Authenticating users via LDAP

HCL Domino Domino Forum
1

I have a Tomcat server that I want to set up a JNDI realm for LDAP to my domino server.

I need to have the servlet user authenticated by our domino server keeping a single point of user management with the other resources available to them.

I am having trouble getting this working.

Here is the realm snippet from my server.xml file in my tomcat.

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"

	connectionURL="ldap://192.168.168.21:389"

	userPattern="uid={0},dc=my-actual-company-here,dc=com"

roleBase="ou=groups,dc=my-actual-company-here,dc=com"

roleName="cn"

roleSearch="(uniqueMember={0})"

/>

What am I missing?

Notes:

I do have the user currently accessing a HTML file located on the domino server with authentication but now my management would like to have the user name logged with each access. Since this information is not available via JavaScript I need to transfer the authentication to the tomcat server via LDAP.

2

Subject: Authenticating users via LDAP

I have a Tomcat server that I want to set up a JNDI realm for LDAP to my domino server.

I need to have the servlet user authenticated by our domino server keeping a single point of user management with the other resources available to them.

I am having trouble getting this working.

Here is the realm snippet from my server.xml file in my tomcat.

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"

	connectionURL="ldap://192.168.168.21:389"

	userPattern="uid={0},dc=my-actual-company-here,dc=com"

roleBase="ou=groups,dc=my-actual-company-here,dc=com"

roleName="cn"

roleSearch="(uniqueMember={0})"

/>

What am I missing?

Notes:

I do have the user currently accessing a HTML file located on the domino server with authentication but now my management would like to have the user name logged with each access. Since this information is not available via JavaScript I need to transfer the authentication to the tomcat server via LDAP.

I am not familiar with Tomcat or its notation above for authentication and roles, but you will have to be familiar with how your Domino directory entries are organized and named.

Domino uses neither UIDs nor DCs in its names. We use X500’s CNs, OUs, and Os.

Domino groups are traditionally located in the base of the naming hierarchy (i.e., flat names)

Assuming you wanted to find Domino people like cn=Ken Lin/ou=Westford/o=IBM and groups like cn=Iris Directory Team, my guess would then be that you need something like …

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"

	connectionURL="ldap://192.168.168.21:389"

	userPattern="cn={0},ou=Westford,o=IBM"

roleBase=""

roleName="cn"

roleSearch="(uniqueMember={0})"

/>