PM CET> <Critical> <WebLogicServer> <hqchnesoa102> <osbdv1as> <main> <<WLS Kernel>> <> <> <1321877540974> <BEA-000386> <Server subsystem failed. Reason: java.lang.NumberFormatException: null
java.lang.NumberFormatException: null
at java.lang.Integer.parseInt(Integer.java:417)
at java.lang.Integer.<init>(Integer.java:660)
at com.octetstring.vde.replication.Replication.initAgreements(Replication.java:146)
at com.octetstring.vde.replication.Replication.init(Replication.java:87)
at weblogic.ldap.EmbeddedLDAP.initReplication(EmbeddedLDAP.java:1304)
at weblogic.ldap.EmbeddedLDAP.start(EmbeddedLDAP.java:344)
at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:178)
>


moving the AdminServer/data/LDAP directory to a LDAP_BACKUP and restarting the server solved the problem. Of course we lost all the users.

I assume that the LDIF files simply get occasionally corrupted upon OOM. This is quite annoying.

Further digging showed that the file $DOMAIN_HOME/servers/AdminServer/data/ldap/conf/replicas.prop was empty, while it should contain something like this:


#Generated property file
#Mon Nov 21 13:38:21 CET 2011
replica.num=1
replica.0.name=osbdv1ms1
replica.0.base=dc\=osbdv1do
replica.0.port=8001
replica.0.hostname=soa102.acme.com
replica.0.masterurl=ldap\://soa102.acme.com\:7001/
replica.0.masterid=osbdv1as
replica.0.secure=0
replica.0.binddn=cn\=Admin
replica.0.consumerid=osbdv1ms1


How the file managed to get nuked, it's anybody's guess.

The message is: keep a backup of the AdminServer/data directory...

How to explore WebLogic internal LDAP with a LDAP browser

Download http://jxplorer.org/

Enter a password to protect access to LDAP:
(click on the domain/security/Embedded LDAP and enter credential/confirm credential)
The username associated is "Admin".
My domain is "soadev".

Enter these values in JXplorer (replace soadev with your own domain name):

here is what you get: