I am trying to get Grails LDAP plugin to work with my Active Directory.
The plugin requires a lot of things which I'm not really familiar with as I don't know much about Active Directory.
Here are the things required by the plugin:
// LDAP config
grails.plugins.springsecurity.ldap.context.managerDn = '[distinguishedName]'
grails.plugins.springsecurity.ldap.context.managerPassword = '[password]'
grails.plugins.springsecurity.ldap.context.server = 'ldap://[ip]:[port]/'
grails.plugins.springsecurity.ldap.authorities.ignorePartialResultException = true // typically needed for Active Directory
grails.plugins.springsecurity.ldap.search.base = '[the base directory to start the search. usually something like dc=mycompany,dc=com]'
grails.plugins.springsecurity.ldap.search.filter="sAMAccountName={0}" // for Active Directory you need this
grails.plugins.springsecurity.ldap.search.searchSubtree = true
grails.plugins.springsecurity.ldap.auth.hideUserNotFoundExceptions = false
grails.plugins.springsecurity.ldap.search.attributesToReturn = ['mail', 'displayName'] // extra attributes you want returned; see below for custom classes that access this data
grails.plugins.springsecurity.providerNames = ['ldapAuthProvider', 'anonymousAuthenticationProvider'] // specify this when you want to skip attempting to load from db and only use LDAP
// role-specific LDAP config
grails.plugins.springsecurity.ldap.useRememberMe = false
grails.plugins.springsecurity.ldap.authorities.retrieveGroupRoles = true
grails.plugins.springsecurity.ldap.authorities.groupSearchBase ='[the base directory to start the search. usually something like dc=mycompany,dc=com]'
// If you don't want to support group membership recursion (groups in groups), then use the following setting
// grails.plugins.springsecurity.ldap.authorities.groupSearchFilter = 'member={0}' // Active Directory specific
// If you wish to support groups with group as members (recursive groups), use the following
grails.plugins.springsecurity.ldap.authorities.groupSearchFilter = '(member:1.2.840.113556.1.4.1941:={0})' // Active Directory specific
I'm using Windows 2008 Server and know the following:
IP = 10.10.10.90
Name = bold.foo.bar (This is what I see under Active Directory Users and Computers)
Domain =`BOLD`
Group = `MANAGERS`
Users = USERA (part of MANAGERS group) and USERB (not part of MANAGERS group)
Question
Can I get some help on filling in some/most of the configurations required? I have access to the Active Directory Domain Services in Server Manager so if most of the information will come out of there, I can get it.
PS: I don't have the luxury of a Sys Admin helping me on this. So I'm the developer left filling both roles :)
search.searchSubtree
,search.filter
) others will depend upon your environment's configuration, these appear to be in square brackets. Which line specifically are you not sure about? Your title mentions "LDAP connection string" but you've got about 20 lines of config here.