In implementation that supports multiple organizations, all users and roles except for system administrators and system roles belong to organizations. In turn, each organization determines the folders that its users can access in the repository. So the final part of mapping is to determine an organization ID for the external user and roles, based on the user’s RDN in the directory.

If your JasperReports Server supports multiple organizations, you have two ways to set the user organization for external users:

If your JasperReports Server deployment supports only a single organization (all community deployments and some professional editions), you do not need to set organization information.

Mapping to Multiple Organizations

LDAP is well suited to mapping users into organizations, because LDAP itself has a hierarchical structure of user entries that's often used to represent separate organizations, such as the internal departments of a company. The LDAP tree structure is reflected in the elements of the RDN of each user entry, and the server maps this RDN into an organization or hierarchy of organizations for the external user. For example, the users uid=jack,ou=audit,ou=finance,dc=example,dc=com and uid=jill,ou=accounting,ou=finance,dc=example,dc=com could be mapped to the organizations audit and accounting, respectively, both of which are sub-organizations of finance.

In order to ensure consistency, the server must create the organization of any external user if the organization does not already exist. The server also creates any organization that does not exist in the hierarchy of organizations mapped from the user RDN. To avoid “stray” organizations outside of your intended hierarchy, test your mapping against all potential user DNs in your LDAP directory.

Organizations created during external user login have an administrator with a default password. The admin username and password is configurable. See Setting Up Default Admins for Organizations for more information. For security reasons, you should change the default password of any organization admin created. See Initialization of JasperReports Server for External Users for a process to initialize the server, including organization admins, before going into production with external authentication.

Setting Up Organization Mapping

Specify the following information in the ldapExternalTenantProcessor bean to map the RDN of the user to a hierarchy of organizations in JasperReports Server:

The following example shows the syntax of the ldapExternalTenantProcessor bean and its properties:

                         o      ou          [/code]

...</bean>[/code]                    

For example, given the ldapExternalTenantProcessor bean configuration above, an LDAP user with the DN uid=jack,ou=audit,ou=finance, dc=example,dc=com is placed in a organization named audit which is a child of an organization named finance, which in turn is a child of organization_1. This example illustrates that it's not possible to map only one of the two RDN components if they have the same attribute. In other words, the mapping mechanism does not let you choose to create only the audit or the finance organization; both are created if you specify ou in the list of organizationRDNs.

Setting Up Default Admins for Organizations

In a multi-organization deployment, JasperReports Server creates a jasperadmin user whenever you create a new organization. The jasperadmin user is also given a standard default password. When creating multiple organizations using external authentication, you can set a different default password for jasperadmin, remove the jasperadmin user, and/or create additional default users in each new organization created by external authentication. Optionally, you can encrypt the password in the configuration files. See the JasperReports Server Security Guide for more information on default users in every organization.

To set up admin users:

                                                      ROLE_ADMINISTRATOR          ROLE_USER                    [/code]                    

    <bean class="com.jaspersoft.jasperserver.multipleTenancy.security.                 externalAuth.processors.MTAbstractExternalProcessor.ExternalTenantSetupUser">      <property name="username" value="${new.tenant.user.name.2}"/>      <property name="fullName" value="${new.tenant.user.fullname.2}"/>      <property name="password" value="${new.tenant.user.password.2}"/>      <property name="emailAddress" value="${new.tenant.user.email.2}"/>[/code]                    

      <property name="roleSet">        <set>          <value>ROLE_ADMINISTRATOR</value>          <value>ROLE_USER</value>        </set>      </property>    </bean>[/code]                    

<js-install>buildomaticconf_sourceieProjs.config.properties file.

To set these values, open <js-install>buildomaticconf_sourceieProjs.config.properties and edit the entries there.

new.tenant.user.name.1=jasperadminnew.tenant.user.fullname.1=jasperadminnew.tenant.user.password.1=mynewpasswordnew.tenant.user.email.1=[/code]

new.tenant.user.name.2=anotheradminnew.tenant.user.fullname.2=Another Adminnew.tenant.user.password.2=anotherpasswordnew.tenant.user.email.2=[/code]                    

Note: The property names, for example, new.tenant.user.name.1, are arbitrary. You can use any name for each property as long as the name in the applicationContext-externalAuth-xxx.xml file matches the name in the js.config.properties file.

      <property name="username" value="anotheradmin"/>      <property name="fullName" value="Another Admin"/>      <property name="password" value="anotherpassword"/>      <property name="emailAddress" value=""/>[/code]                    

Mapping Organization Names

You have the option to use the organizationMap property in the ldapExternalTenantProcessor bean to map organization names extracted from your external authority to organization names in JasperReports Server. To do this, create a key/value pair for each organization you want to map, specifying the external organization name as the key and the organization name in JasperReports Server as the value. When mapping organizations, the server determines the mapped name and uses it as the name, ID, and description of the organization.

For example, the following would map users in External_Org_1 in the external authority to JRS_Org_1 in JasperReports Server and users in External_Org_2 in the external authority to JRS_Org_2 in JasperReports Server:

    <property name="organizationMap">        <map>            <entry key="External_Org_1" value="JRS_Org_1" />            <entry key="External_Org_2" value="JRS_Org_2" />        </map>    </property>[/code]                    

The organizationMap property is optional. Any organization in your external authority that is not listed in organizationMap is mapped to an organization of the same name in JasperReports Server. However, if an organization in your external authority contains unsupported characters, each sequence of unsupported characters is replaced with a single underscore. For example, Human Resources maps to Human_Resources.

The tenantIdNotSupportedSymbols property of the configurationBean bean in the applicationContext.xml file lists the unsupported characters, including spaces and the following characters: |, &, *, ?, <, >, /, , ~, !, #, $, %, ^, [, ], or a space. If you want to list additional characters that should be replaced with an underscore, you can add them in this bean. However, we do not recommend removing any of the pre-defined characters, as JasperReports Server may not handle them correctly.

Mapping to a Single Organization

If you have a commercial version of JasperReports Server, you can choose to map all external users to a single organization, for example, in the following cases:

The following steps show how to map all external users to a single organization using the sample-applicationContext-externalAuth-LDAP-mt.xml file:

The following example places all external users in the default organization, organization_1.

<bean id="ldapExternalTenantProcessor"         class="com.jaspersoft.jasperserver.multipleTenancy.security.              externalAuth.processors.ldap.LdapExternalTenantProcessor"         parent="abstractExternalProcessor">  <property name="ldapContextSource" ref="ldapContextSource"/>  <property name="multiTenancyService"><ref bean="internalMultiTenancyService"/></property>  <property name="excludeRootDn" value="true"/>  <property name="defaultOrganization" value="organization_1"/></bean>[/code]                    

Open topic with navigation