Menu
What is the best way to configure Tomcat 5.5 or later to authenticate users from Windows Active Directory?
623
The client must be configured to use Kerberos authentication. For Internet Explorer this means making sure that the Tomcat instance is in the "Local intranet" security domain and that it is configured (Tools > Internet Options > Advanced) with integrated Windows authentication enabled.
You can use Windows authentication when your IIS 7 server runs on a corporate network that is using Microsoft Active Directory service domain identities or other Windows accounts to identify users. Because of this, you can use Windows authentication whether or not your server is a member of an Active Directory domain.
From www.jspwiki.org
See : ActiveDirectoryIntegration
Try this in the server.xml with your ldap-settings :
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99" connectionURL="ldap://youradsserver:389" alternateURL="ldap://youradsserver:389" userRoleName="member" userBase="cn=Users,dc=yourdomain" userPattern="cn={0},cn=Users,dc=yourdomain" roleBase="cn=Users,dc=yourdomain" roleName="cn" roleSearch="(member={0})" roleSubtree="false" userSubtree="true"/> And define the role in the tomcat-users.xml and the web.xml of your application
Edit webapp_root/WEB_INF/Web.xml file as follows:
<security-constraint> <display-name>your web app display name</display-name> <web-resource-collection> <web-resource-name>Protected Area</web-resource-name> <url-pattern>*.jsp</url-pattern> <url-pattern>*.html</url-pattern> <url-pattern>*.xml</url-pattern> </web-resource-collection> <auth-constraint> <role-name>yourrolname(ADS Group)</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>FORM</auth-method> <form-login-config> <form-login-page>/login.jsp</form-login-page> <form-error-page>/error.jsp</form-error-page> </form-login-config> </login-config> <security-role> <description>your role description</description> <role-name>yourrolename(i.e ADS group)</role-name> </security-role> If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
