Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add LDAP plugin configuration to JAAS login.config #96

Merged

Conversation

guidograzioli
Copy link
Member

@guidograzioli guidograzioli commented Sep 7, 2023

The following new parameters allows to configure a secondary (sufficient) or primary (required) LDAP authentication endpoint.

Variable Description Default
activemq_auth_properties_enabled Whether to enable property based JAAS config True
activemq_auth_ldap_enabled Whether to enable LDAP based JAAS config False
activemq_auth_ldap_url URL for LDAP server connection ldap://localhost:389
activemq_auth_ldap_conn_username Bind username for LDAP server uid=admin,ou=system
activemq_auth_ldap_conn_password Bind user password for LDAP server password
activemq_auth_ldap_conn_codec Optional password codec class for bind user password {{ activemq_password_codec }}
activemq_auth_ldap_conn_protocol Protocol for LDAP connection s
activemq_auth_ldap_auth Type of LDAP server authentication simple
activemq_auth_ldap_user_base Base for user search ou=Users,dc=example,dc=com
activemq_auth_ldap_user_search User attribute (uid={0})
activemq_auth_ldap_user_search_subtree Whether to enable subtree user search True
activemq_auth_ldap_role_base Base for role search ou=Groups,dc=example,dc=com
activemq_auth_ldap_role_name Role attribute cn
activemq_auth_ldap_role_search Role search attribute (member={0})
activemq_auth_ldap_role_search_subtree Whether to enable subtree role search False

Example:

    activemq_hawtio_role: Scientists
    activemq_auth_ldap_enabled: True
    activemq_auth_ldap_url: ldap://ldap.forumsys.com:389
    activemq_auth_ldap_conn_username: uid=tesla,dc=example,dc=com
    activemq_auth_ldap_conn_password: password
    activemq_auth_ldap_user_base: dc=example,dc=com
    activemq_auth_ldap_user_search: '(uid={0})'
    activemq_auth_ldap_role_base: dc=example,dc=com
    activemq_auth_ldap_role_name: cn
    activemq_auth_ldap_role_search: '(uniqueMember={0})'
    activemq_auth_ldap_role_search_subtree: True
    activemq_users:
      - user: amq
        password: amqbrokerpass
        roles: [ admin ]
      - user: other
        password: amqotherpass
        roles: [ consumer, producer ]
    activemq_roles:
      - name: admin
        permissions: [ createNonDurableQueue, deleteNonDurableQueue, createDurableQueue, deleteDurableQueue, createAddress, deleteAddress, consume, browse, send, manage ]
      - name: Scientists
        permissions: [ createNonDurableQueue, deleteNonDurableQueue, createDurableQueue, deleteDurableQueue, createAddress, deleteAddress, consume, browse, send, manage ]

It will authenticate and authorized LDAP users in the "Scientists" group; in addition to amq and other defined in property files.

Fix #80

@guidograzioli guidograzioli added the minor_changes New parameters added to modules, or non-breaking behavior changes to existing parameters; no bugfix label Sep 7, 2023
@guidograzioli guidograzioli changed the title add ldap plugin configuration to login.config Add ldap plugin configuration to login.config Sep 7, 2023
@guidograzioli guidograzioli changed the title Add ldap plugin configuration to login.config Add ldap plugin configuration to JAAS login.config Sep 7, 2023
@guidograzioli guidograzioli merged commit db9a5e8 into ansible-middleware:main Sep 7, 2023
14 checks passed
@guidograzioli guidograzioli changed the title Add ldap plugin configuration to JAAS login.config Add LDAP plugin configuration to JAAS login.config Sep 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
minor_changes New parameters added to modules, or non-breaking behavior changes to existing parameters; no bugfix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Provide a custom login.config
1 participant