Page Comparison

Current File(s): conf/authn/password-authn-config.xml, conf/ldap.properties, conf/authn/authn.properties
Format: Native Spring, Properties

...

Expand

title	Properties

A number of properties are found in ldap.properties to configure LDAP authentication global defaults. Most of the time, this is sufficient to deal with most configurations without having to delve into modifying any beans, unless you're trying to chain together separately configured back-ends.

Note that the big "override everything" hook tends to be the idp.authn.LDAP.authenticator property, as most of the other properties auto-configure specific aspects of one of the built-in Authenticator beans.

Property	Type	Default	Function
idp.authn.LDAP.authenticator	Enumeration	anonSearchAuthenticator	Controls the workflow for how authentication occurs against the LDAP, one of: anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
idp.authn.LDAP.ldapURL	LDAP URI		Connection URI for LDAP directory.
idp.authn.LDAP.useStartTLS	Boolean	true	Whether StartTLS should be used after connecting with LDAP alone.
idp.authn.LDAP.connectTimeout	Duration	PT3S	Time to wait for the TCP connection to occur.
idp.authn.LDAP.responseTimeout	Duration	PT3S	Time to wait for an LDAP response message. (Applies to every request .)except startTLS)
idp.authn.LDAP.startTLSTimeout	Duration	PT3S	Time to wait for a startTLS response message.
idp.authn.LDAP.connectionStrategy	Enumeration	ACTIVE_PASSIVE	Connection strategy to use when multiple URLs are supplied, one of ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
idp.authn.LDAP.sslConfig	Enumeration	certificateTrust	How to establish trust in the server's TLS certificate, one of: jvmTrust, certificateTrust, or keyStoreTrust
idp.authn.LDAP.trustCertificates	Resource path		A resource to load trust anchors from, usually a local file in %{idp.home}/credentials
idp.authn.LDAP.trustStore	Resource path		A resource to load a Java keystore containing trust anchors, usually a local file in %{idp.home}/credentials
idp.authn.LDAP.returnAttributes	Comma-sep'd Strings		List of attributes to request during authentication
idp.authn.LDAP.baseDN	String		Base DN to search against, used by anonSearchAuthenticator, bindSearchAuthenticator
idp.authn.LDAP.subtreeSearch	Boolean	false	Whether to search recursively, used by anonSearchAuthenticator, bindSearchAuthenticator
idp.authn.LDAP.userFilter	String		LDAP search filter, used by anonSearchAuthenticator, bindSearchAuthenticator
idp.authn.LDAP.bindDN	String		DN to bind with during search, used by bindSearchAuthenticator
idp.authn.LDAP.bindDNCredential	String		Password to bind with during search, used by bindSearchAuthenticator, usually set via %{idp.home}/credentials/secrets.properties
idp.authn.LDAP.dnFormat	String		A formatting string to generate the user DNs to authenticate, used by directAuthenticator, adAuthenticator
idp.authn.LDAP.resolveEntryOnFailure	Boolean	false	Whether the user's LDAP entry should be returned in the authentication response even when the user bind fails.
idp.authn.LDAP.resolveEntryWithBindDN	Boolean	false	Whether the user's LDAP entry should be resolved with the bindDN credentials rather than as the authenticated user.
idp.authn.LDAP.usePasswordPolicy	Boolean	false	Whether to use the Password Policy Control.
idp.authn.LDAP.usePasswordExpiration	Boolean	false	Whether to use the Password Expired Control.
idp.authn.LDAP.activeDirectory	Boolean	false	If you are using Active Directory, this switch will attempt to use the account states defined by AD. Note that this flag is unnecessary if you are using the 'adAuthenticator'. It is meant to be specified with one of the other authenticator types.
idp.authn.LDAP.freeIPADirectory	Boolean	false	If you are using the FreeIPA LDAP, this switch will attempt to use the account states defined by that product.
idp.authn.LDAP.eDirectory	Boolean	false	If you are using the EDirectory LDAP, this switch will attempt to use the account states defined by that product.
idp.authn.LDAP.disablePooling	Boolean	false	Whether connection pools should be used for LDAP connections used for authentication.
idp.pool.LDAP.minSize	Integer	3	Minimum LDAP connection pool size
idp.pool.LDAP.maxSize	Integer	10	Maximum LDAP connection pool size
idp.pool.LDAP.validateOnCheckout	Boolean	false	Whether to validate connections when checking them out of the pool
idp.pool.LDAP.validatePeriodically	Boolean	true	Whether to validate connections in the background
idp.pool.LDAP.validatePeriod	Duration	PT5M	Duration between validation, if idp.pool.LDAP.validatePeriodically is true
idp.pool.LDAP.validateDN	String		DN to search with the validateFilter, default is the rootDSE
idp.pool.LDAP.validateFilter	String	(objectClass=*)	Search filter to execute in order to validate a pooled connection
idp.pool.LDAP.prunePeriod	Duration	PT5M	Duration between looking for idle connections to reduce the pool back to its minimum size
idp.pool.LDAP.idleTime	Duration	PT10M	Duration connections must be idle to be eligible for pruning
idp.pool.LDAP.blockWaitTime	Duration	PT3S	Duration to wait for a free connection in the pool
idp.authn.LDAP.bindPoolPassivator	Enumeration	none	Controls how connections in the bind pool are passivated. Connections in the bind pool may be in an authenticated state that will not allow validation searches to succeed. This property controls how bind connections are placed back into the pool. If your directory requires searches to be performed by the idp.authn.LDAP.bindDN or anonymously, this property controls that behavior. one of: none, bind, anonymousBind.

...

Expand

title	Attribute Retrieval

LDAP attributes are returned as part of the authentication process and exposed in the LDAPResponseContext.

Property	Sample	Result
idp.authn.LDAP.returnAttributes	uid, eduPersonAffiliation	Returns the uid and eduPersonAffiliation attributes.
	*	Returns all user attributes on the entry.
	*,+	Returns all user and operational attributes on the entry.
	1.1	No attribute returned. No search performed.

By default, attributes will be searched for using the same connection the user authenticated on. Therefore the user must have read on any attributes for those to be returned.

If you need access to attributes that user does not have read access to, then you must configure a connection pool that is authorized to read that data. The following configuration demonstrates how to add a new connection pool for that purpose.

Spring Configuration

Code Block

language	xml

<!-- Modify the authenticator to use the entry resolver -->
<bean name="anonSearchAuthenticator" class="org.ldaptive.auth.Authenticator" p:entryResolver-ref="bindSearchEntryResolver">
...
 
<!-- Add an entry resolver to read attributes -->
<bean id="bindSearchEntryResolver" class="org.ldaptive.auth.PooledSearchEntryResolver" p:connectionFactory-ref="entryResolverPooledConnectionFactory" />
<bean id="entryResolverPooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory" p:connectionPool-ref="entryResolverConnectionPool" />
<bean id="entryResolverConnectionPool" class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool" p:connectionFactory-ref="entryResolverConnectionFactory" p:name="entry-resolver-pool" />
<bean id="entryResolverConnectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="entryResolverConnectionConfig" />
<bean id="entryResolverConnectionConfig" parent="connectionConfig" p:connectionInitializer-ref="entryResolverConnectionInitializer" />
<bean id="entryResolverConnectionInitializer" class="org.ldaptive.BindConnectionInitializer" p:bindDn="%{idp.authn.LDAP.entryResolver.bindDN}">
    <property name="bindCredential">
        <bean class="org.ldaptive.Credential">
            <constructor-arg value="%{idp.authn.LDAP.entryResolver.bindDNCredential}" />
        </bean>
    </property>
</bean>

Add the idp.authn.LDAP.entryResolver.bindDN and idp.authn.LDAP.entryResolver.bindDNCredential properties to conf/ldap.properties and credentials/secrets.properties respectively. Then set idp.authn.LDAP.authenticator to anonSearchAuthenticator. to complete the configuration.

Note: if you're using the bindSearchAuthenticator and those credentials can be reused for entry resolution, then this configuration can be shortened by wiring the bindPooledConnectionFactory to the entry resolver.

...

Versions Compared

Old Version 2

New Version 3

Key

Spring Configuration