Configuring Tomcat to authenticate using Windows Active Directory

Question

What is the best way to configure Tomcat 5.5 or later to authenticate users from Windows Active Directory?

Answer 1

From www.jspwiki.org

See : ActiveDirectoryIntegration

Try this in the server.xml with your ldap-settings :

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"     connectionURL="ldap://youradsserver:389"     alternateURL="ldap://youradsserver:389"              userRoleName="member"     userBase="cn=Users,dc=yourdomain"     userPattern="cn={0},cn=Users,dc=yourdomain"     roleBase="cn=Users,dc=yourdomain"     roleName="cn"     roleSearch="(member={0})"     roleSubtree="false"     userSubtree="true"/> 

And define the role in the tomcat-users.xml and the web.xml of your application

Edit webapp_root/WEB_INF/Web.xml file as follows:

<security-constraint>    <display-name>your web app display name</display-name>    <web-resource-collection>      <web-resource-name>Protected Area</web-resource-name>      <url-pattern>*.jsp</url-pattern>      <url-pattern>*.html</url-pattern>      <url-pattern>*.xml</url-pattern>    </web-resource-collection>    <auth-constraint>      <role-name>yourrolname(ADS Group)</role-name>    </auth-constraint>  </security-constraint>  <login-config>    <auth-method>FORM</auth-method>    <form-login-config>      <form-login-page>/login.jsp</form-login-page>      <form-error-page>/error.jsp</form-error-page>    </form-login-config>  </login-config>  <security-role>    <description>your role description</description>    <role-name>yourrolename(i.e ADS group)</role-name>  </security-role>