Stian Lund [http://community.jboss.org/people/pathduck] created the discussion
"Re: Integrate JBoss 6 to AD - map groups to roles?" To view the discussion, visit: http://community.jboss.org/message/615127#615127 -------------------------------------------------------------- Hello Ashutosh and thanks for the replies. After a lot of trial and error I have made it work with the following application policy. <!-- Application policy for ActiveDirectory --> <application-policy name="ActiveDirectory"> <authentication> <login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required" > <module-option name="java.naming.provider.url">ldap://ldaphost:389/</module-option> <module-option name="bindDN">CN=xxx,OU=xxx,DC=xxx,DC=xxx</module-option> <module-option name="bindCredential">xxx</module-option> <module-option name="baseCtxDN">OU=Users,OU=xxx,OU=xxx,DC=xxx,DC=xxx</module-option> <module-option name="baseFilter">(sAMAccountName={0})</module-option> <module-option name="rolesCtxDN">OU=Groups,OU=xxx,OU=xxx,DC=xxx,DC=xxx</module-option> <module-option name="roleFilter">(member={1})</module-option> <module-option name="roleAttributeID">CN</module-option> <module-option name="allowEmptyPasswords">false</module-option> </login-module> <login-module code="org.jboss.security.auth.spi.RoleMappingLoginModule" flag="required" > <module-option name="password-stacking">useFirstPass</module-option> <module-option name="rolesProperties">props/roles.properties</module-option> </login-module> </authentication> </application-policy> The file roles.properties contains the mapping of AD groups to roles. This way I can map the application policy to be used in jboss-web.xml for the different apps (and admin/jmx-console) without having to edit the names of the application roles. I have not however managed to map single users to roles, only groups, so I might look into the other module you posted. Thanks for your help. BTW allowEmptyPasswords is NASTY! :D -------------------------------------------------------------- Reply to this message by going to Community [http://community.jboss.org/message/615127#615127] Start a new discussion in Beginner's Corner at Community [http://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2075]
_______________________________________________ jboss-user mailing list [email protected] https://lists.jboss.org/mailman/listinfo/jboss-user
