...
| Code Block | ||||
|---|---|---|---|---|
| ||||
vi /app/ui/MonTier-UI/conf/server.xml |
Disabling DB registry
DPOD is set up by default with the internal database user management option. To use LDAP, you will first have to disable the DB registry
To do that, comment out the DataSourceRealm element (see below)
| Code Block | ||||
|---|---|---|---|---|
| ||||
<!-- <Realm className="org.apache.catalina.realm.DataSourceRealm" ... /> --> |
Scenario A - An attribute of the user directory entry
When your installation scenario matches Scenario A in the Concepts Section - add the following XML element right after the DataSourceRealm element you've commented out in the previous step.
...
| Parameter Name | Description |
|---|---|
| connectionURL | An LDAP URL specifying the domain name of the directory server, the port number and DN of the root naming context. |
| alternateURL | An LDAP URL specifying an alternate directory server to connect to (if any). This should follow the same format as connectionURL |
| referrals | State how you want LDAP referrals to be handled. Valid values are "follow" or "ignore" |
| connectionName | The connection username/DN for the directory server, which is used to retrieve user and groups. |
| connectionPassword | The connection password for the directory server, which is used to retrieve user and groups. Note: Do not enter the password in plain text. The value here must be a hash digest (See Encrypting Connection Password below) |
| userBase | The base entry for the user search. If not specified, the search base defaults to the top-level directory context |
| userSubtree | Whether to search the entire subtree rooted at the userBase entry, or limit it to a single-level. Valid values are "true" and "false" |
| userSearch | An LDAP search filter to find the user. {0} will be replaced with the authenticating username, '&' and '|' should be escaped. |
| userRoleName | The name of the attribute in the user's directory entry containing the name of the role |
Scenario B - An attribute of the group directory entry
When your installation scenario matches Scenario B in the Concepts Section - add the following XML element right after the DataSourceRealm element you've commented out in the previous step.
...
| Parameter Name | Description |
|---|---|
| connectionURL | An LDAP URL specifying the domain name of the directory server, the port number and DN of the root naming context. |
| alternateURL | An LDAP URL specifying an alternate directory server to connect to (if any). This should follow the same format as connectionURL |
| referrals | State how you want LDAP referrals to be handled. Valid values are "follow" or "ignore" |
| connectionName | The connection username/DN for the directory server, which is used to retrieve user and groups. |
| connectionPassword | The connection password for the directory server, which is used to retrieve user and groups. Note: Do not enter the password in plain text. The value here must be a hash digest (See Encrypting Connection Password below) |
| userBase | The base entry for the user search. If not specified, the search base defaults to the top-level directory context |
| userSubtree | Whether to search the entire subtree rooted at the userBase entry, or limit it to a single-level. Valid values are "true" and "false" |
| userSearch | An LDAP search filter to find the user.
|
| roleBase | The base entry for the group search. If not specified, the search base defaults to the top-level directory context |
| roleSubtree | Whether to search the entire subtree rooted at the roleBase entry, or limit it to a single-level. Valid values are "true" and "false" |
| roleSearch | An LDAP search filter to find the groups.
|
| userRoleAttribute | The name of the attribute that provides the value for {2} on roleSearch, if required |
| roleName | The name of the attribute in the group's directory entry containing the name of the role |
| roleNested | Whether roles are nested in roles. If configured, then every newly found roleName and distinguished name will be recursively tried for a new role search Valid values are "true" and "false" |
Encrypting connection password
As noted above, you should not enter the clear-text password in server.xml. Instead, you provide a hash digest of the password. Use the following command to generate an encrypted password
Run the following command (Replace <CLEAR-TEXT-PASSWORD> with your password):
Code Block language bash theme RDark java -cp "/app/ui/MonTier-UI/lib/*:/app/ui/MonTier-UI/bin/*" org.apache.catalina.realm.RealmBase -a SHA1 <CLEAR-TEXT-PASSWORD> or /app/ui/MonTier-UI/bin/digest.sh -a SHA1 <CLEAR-TEXT-PASSWORD>
The system will create an encrypted password and display the result in the following format:
<CLEAR-TEXT-PASSWORD>:<ENCRYPTED-PASSWORD>
Modify the JNDIRealm XML element (this is the element discussed above)
Code Block language bash theme RDark <Realm className="org.apache.catalina.realm.JNDIRealm" ... connectionPassword="<ENCRYPTED-PASSWORD>" digest="MD5" ... />
Connect to LDAP over SSL
In order to connect to the LDAP server over SSL (LDAPS ) perform the following steps:
...