Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to get Grails LDAP plugin to work with my Active Directory.

The plugin requires a lot of things which I'm not really familiar with as I don't know much about Active Directory.

Here are the things required by the plugin:

// LDAP config
grails.plugins.springsecurity.ldap.context.managerDn = '[distinguishedName]'
grails.plugins.springsecurity.ldap.context.managerPassword = '[password]'
grails.plugins.springsecurity.ldap.context.server = 'ldap://[ip]:[port]/'
grails.plugins.springsecurity.ldap.authorities.ignorePartialResultException = true // typically needed for Active Directory
grails.plugins.springsecurity.ldap.search.base = '[the base directory to start the search.  usually something like dc=mycompany,dc=com]'
grails.plugins.springsecurity.ldap.search.filter="sAMAccountName={0}" // for Active Directory you need this
grails.plugins.springsecurity.ldap.search.searchSubtree = true
grails.plugins.springsecurity.ldap.auth.hideUserNotFoundExceptions = false
grails.plugins.springsecurity.ldap.search.attributesToReturn = ['mail', 'displayName'] // extra attributes you want returned; see below for custom classes that access this data
grails.plugins.springsecurity.providerNames = ['ldapAuthProvider', 'anonymousAuthenticationProvider'] // specify this when you want to skip attempting to load from db and only use LDAP

// role-specific LDAP config
grails.plugins.springsecurity.ldap.useRememberMe = false
grails.plugins.springsecurity.ldap.authorities.retrieveGroupRoles = true
grails.plugins.springsecurity.ldap.authorities.groupSearchBase ='[the base directory to start the search.  usually something like dc=mycompany,dc=com]'
// If you don't want to support group membership recursion (groups in groups), then use the following setting
// grails.plugins.springsecurity.ldap.authorities.groupSearchFilter = 'member={0}' // Active Directory specific
// If you wish to support groups with group as members (recursive groups), use the following
grails.plugins.springsecurity.ldap.authorities.groupSearchFilter = '(member:1.2.840.113556.1.4.1941:={0})' // Active Directory specific

I'm using Windows 2008 Server and know the following:

IP = 10.10.10.90
Name = bold.foo.bar (This is what I see under Active Directory Users and Computers)
Domain =`BOLD`
Group = `MANAGERS`
Users = USERA (part of MANAGERS group) and USERB (not part of MANAGERS group)

Question

Can I get some help on filling in some/most of the configurations required? I have access to the Active Directory Domain Services in Server Manager so if most of the information will come out of there, I can get it.

PS: I don't have the luxury of a Sys Admin helping me on this. So I'm the developer left filling both roles :)

share|improve this question
    
Some of these are already filled out (search.searchSubtree, search.filter ) others will depend upon your environment's configuration, these appear to be in square brackets. Which line specifically are you not sure about? Your title mentions "LDAP connection string" but you've got about 20 lines of config here. –  jscott Feb 22 '13 at 2:40
add comment

2 Answers 2

Active Directory Explorer (AdExplorer) utility from Microsoft Windows Sysinternals suite can help you find out DN and Search Base information you needed.

AD Explorer

But it's better to get some LDAP concepts to get more control, for example, you want to add more search.filter or to get more attributes (search.attributesToReturn) in search results (you want to get user's phoneNumber too). Useful links:

share|improve this answer
add comment

From your config:

grails.plugins.springsecurity.ldap.context.managerDn = '[distinguishedName]'

Put the distinguishedName (DN) of the manager user here. If I was the manager, the value would be 'CN=jason scott,OU=staff,OU=isc,DC=example,DC=org' If you have RSAT/Powershell, you could get my user DN with the following: (Get-ADUser jscott).distinguishedName else go into dsa.msc and look at the properties of the user object.

grails.plugins.springsecurity.ldap.context.managerPassword = '[password]'

Put the password of the user specified above. You should probably create a grails manger specific AD user for this now that I think of it.

grails.plugins.springsecurity.ldap.context.server = 'ldap://[ip]:[port]/'

Something like 'ldap://10.10.10.90:389' for LDAP or 'ldap://10.10.10.90:636' for LDAP+SSL, depends on your config. Well behaved AD/LDAP integrations can use the domain name here as it will return each of the DCs. If this works, it's preferable as you don't need to update the IP in the URL if your DCs change 'ldap://bold.foo.bar:389' or 'ldap://bold.foo.bar:636'

grails.plugins.springsecurity.ldap.authorities.ignorePartialResultException = true // typically needed for Active Directory

Looks ok to me, not sure if you need partial result exceptions to bubble up.

grails.plugins.springsecurity.ldap.search.base = '[the base directory to start the search.  usually something like dc=mycompany,dc=com]'

Where to start searching for LDAP users. This should be an OU, CN or domain root. For example 'OU=staff,OU=isc,DC=example,DC=org' would start searches in the "staff" OU under the "ISC" OU within the "example.org" domain. 'DC=bold,DC=foo,DC=bar' would start searches from your domain root.

grails.plugins.springsecurity.ldap.search.filter="sAMAccountName={0}" // for Active Directory you need this

Looks ok to me, unless you users use a different attibute for logons.

grails.plugins.springsecurity.ldap.search.searchSubtree = true

Looks ok to me, unless you want to disable sub-Tree searches -- you probably don't.

grails.plugins.springsecurity.ldap.auth.hideUserNotFoundExceptions = false

Looks ok to me, unless you.... never mind, just leave it at default.

grails.plugins.springsecurity.ldap.search.attributesToReturn = ['mail', 'displayName'] // extra attributes you want returned; see below for custom classes that access this data

If you know you need more attributes from the AD user, add them to this array. Else, you're good.

grails.plugins.springsecurity.providerNames = ['ldapAuthProvider', 'anonymousAuthenticationProvider'] // specify this when you want to skip attempting to load from db and only use LDAP

Looks ok to me.

// role-specific LDAP config
grails.plugins.springsecurity.ldap.useRememberMe = false

Looks ok to me.

grails.plugins.springsecurity.ldap.authorities.retrieveGroupRoles = true

Looks ok to me.

grails.plugins.springsecurity.ldap.authorities.groupSearchBase ='[the base directory to start the search.  usually something like dc=mycompany,dc=com]'

Just like the user search base above, this is where to start group searches. Some ADs keep users and groups in separate CNs/OUs. You may just try your domain root here 'DC=bold,DC=foo,DC=bar'

// If you wish to support groups with group as members (recursive groups), use the following
grails.plugins.springsecurity.ldap.authorities.groupSearchFilter = '(member:1.2.840.113556.1.4.1941:={0})' // Active Directory specific

You almost certainly want recursive (nested) group look-ups, unless your domain has parent groups which are also within their own child groups.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.