Authenticate web application with Active Directory in JBoss EAP 6

This is so embarrassing. In my previous post, I though I have already done the AD configuration, but that was only for management, not the application. There are 2 different story. Assume I have the following AD configuration:

    dn: CN=user1,OU=Users,DC=huahsin68,DC=org
    objectClass: user
    objectClass: organizationalPerson
    objectClass: person
    objectClass: top
    memberOf: CN=Role_1,OU=Groups,OU=Users,DC=huahsin68,DC=org
    sAMAccountName: user1
    ...
     
    dn: CN=Role_1,OU=Groups,OU=Users,DC=huahsin68,DC=org
    objectClass: group
    objectClass: top
    cn: Role_1
    member: CN=user1,OU=Users,DC=huahsin68,DC=org
    name: Role_1
    ...

For web application, there are 2 things need to be done in order to authenticate users through Active Directory (AD) in JBoss. One is deployment descriptor (web.xml) configuration, and the other one is JBoss configuration (either in domain.xml or standalone.xml). In deployment descriptor, the following configuration shows the regular piece in securing a web application:

      <security-constraint>
     <web-resource-collection>
      <web-resource-name>Authentication</web-resource-name>
      <description>Please login</description>
      <url-pattern>/pages/*</url-pattern>
      <http-method>GET</http-method>
      <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
      <role-name>Role_1</role-name>
      <role-name>Role_2</role-name>
     </auth-constraint>
      </security-constraint>
    
      <login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
      <form-login-page>/login.xhtml</form-login-page>
      <form-error-page>/error.xhtml</form-error-page>
     </form-login-config>
      </login-config>
     
      <security-role>
     <role-name>Role_1</role-name>
      </security-role>
      <security-role>
     <role-name>Role_2</role-name>
      </security-role>

Next is JBoss configuration. It has been a hard time for me to configure this as I mess up the role configuration causing me keep hitting HTTP 403. This is not fun at all, but at last I managed to find the solution. Configuration below shows how this is done in order to authenticate through AD.

    <security-domain name="ADRealm" cache-type="default">
       <authentication>
          <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required">
             <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
             <module-option name="java.naming.security.authentication" value="simple"/>
             <module-option name="java.naming.provider.url" value="ldap://127.0.0.1:10389"/>
             <module-option name="debug" value="true"/>
             <module-option name="bindDN" value="CN=huahsin,OU=Users,DC=huahsin68,DC=org"/>
             <module-option name="bindCredential" value="Abcd1234"/>
             <module-option name="baseCtxDN" value="OU=Users,DC=huahsin68,DC=org"/>
             <module-option name="baseFilter" value="(sAMAccountName={0})"/>
             <module-option name="searchScope" value="SUBTREE_SCOPE"/>
             <module-option name="allowEmptyPasswords" value="false"/>
             <module-option name="roleAttributeIsDN" value="true"/>
             <module-option name="rolesCtxDN" value="OU=Groups,OU=Users,DC=huahsin68,DC=org"/>
             <module-option name="roleFilter" value="(member={1})"/>
             <module-option name="roleAttributeID" value="memberOf"/>
          </login-module>
       </authentication>
    </security-domain>

A new security domain is created under the <subsystem xmlns="urn:jboss:domain:security:1.1">, don't confuse with the management's configuration. There are 2 different entity. Last but not least, remember to link ADRealm which is define in JBoss configuration in jboss-web.xml (as shown in the following code), otherwise the web application would not be able to authenticate though the AD.

   <jboss-web>
      <security-domain>java:/jaas/ADRealm</security-domain>
   </jboss-web>

Some site info, when the role is found in AD, following log could be seen in server log.

    15:21:48,811 DEBUG [org.apache.catalina.realm] (http-localhost/127.0.0.1:8080-2)   Checking roles GenericPrincipal[huahsin68(Role_1,)] 
    15:21:48,811 DEBUG [org.apache.catalina.realm] (http-localhost/127.0.0.1:8080-2) JBWEB000017: User [user1] has role [Role_1]
    15:21:48,811 DEBUG [org.apache.catalina.realm] (http-localhost/127.0.0.1:8080-2) Role found:  Role_1

But if it doesn’t found, following log would be seen in server log:

    11:32:40,401 DEBUG [org.apache.catalina.realm] (http-localhost/127.0.0.1:8080-2)   Checking roles GenericPrincipal[huahsin68()]
    11:32:40,415 DEBUG [org.apache.catalina.realm] (http-localhost/127.0.0.1:8080-2) JBWEB000016: User [user1] does not have role [Role_1]
    11:32:40,415 DEBUG [org.apache.catalina.realm] (http-localhost/127.0.0.1:8080-2) No role found:  Role_1

Authenticate JBoss EAP 6 through Active Directory

The codes shown below represent a portion of the JBoss EAP 6 authentication mechanism in standalone.xml. Notice the user’s authentication details are store in the properties file whenever a user is added through add-user script provided by JBoss. There are 2 properties files, one for user, and one for role.

    <management>
            <security-realms>
                <security-realm name="ManagementRealm">
                    <authentication>
                        <local default-user="$local" skip-group-loading="true"/>
                        <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
                    </authentication>
                    <authorization map-groups-to-roles="false">
                        <properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
                    </authorization>
                </security-realm>
                ...
                ...
            </security-realms>
            <management-interfaces>
                <native-interface security-realm="ManagementRealm">
                    <socket-binding native="management-native"/>
                </native-interface>
                <http-interface security-realm=" ManagementRealm ">
                    <socket-binding http="management-http"/>
                </http-interface>
            </management-interfaces>
    </management>

My objective is to implement Active Directory (AD) authentication on JBoss, so that it doesn't use the local user (the one that store in the properties file). And the connection established to AD must be secured. First I initiate a connection to AD as defined in <outbound-connections>:

    <management>
        <security-realms>
            ...
        </security-realms>
        <outbound-connections>
            <ldap name="ad" url="ldaps://192.168.1.88:686" search-dn="CN=huahsin,OU=Users, DC=huahsin68,DC=org" search-credential="Abcd1234"/>
        </outbound-connections>
        ...
        ...
    </management>

And then add a new realm, named ADRealm, under the security realm section to search for users. This section is to tells how the searching criteria would be. In my case, I'm using sAMAccountName as the search key, and recursively search starting from Users subtree:

    <security-realms>
        ...
        <security-realm name="ADRealm">
            <authentication>
                <ldap connection="ad" base-dn="OU=Users,DC=huahsin68,DC=org" recursive="true">
                    <username-filter attribute="sAMAccountName"/>
                </ldap>
             </authentication>
        </security-realm>
    <security-realms>

And then I would have to redirect the authentication to use ADRealm rather than ManagementRealm under the <management-interfaces>.

    <management-interfaces>
        <native-interface security-realm="ManagementRealm">
            <socket-binding native="management-native"/>
        </native-interface>
        <http-interface security-realm="ADRealm">
            <socket-binding http="management-http"/>
        </http-interface>
    </management-interfaces>

Now comes to second stage would be to configure SSL so that the JBoss would be able to authentication through a secure channel. Execute the following command to import the certificate into JDK which has been bound to JBoss.

keytool –import –trustkey –file /path/to/adcert.cer –alias ADCert –keystore C:\Tool\jdk1.7.0_79\jre\lib\security\cacerts

Once done! JBoss will now integrate with AD authentication.

Never ever though I could have such fate with Login module.

My intention is develop a login module for an web application, this is very important as in an Enterprise Application architecture design, authentication and authorization should never miss. Since the Feb 2013 I start on this, along the development journey, I have explore into 4 different types of technologies, start from Spring Security -> LDAP -> Apache Directory Studio -> JAAS.

Spring security doesn't have much problem. I come into my attention on LDAP when I start configuring Spring security for LDAP. LDAP configuration is real deep advance piece. Base on my experience on learning it, never do it using plain text editor. There are tons jargon I never know when configuring LDAP. Without the help from tools to speed up the configuration, this is a very difficult task for me. Thus Apache Directory Studio playing the primary role on this configuration. I wasn't lucky so, I was downloaded the wrong tool, Apache Directory, without Studio append at the end. There is difference, the studio one allow me to create new configuration whereas the other one doesn't, and only allow me to amend on the existing configuration.

Hey! I just realize that there isn't any web login module using LDAP authentication. May be I should put back myself, where majority of the web authentication are talk to database. Here come to JAAS. Unfortunately there isn't much resource and blog talk about this, I got no choice but try and error to see whether I can find some light on this JAAS thing. As of today, I was totally helpless on the JAAS configuration part. This piece is very dependent on the server configuration. No rush, I start from Tomcat.

Due to the JAAS configuration on Tomcat, I meet realm. This is the mystery piece embedded inside the heart of Tomcat. It is a configurable plugin module that could allow me to have variety type of authentication which is done in JAVA. UserDatabaseRealm is one of it. I haven't finish studying the realm thing.

While I'm still haven't finish with Realm. I meet the fifth technology on authentication module called Apache Shiro. I was quite inspire and attracted by its capability. I will come back on this after I have finish with JAAS.

Losing contact on LDAP server

I made a mistake in LDAP configuration file that would cause this error being shown.

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I have miss configure SLAPD_LDAP=no in /etc/sysconfig/ldap, and this have cause whatever ldap operation like ldapadd and ldapsearch failed with this error.

LDAP configuration made easy with Apache Directory

Since the purpose of setting up LDAP is for personal research and development, it could be much more easier if I do it using ApacheDS and Apache Directory Studio.

Just few simple steps shown below:

1. Download and extract the archive zip/tar.gz.
2. Goto bin directory, execute apacheds program.

The Apache Directory The Apache Directory Project provides directory solutions entirely written in Java. These include a directory server, which has been certified as LDAP v3 compliant by the Open Group (ApacheDS), and Eclipse-based directory tools (Apache Directory Studio).

Configuring LDAP authentication into SVN on AIX

On last week, I have successfully configure Windows Active Directory authentication in our's new SVN server for the whole group of people. I'm feeling so great that I manage to configure this on a UNIX machine, AIX 7.1. Two components required on this setup, subversion, and Apache server. To ensure the correct version has to be install for AIX, I download all dependencies from this site. The installation was handle by rpm, every dependencies are install into /opt/freeware directory, basically not much worry on this, just use the default installation settings.

To configure the Subversion to have HTTP access will require Apache server to do this job for me. Once the Apache server has been installed, additional configuration need to be done on this file, httpd-subversion.conf located at /opt/freeware/etc/httpd/conf/extra. The same file can be used for Active Directory/LDAP authentication configuration, it is just right inside the same < Location > section. 

   
       DAV svn
       SVNParentPath /u01/svn
       SVNListParentPath off
       AuthType Basic
       AuthName "Huahsin Source Code Repository"
       AuthBasicProvider file ldap
       AuthBasicAuthoritative off
       AuthUserFile /opt/freeware/etc/httpd/conf/svn_auth_file
       AuthzLDAPAuthoritative off
       AuthLDAPURL "ldap://128.230.84.53:389/dc=Intralab,dc=java?sAMAccountName?sub"
       AuthLDAPBindDN "CN=TestUser,OU=javagroup,DC=intralab,DC=java"
       AuthLDAPBindPassword Test123
       require valid-user
   

Assuming I'm connecting to an Active Directory server having this IP and port, 128.230.84.53:389, and the JAVA developer locate in the domain java.intranet will be granted access into the SVN. Thus the configuration will look like this.

Extra note on AuthLDAPBindDN and AuthLDAPBindPassword, this is the user account that dedicate for the SVN to get pass into Active Directory server authentication, without this the rest of the authentication will not get pass. AuthBasicProvider file ldap giving an option that first will look for the authentication inside /opt/freeware/etc/httpd/conf/svn_auth_file, if the user wasn't there, look into the Active Directory/LDAP server.