Single Sign On with JBoss Portal and Active Directory

No one has asked for it but I've begun work on a SSO project when I'm between official projects. I discovered the power of Acegi and CAS. I have an install of the JBoss portal as well and that requires its own set up too... however it is looking like we are going to use Joomla instead.

I began with understanding how to talk to an ldap server (in my case Active Directory). Once I understood how to query LDAP I began searching around using my groovy scripts to find the object classes, and specific names I would need inside my CAS configuration.

I then followed this tutorial for CAS to authenticate the users:

• CAS: LDAP - JA-SIG Wiki

Next I built in the CAS client into JBoss portal using this wiki page's instructions:

• CAS SSO Framework Integration for JBoss Portal

Finding the specific settings were hard. In particular I had to muck about with the ldap_identity-config.xml deep inside our jboss-portal.sar file... it turns out our AD setup is somewhat "special" and needed some extra care beyond what is in this page:

• Configure Portal for MS Active Directory

I have no idea how I would have figured out how to do that kind of configuration without that wiki page.

Once I managed to stitch together both sets of instructions I could have my users authenticate via CAS and then the portal would query roles on its own against Active Directory.

Next I'll investigate how to bring Groovy and Grails into this mix. I'll have a project for delivery in March that will need to hook into this SSO system... and likely subsequent projects to link into the CAS system using PHP and Perl.

helloLDAP.groovy

Here's a short script that I wrote just to test working with an ActiveDirectory server. It's a short hack of a script that you can use to just test settings and the like. Thanks to this script I know I've found the right settings to work with our Microsoft ActiveDirectory server through Java. I could even use this groovy code to set up a Spring Bean service.

#!/usr/bin/env groovy

import java.util.Hashtable
import javax.naming.*
import javax.naming.event.*
import javax.naming.directory.*

def ou = " System and Service Accounts"

// here, we're just reading in some parameters...
def stdin = new BufferedReader(
        new InputStreamReader(System.in)
    )
print "username: " // your username to access LDAP... not a real user
String username = stdin.readLine()
print "password: " // the password for that account...
String passwd = stdin.readLine()

// next we set up an environment for LDAP
Hashtable env = new Hashtable()
env.put(
    Context.INITIAL_CONTEXT_FACTORY,
    "com.sun.jndi.ldap.LdapCtxFactory"
    )
env.put(
    Context.SECURITY_AUTHENTICATION, 
    "EXTERNAL"
    )
/* // if only I had SSL working... *sigh* oh well...
env.put(
    Context.SECURITY_PROTOCOL,
    "ssl"
    ) //*/

// You'll want to put your server's name or IP here:
env.put(
    Context.PROVIDER_URL, 
    "ldap://activedirectoryhost.mycompany.com:636/"
    )

// Here, you'll want to set up your company's parameters for OU and DC...
env.put(
    Context.SECURITY_PRINCIPAL,
    "CN=" + username + ",OU=" + ou + ",DC=mycompany,DC=com"
    ) // username
env.put(
    Context.SECURITY_CREDENTIALS,
    passwd
    ) // and password

// Now we'll try and connect...
try {
    def ctx = new InitialDirContext(env)
    def attr = ctx.getAttributes("")
    def srchInfo = new SearchControls()
    // you'll want to use your own search base
    def searchBase= "OU=company,DC=mycompany,DC=com" 
    // this is the magic search string sauce:
    def searchFilter = "(&(objectClass=person))"
    // we strong type the next var because it is 
    // used in a Java API that needs String[]
    String[] objAttribs=[
        "givenName",
        "cn",
        "sn",
        "mail",
        "mailNickname",
        "userPrincipalName",
        "displayName",
        "manager",
        "department",
        "memberOf"
    ]
    srchInfo.setSearchScope(SearchControls.SUBTREE_SCOPE)
    srchInfo.setReturningAttributes(objAttribs)
    
    // Now we get the results and loop through them...
    NamingEnumeration dirObjects = ctx.search(searchBase,searchFilter,srchInfo)
    def nodirObjects = 0
    while (dirObjects != null && dirObjects.hasMoreElements()) {
        def dirObject = dirObjects.next()
        println("'" + dirObject.getName() + "':")
        def attrs = dirObject.getAttributes()
        for(name in objAttribs) {
            println "\t * " + attrs.get(name)
        }
        nodirObjects++ 
    }
    ctx.close()
    println("Number of entries identified: " + nodirObjects)
} catch (Exception e) {
    println "Exception: " + e
}