https://issues.apache.org/bugzilla/show_bug.cgi?id=57209
Bug ID: 57209
Summary: JNDIRealm userSearch does not work against active
directory with roles
Product: Tomcat 7
Version: 7.0.57
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: jasonmcint...@carfax.com
JNDIRealm without connectionPassword/connectionName on role lookups - role
search as user does not work as intended. If you want to search the system as
the logged in user for roles:
userBase = DC=Company,DC=com
userSearch = (&(objectCategory=person)(sAMAccountName={0}))
userSubTree = true
This works fine and you can bind as a user, but searching fails. Search fails
because there's no user credentials to bind with and binding anonymously is
disabled. If you have isRoleSearchAsUser turned on the expectation
protected User getUser(DirContext context, String username, String credentials,
int curUserPattern)
does not add the binding user credentials for searching. A VERY simple fix
around line 1297 is to do the following so that searches work with the bound
user:
// Use pattern or search for user entry
if (userPatternFormatArray != null && curUserPattern >= 0) {
user = getUserByPattern(context, username, credentials,
attrIds, curUserPattern);
}
else {
if (isRoleSearchAsUser()) {
userCredentialsAdd(context, username, credentials);
}
user = getUserBySearch(context, username, attrIds);
}
There's probably a cleaner way to do this, but this is how I've managed to get
things working at this point. I'd imagine a property "userSearchDNPattern"
could be added so that you can specify the pattern for the DN to bind with.
And switch the "userCredentialsAdd" to use that userSearchDNPattern" instead.
With the above fix binding as a user and role lookups now work. Another option
is to change "roleSearchAsUser" to something that says "do all operatins with
the authenticated user, assuming he's authorized"
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
