You need to set up the search parameters for locating your users in the LDAP directory. The goal is to locate a single user entry that validates the password given during the login process. The LDAP entry located by the user search is later used to map roles and organizations.
One of the most common problems in configuring LDAP for JasperReports Server is setting up the correct search parameters to locate the users you want to map. LDAP is a rich and complex structure, with many possible variations, and LDAP directories tend to grow in complexity over time. In order to successfully map your users from LDAP to JasperReports Server, you need to understand the directory server tree structure of your LDAP server. Be aware that branches can be password protected and a single keyword can be used in different ways in different contexts. It can be helpful to use an open-source LDAP browser, such as Apache Directory Server/Studio or JXplorer, to view and navigate your LDAP directory while troubleshooting LDAP user search problems.
| | Each time a user logs in, their roles and status are updated via your chosen method and synchronized with the internal jasperserver database. If you want to disable an external user or modify their external roles, you must do so in your LDAP directory. |
Configuring JSBindAuthenticator
The sample files use an unnamed bean of class JSBindAuthenticator to encapsulate search parameters for finding users in the LDAP directory.
There are two ways to configure JSBindAuthenticator to locate users:
| • | Configure the userDnPatterns property in the JSBindAuthenticator bean match RDN patterns based on the login name provided by the user. Use this method if the login name appears in the DN of your user entries and your user entries are in a fixed branch of your LDAP directory. See Specifying userDnPatterns Parameters for more information. |
| | Matching patterns is faster because it only checks for a DN in the LDAP directory, instead of performing a search on all users. However, it is less flexible. userDnPatterns is not included in the sample files by default. |
| • | Configure the userSearch helper bean to perform a search for the login name provided by the user. Use this method if the login name is the value of an attribute that does not appear in the RDN, or if your user entries are located in a more complex structure. See Specifying userSearch Parameters for more information. |
You can configure pattern matching and login name search at the same time. Patterns are matched first, and login name search is performed only if no match is found.
To find a user, JSBindAuthenticator takes the login name entered into JasperReports Server and attempts to find the correct user in the LDAP directory using bind authentication, as follows:
| 1. | Using the specified pattern matching or search for the login name, find a candidate user entry. |
| | The LDAP username for this candidate does not have to be the JasperReports Server login name. If they are different, the user in JasperReports Server is assigned the login name given during the login process, and not the LDAP username. |
| 2. | Attempt to log in to the LDAP server using the candidate LDAP username with the login password. |
| 3. | A successful bind indicates that the right user was found. |
Alternative to Bind Authentication
Bind authentication with the JSBindAuthenticator bean is the default behavior when configuring Spring Security for LDAP authentication. However, Spring Security provides an alternate authentication method based on password comparison:
| 1. | Use the administrator credentials in the ldapContextSource bean to log into the LDAP server. |
| 2. | Find a candidate user entry. |
| 3. | Retrieve the candidate’s password attribute and compare it to the login password, or send the login password for comparison by the LDAP server. |
The alternate authentication method is implemented by Spring Security in the PasswordComparisonAuthenticator class. Configuring Spring Security with this class is beyond the scope of this documentation. For more information, see the Spring Security documentation and Javadoc.
Recommended Comments
There are no comments to display.