How to add support for StartTls in Spring LDAP

import com.sun.jndi.ldap.LdapClient;

public class Binding extends LdapContextSource {

private SearchControls sc = new SearchControls();
private String base = null;
private static boolean requireServerCertInTrustedStore = false;
private static boolean traceAttributesModification = !true;
private boolean useStartTlsAuth = false;

private final static String[] CLEAR_PARAMS_FOR_STARTTLS = { ".security",
"java.naming.ldap.factory.socket", "com.sun.jndi.ldap.connect.pool"
};

private Hashtable<String,Object> prepareParamsForStartTls(@SuppressWarnings("rawtypes") Hashtable env) {
Hashtable<String,Object> props = new Hashtable<String, Object>();
for (Object k : env.keySet()) {
String key = k.toString();
int hitCount = 0;
for (int i = 0; i < CLEAR_PARAMS_FOR_STARTTLS.length; i++) {
if (key.contains(CLEAR_PARAMS_FOR_STARTTLS[i])) {
hitCount++;
break;
}
}
if (hitCount == 0)
props.put(key, env.get(key));
}
props.put("java.naming.ldap.version", "3");
props.put(Context.SECURITY_PROTOCOL, "plain");
return props;
}

@SuppressWarnings({ "rawtypes", "unchecked" })
@Override
protected DirContext getDirContextInstance(Hashtable env)
throws NamingException {

Hashtable<String,Object> params = prepareParamsForStartTls(env); /* strip pooling and security */
params.put("java.naming.ldap.attributes.binary", "objectSid objectGUID");
final LdapContext ctx = (LdapContext) NamingManager.getInitialContext(params);

StartTlsResponse tlsResp = null;
if (useStartTlsAuth) {
tlsResp = (StartTlsResponse) ctx.extendedOperation(new StartTlsRequest());
tlsResp.setHostnameVerifier(TolerantSSLSocketFactory.TOLERANT_HOSTNAME_VERIFIER);
try {
tlsResp.negotiate(TolerantSSLSocketFactory.INSTANCE);
}
catch (Throwable t) {
throw new NamingException("SSL negotiation for LDAP StartTLS failed: "+t);
}
}
ctx.getEnvironment().putAll(env); /* do not use addToEnvironment because it would reconnect without StartTls */
try {
Field fClient = ctx.getClass().getDeclaredField("clnt");
fClient.setAccessible(true);
LdapClient cli = (LdapClient) fClient.get(ctx);
/* We are over secure channel, need to authenticate now */
Method mAuthenticate = cli.getClass().getDeclaredMethod("authenticate", new Class[] {
boolean.class, String.class, Object.class, int.class, String.class, Control[].class, Hashtable.class
});
mAuthenticate.setAccessible(true);
mAuthenticate.invoke(cli, false, env.get(Context.SECURITY_PRINCIPAL).toString(),
env.get(Context.SECURITY_CREDENTIALS), 3, "simple", null, env);
}
catch (Exception e) {
Throwable t = e;
while (t.getCause() != null)
t = t.getCause();
throw new NamingException("Cannot authenticate due to error: "+t.getMessage());
}
return new InitialLdapContext(env, null) {
@Override
protected Context getDefaultInitCtx() throws NamingException {
/* cache context */
return ctx;
}
};
}

public static boolean isRequiredServerCertInTrustedStore() {
return requireServerCertInTrustedStore;
}

public static void setRequireServerCertInTrustedStore(
boolean requireServerCertInTrustedStore) {
Binding.requireServerCertInTrustedStore = requireServerCertInTrustedStore;
}

public static void setTraceAttributesModification(
boolean traceAttributesModification) {
Binding.traceAttributesModification = traceAttributesModification;
}

public static boolean getTraceAttributesModification() {
return traceAttributesModification;
}

public Binding(String userLogin, String userPassword, String serverUrl, String searchBase) throws Exception {

useStartTlsAuth = serverUrl.startsWith("ldap(s)");
if (useStartTlsAuth) {
serverUrl = "ldap"+serverUrl.substring(7);
setPooled(false);
}
setUserDn(userLogin);
setPassword(userPassword);
setBase(searchBase);
setReferral("follow");
setUrl(serverUrl);
setPooled(true);

HashMap<String,String> props = new HashMap<String, String>();
props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
props.put(Context.SECURITY_AUTHENTICATION, "none");
props.put(Context.SECURITY_AUTHENTICATION, "simple");
props.put(Context.SECURITY_CREDENTIALS, userLogin);
props.put(Context.SECURITY_PRINCIPAL, userPassword);

if (!requireServerCertInTrustedStore) {
props.put("java.naming.ldap.factory.socket", TolerantSSLSocketFactory.class.getName());
}
setCacheEnvironmentProperties(true);
setBaseEnvironmentProperties(props);
setAuthenticationStrategy(new SimpleDirContextAuthenticationStrategy());
afterPropertiesSet();
sc.setSearchScope(SearchControls.SUBTREE_SCOPE);
sc.setCountLimit(0);
sc.setReturningAttributes(null);
sc.setReturningObjFlag(true);
}

public SearchControls getSearchControls() {
return sc;
}

public String getSearchBase() {
return this.base != null ? base : "";
}
}

DSEE 7.0 na NT 6.1

Po rozpakowaniu windowsowej wersji DSEE w katalogu var mamy plik dsee7.war, który należy zadeployować sobie na GlassFishu. Najpierw jednak inicjalizujemy Directory Server i podnosimy cacao.

Cacao używa samodzielnie podpisanego certyfikatu SSL, który nie przejdzie w DCC 7. Dlatego wyeskportujemy certyfikat i zaimportujemy go do keystore'a, którego używa GlassFish.

Linux podpięty do AD

$ cat /etc/openldap/ldap.conf
TLS_REQCERT allow
host 192.168.1.1
base dc=example,dc=com

$ cat /etc/ldap.conf
host 192.168.1.1
uri ldap://ntpdc.example.com
port 389
ssl no
base dc=example,dc=com
scope sub

binddn LDAP@example.com
bindpw haslohaslo

nss_base_passwd dc=example,dc=com?sub
nss_base_shadow dc=example,dc=com?sub
nss_base_group dc=example,dc=com?sub&(objectCategory=group)
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_objectclass posixGroup user
nss_map_attribute gecos name
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute uniqueMember member

pam_password ad
nss_map_attribute userPassword authPassword

$ cat /etc/krb5.conf
[libdefaults]
default_realm = EXAMPLE.COM
clockskew = 300

[realms]
EXAMPLE.COM = {
kdc = ntpdc.example.com
admin_server = ntpdc.example.com
default_domain = example.com
}

[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = FILE:/var/log/krb5/krb5libs.log

[domain_realm]
.example.com = EXAMPLE.COM

[appdefaults]
pam = {
debug = false
ticket_lifetime = 1d
renew_lifetime = 1d
forwardable = true
proxiable = false
minimum_uid = 1
clockskew = 300
external = sshd
use_shmem = sshd
}

$ cat /etc/samba/smb.conf
[global]
workgroup = EXAMPLE
realm = EXAMPLE.COM
preferred master = no
security = ads
encrypt passwords = true
log file = /var/log/samba/%m.log
log level = 3
dos charset = CP1250
unix charset = UTF8
display charset = UTF8
idmap gid = 10000-20000
idmap uid = 10000-20000
template homedir = /home/%D/%U
template shell = /bin/bash
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind nested groups = Yes
winbind refresh tickets = yes
winbind separator = +
passdb backend = tdbsam
idmap backend = ad
winbind nss info = rfc2307

oplocks = yes
max xmit = 65535
dead time = 15
getwd cache = yes
large readwrite = no
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
load printers = no

$ cat /etc/nsswitch.conf
passwd: files winbind ldap
shadow: files windind ldap
group: files winbind ldap

$ nano /etc/pam.d/ [tab]
{auth,account,password} sufficient pam_winbind.so use_first_pass

$ net groupmap add rid=1000 ntgroup="Development" unixgroup=dev type=d
# lepiej zamiast tego nadac grupie nt atrybut gidNumber taki sam jak gid uniksowy

$ nano /etc/samba/smb.conf
[project]
comment = 'Remote project'
path = /home/dev/project
browseable = yes
read only = no
map inherit acl = no
inherit acls = no
inherit permissions = no
create mask = 664
directory mask = 775
valid users = @"EXAMPLE+Development"
admin users = @"EXAMPLE+Domain Admins"
force user = dev
force group = dev

$ cat /etc/apache2/vhosts.d/svn.conf

DAV svn
SVNPath /var/lib/svn/svnrepo
AuthBasicProvider ldap
AuthType Basic
AuthName "Subversion svnrepo repository"

AuthzSVNAccessFile /var/lib/svn/svn-acl

AuthLDAPURL ldap://192.168.1.1:389/OU=IT,dc=example,dc=com?samAccountName?sub?(objectCategory=person)
AuthLDAPBindDN "example\LDAP"
AuthLDAPBindPassword "haslohaslo"

Require valid-user

Zrób to sam: Apache Directory Studio pod Solarisa

Nie ma wersji Apache Directory Studio pod Solarisa, ale można ją zrobić samemu. Ściągamy zwykłego Eclipse'a (pod x86 ciężko będzie go znaleźć, chyba najlepiej zainstalować Blastwave'a (pkgadd -d http://www.blastwave.org/pkg_get.pkg) a potem /opt/csw/bin/pkg-get -i eclipse)). Następnie ściągamy ADS 1.0.1 pod Linuksa, rozpakowujemy i kopiujemy {plugins,features}/org.apache.directory.studio* do solarisowego Eclipse'a.

Pod Eclipsem zmieniamy perspektywę na LDAP i mamy to samo co w Apache Directory Studio.

Problem wynika z tego, że Eclipse używa SWT wymagającego natywnej biblioteki w C.
Pod Windowsem SWT korzysta z WinAPI, pod Linuksem z GTK, pod OSX z Cocoa.
Prawda też jest taka, że Eclipse chodzi najszybciej pod Windowsem i OSX.

Autostart DSEE

Żeby serwer LDAP ładnie wstawał przy starcie systemu (zwłaszcza na słabszej maszynie) trzeba zrobić tak:

• /usr/sbin/cacao enable
• /usr/sbin/smcwebserver enable
• /opt/SUNWdsee/ds6/bin/dsadm enable-service /var/opt/SUNWdsee/dscc6/dcc/ads (włączy DCC)
  
• /opt/SUNWdsee/ds6/bin/dsadm enable-service /instancja-naszego-serwera
• svccfg -s svc:/application/sun/ds, a następnie editprop i zmienić timeouty przy startowaniu i zamykaniu (start/timeout_seconds, stop/timeout_seconds)

I to cała magia.

Gnome + LDAP czyli ciąg dalszy zabawy z DSEE

Po NFSie wystawiany katalogi domowe (/etc/dfs/dfstab + shareall) na serwerze. W DSEE dodajemy auto_master (/home auto_home -nobrowse)
i auto_home (* svr:/export/home/&) - obydwie pozycje z klasy automap. Możemy jeszcze dodać cn=mailhost,ou=hosts,dc=... z klasy ipHost. Na kliencie należy pamiętać o włączeniu svcadm-em serwisów svc:/network/nfs/client:* i autofs.

Skrócony tutorial jak zrobić SSH z autoryzacją LDAP

Potrzebujemy: 1 x Solaris 10, 1 x Sun Directory Server Enterprise Edition 6.x
(z pakietu Sun Communication Suite), 1 x Apache Directory Studio
(świetny produkt oparty na Eclipsie).

Po skonfigurowaniu serwera DNS (tutaj na hoscie 192.168.8.15) instalujemy CommSuite'a.
Konfiguracja autoryzacji po LDAPie jest zrobiona w zonie 192.168.8.150.