Integrating AD with web application running on Tom

2019-06-09 21:55发布

问题:

Am trying to change my web application using AD for authentication. My application uses Tomcat 5.5.17. Currently it uses UserDatabaseRealm to authenticate users of the application. After reading many posts here, I used the following configuration in server.xml. (Since am just getting started, I didn't bother about roles).

But when I actually do try to login, i seem to get this error. (I used JXplorer to navigate through ActiveDirectory and hence I know that the URL works)

 javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece
    INFO   | jvm 1    | 2009/12/21 08:55:31 |   at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3045)
    INFO   | jvm 1    | 2009/12/21 08:55:31 |   at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2951)
    INFO   | jvm 1    | 2009/12/21 08:55:31 |   at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2758)
    INFO   | jvm 1    | 2009/12/21 08:55:31 |   at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1812)

Any ideas about where am getting it wrong?

Thanks K

回答1:

Thanks for the response.

I figured out that the ldap server that I was connecting to requires a binding user name and password, which when supplied it worked

For people who need it, here is how my config looks

 <Realm className="org.apache.catalina.realm.CustomLdapUserRealm"
                    debug="99"
            userBase="ou=xx,ou=xx,ou=xx,DC=xx,DC=xx,DC=xx"
            userSearch="(sAMAccountName={0})"
                    connectionURL="ldap://xxx:389"
                    digest="MD5"
                    roleName="cn"
                    roleBase="ou=xx,ou=xx,ou=xx,DC=xx,DC=xx,DC=xx"
                    userRoleName="xx" 
                    />

In CustomLdapUserRelam, i supplied the binding user name and password. Also in my web.xml i had to give permission to the roles that I would receive from LDAP