LDAP Authentication for COEUS Premium and Coeus Lite

Transcription

1 LDAP Authentication for COEUS Premium and Coeus Lite Presented by: Pradeep Frederick, Dartmouth College and Eunissa Yancy, University of Maryland, Baltimore

2 LDAP - COEUS supports Light Weight Directory Access Protocol Authentication (LDAP) - LDAP is a popular authentication system - Currently the University of Maryland- Baltimore, Dartmouth College, Brown University, Purdue University etc. authenticate COEUS via LDAP.

3 Files to be customized 1. Authentication.xml Full Path : /Source/WEB-INF/classes/Authentication.xml 2. coeus.properties Full Path: /Source/WEB-INF/classes/coeus.properties 3. LDAPAuthService.java Full Path: /Source/WEB-INF/classes/edu/mit/coeus /user/auth/ldapauthservice.java

4 Authentication.xml Baseline Code for LDAP <LDAP clientsideauthclass="edu.mit.coeus.user.auth.clientauthservicehelper" serversideauthclass="edu.mit.coeus.user.auth.umdldapauthservice"> <PROPERTY name="ldap_context_factory" value="com.sun.jndi.ldap.ldapctxfactory"/> <PROPERTY name="ldap_provider_url" value=""/> <PROPERTY name="ldap_domain_base" value=""/> <PROPERTY name="ldap_security_auth_mode" value=""/> <PROPERTY name="ldap_security_protocol" value=""/> <PROPERTY name="ldap_filter_uid_name" value=""/> <PROPERTY name="coeus_ldap_admin_dn" value=""/> <PROPERTY name="coeus_ldap_admin_credentials" value=""/> </LDAP>

5 Changes to Authentication.xml <LDAP clientsideauthclass="edu.mit.coeus.user.auth.clientauthservicehelper" serversideauthclass="edu.mit.coeus.user.auth.ldapauthservice" loginscreen="true"> <PROPERTY name="ldap_context_factory" value="com.sun.jndi.ldap.ldapctxfactory"/> <PROPERTY name="ldap_provider_url" value= String Value of LDAP Server Address:389/"/> <!-- Context.PROVIDER_URL --> <PROPERTY name="ldap_domain_base" value="dc=dartmouth,dc=edu"/> <PROPERTY name="ldap_security_auth_mode" value="simple"/> <!-- Context.SECURITY_AUTHENTICATION --> <PROPERTY name="ldap_security_protocol" value="none"/> <!-- Context.SECURITY_PROTOCOL => ssl none --> <PROPERTY name="ldap_filter_uid_name" value="cn"/> <PROPERTY name="coeus_ldap_admin_dn" value=""/> <PROPERTY name="coeus_ldap_admin_credentials" value=""/> </LDAP>

6 Changes to coeus.properties LDAP Authentication for Coeus Premium SWING_LOGIN_MODE=LDAP LDAP Authentication for Coeus Lite LOGIN_MODE=LDAP

7 Changes to LDAPAuthService.java - If the LDAP user id entered from the login screen is exactly the SAME as the COEUS userid, then NO changes are required in this file. - If the above case is not true, more work needs to be done. (next few slides explain this scenario)

8 Overcoming the 8 character user id barrier - COEUS has a 8 character userid limitation - Dartmouth s LDAP userids are much longer - USER_ID field in OSP$USER is only 8 characters long - Several Stored Procedures access the USER_ID field - The USER_ID field is also a foreign key in several COEUS tables - COEUS base code imposes that the userid entered via the login screen should be the same as the internal Coeus User Id. (The value in the USER_ID field in OSP$USER).

9 Dartmouth s Mapping Solution A mapping function to translate the userid entered via the screen to the internal COEUS user id Derive the internal Coeus User Id from the screen-entered credentials after authentication Propagate the derived internal Coeus User id further down the application Will involve changes to the appropriate authentication class (LDAPAuthService.java)

10 LDAPAuthService.java - Dartmouth Link to LDAPAuthService.java code (Dartmouth College version)

11 A possible architecture for mapping legacy userids to Coeus User Id Document explaining a possible generic mapping scheme to map legacy authentication userids to 8 character COEUS userids

12 UMB s Mapping Solution Created a new Directory attribute that was unique and limited to 8 characters UMB called this attribute umbcoeusid LDAPAuthService. authenticate() method was modified in order to store umbcoeusid as the internal COEUS user id instead of the actual login name used during authentication

13 UMB Changes to LDAPAuthService. authenticate() 88a88,91 > // BEGIN UMB Changes 03/28/07 by E. Yancy > // variable to hold the non-changing userid stored in the UMB Directory > String umbcoeusid = null; > // END UMB Changes 03/23/07 by E. Yancy 118a122,127 > // BEGIN UMB Changes 03/28/07 by E. Yancy > // retrieve the umbcoeusid attribute from the UMB Directory > umbcoeusid = (String)attrs.get("umbCOEUSid").get(); > UtilFactory.log("userDN = " + userdn); > UtilFactory.log("umbCoeusId = " + umbcoeusid); > // END UMB Changes 03/28/07 by E. Yancy

14 UMB Changes to LDAPAuthService. authenticate() 161,163c174,186 < setresponseforweb(userid);//for web < else < setresponse(userid);//for swing --- > // BEGIN UMB Changes 03/28/07 by E. Yancy > // Use the umbcoeusid as the person's id in Coeus instead of the > // userid the person used to log in with > //setresponseforweb(userid);//for web > setresponseforweb(umbcoeusid);//for web > // END UMB Changes 03/28/07 by E. Yancy > else > // BEGIN UMB Changes 03/28/07 by E. Yancy > // Use the umbcoeusid as the person's id in Coeus instead of the > // userid the person used to log in with > //setresponse(userid);//for swing > setresponse(umbcoeusid);//for swing > // END UMB Changes 03/28/07 by E. Yancy

15 UMB LDAPAuthService.java Link to LDAPAuthService.java source code (UMB version)

16 Pros/Cons When Considering to Use LDAP Authentication Method Does the Coeus Super User account move to Active Directory? No, but you will need to create an admin account in your LDAP Server for authenticated searches. This admin account will need rights to search your directory for the Distinguished Name (DN) of a user. If the user is found, then the LDAP authentication method tries to bind to your LDAP server using the credentials entered in the Coeus Login screen by the end user. Do we still have to create/maintain user accounts in Oracle, and assign roles to them? No, you do not need to create/maintain user accounts in Oracle. You will just create Coeus users and assign roles and rights to them via the Coeus application.

17 Pros/Cons When Considering to Use LDAP Authentication Method Are there other issues which we need to be aware of? Yes. Schools have different LDAP servers and your set-up may be slightly different than another schools. MIT has created a generic LDAP authentication class, but you may need to tweak it depending on your server configuration. What are its advantages over simple authentication? At UMB, everyone associated with our school is entered into our LDAP directory. The advantage for us is that we do not need to maintain Oracle users. Also, all of our applications authenticate against the LDAP directory. Therefore, end-users only need to remember 1 user name and 1 password.

18 Pros/Cons When Considering to Use LDAP Authentication Method Configuring Coeus for LDAP Is that process relatively simple or difficult? For UMB, Coeus 4.2 provided an LDAP authentication configuration process that was relatively simple to set-up. How much time should one plan to spend making it work? One should plan to spend at least a week on making it work. If you would are lucky, all you have to do is enter the appropriate information in the Authentication.xml and coeus.properties file and LDAP authentication will work without any problems. However, this was not our experience, mainly because we did not configure our directory in the standard manner.

19 Pros/Cons When Considering to Use LDAP Authentication Method For those using LDAP with Coeus Are there problems such as losing connectivity with the active directory server(s)? UMB is not having this problem. Once we worked out the kinks with our particular set-up, we have had no problems with LDAP authentication. Is there a mechanism within Coeus to handle redundancy? UMB purchased a load balancer. Behind the load balancer are 3 Directory Servers. The load balancer is configured to have one aliased address (ds.umaryland.edu) that points to 3 different Directory Servers. This is the URL we use to configure Coeus to use LDAP authentication.