Difference between revisions of "Active Directory - OpenKM 4.1"
From OpenKM Documentation
(Created page with '== Basic configuration == This is the suggested configuration that should be used when roles and users are both defined in same node,otherside refer to advanced configuration. T…') |
m (moved Active Directory OpenKM 4.1 to Active Directory - OpenKM 4.1) |
||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
| − | |||
| − | |||
| − | |||
To configure Active Directory we must make some changes in [[OpenKM.cfg]] configuration file and in login-config.xml file that can be found at ''$JBOSS_HOME/server/default/conf''. For both changes you need to restart JBoss server. | To configure Active Directory we must make some changes in [[OpenKM.cfg]] configuration file and in login-config.xml file that can be found at ''$JBOSS_HOME/server/default/conf''. For both changes you need to restart JBoss server. | ||
| Line 8: | Line 5: | ||
<source lang="java"> | <source lang="java"> | ||
system.login.lowercase=on | system.login.lowercase=on | ||
| − | principal.adapter= | + | principal.adapter=es.git.openkm.principal.LdapPrincipalAdapter |
principal.ldap.server=ldap://192.168.0.6 | principal.ldap.server=ldap://192.168.0.6 | ||
| Line 16: | Line 13: | ||
principal.ldap.user.search.base=cn=users,dc=weyler,dc=local | principal.ldap.user.search.base=cn=users,dc=weyler,dc=local | ||
principal.ldap.user.search.filter=(objectclass=person) | principal.ldap.user.search.filter=(objectclass=person) | ||
| − | principal.ldap.user. | + | principal.ldap.user.atribute=cn |
principal.ldap.role.search.base=cn=users,dc=weyler,dc=local | principal.ldap.role.search.base=cn=users,dc=weyler,dc=local | ||
principal.ldap.role.search.filter=(objectclass=group) | principal.ldap.role.search.filter=(objectclass=group) | ||
| − | principal.ldap.role. | + | principal.ldap.role.atribute=cn |
principal.ldap.mail.search.base=cn={0},cn=users,dc=weyler,dc=local | principal.ldap.mail.search.base=cn={0},cn=users,dc=weyler,dc=local | ||
principal.ldap.mail.search.filter=(objectclass=person) | principal.ldap.mail.search.filter=(objectclass=person) | ||
| − | principal.ldap.mail. | + | principal.ldap.mail.atribute=mail |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
</source> | </source> | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
In case of Active directory ( windows ) it's important that all users login be in lower case, for it purpose we enable | In case of Active directory ( windows ) it's important that all users login be in lower case, for it purpose we enable | ||
| Line 82: | Line 57: | ||
</application-policy> | </application-policy> | ||
</source> | </source> | ||
| + | |||
| + | {{Note|Take care if your ldap server is configured under ssl then you should use ldaps://}} | ||
If you want to restrict the user who can log into OpenKM, you should change these two property in OpenKM.cfg: | If you want to restrict the user who can log into OpenKM, you should change these two property in OpenKM.cfg: | ||
| Line 113: | Line 90: | ||
[[Category: Installation Guide]] | [[Category: Installation Guide]] | ||
| − | |||
Latest revision as of 19:36, 1 December 2012
To configure Active Directory we must make some changes in OpenKM.cfg configuration file and in login-config.xml file that can be found at $JBOSS_HOME/server/default/conf. For both changes you need to restart JBoss server.
OpenKM.cfg file example ( you must change 192.168.0.6, Administrador, password and weyler values to your active directory values )
system.login.lowercase=on
principal.adapter=es.git.openkm.principal.LdapPrincipalAdapter
principal.ldap.server=ldap://192.168.0.6
principal.ldap.security.principal=CN=Administrator,cn=users,dc=weyler,dc=local
principal.ldap.security.credentials=password
principal.ldap.user.search.base=cn=users,dc=weyler,dc=local
principal.ldap.user.search.filter=(objectclass=person)
principal.ldap.user.atribute=cn
principal.ldap.role.search.base=cn=users,dc=weyler,dc=local
principal.ldap.role.search.filter=(objectclass=group)
principal.ldap.role.atribute=cn
principal.ldap.mail.search.base=cn={0},cn=users,dc=weyler,dc=local
principal.ldap.mail.search.filter=(objectclass=person)
principal.ldap.mail.atribute=mail
In case of Active directory ( windows ) it's important that all users login be in lower case, for it purpose we enable
system.login.lowercase=on
property in OpenKM.cfg. The reason is so simply, Windows not makes any difference between upper or lower case validating user name credentials.
login-config.xml file example ( you must change 192.168.0.6, Administrador, password and weyler values to your active directory values )
<application-policy name="OpenKM">
<authentication>
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required" >
<module-option name="java.naming.provider.url">ldap://192.168.0.6</module-option>
<module-option name="bindDN">CN=Administrador,cn=users,dc=weyler,dc=local</module-option>
<module-option name="java.naming.security.authentication">simple</module-option>
<module-option name="bindCredential">password</module-option>
<module-option name="baseCtxDN">cn=users,dc=weyler,dc=local</module-option>
<module-option name="baseFilter">(sAMAccountName={0})</module-option>
<module-option name="rolesCtxDN">cn=users,dc=weyler,dc=local</module-option>
<module-option name="roleFilter">(member={1})</module-option>
<module-option name="roleAttributeID">cn</module-option>
<module-option name="roleAttributeIsDN">false</module-option>
<module-option name="roleRecursion">2</module-option>
<module-option name="searchScope">ONELEVEL_SCOPE</module-option>
<module-option name="defaultRole">UserRole</module-option>
<module-option name="allowEmptyPasswords">false</module-option>
</login-module>
</authentication>
</application-policy>
 |
Take care if your ldap server is configured under ssl then you should use ldaps:// |
If you want to restrict the user who can log into OpenKM, you should change these two property in OpenKM.cfg:
principal.ldap.user.search.filter=(&(objectclass=user)(memberOf=CN=UserRole,CN=users,DC=weyler,DC=local))
principal.ldap.role.search.filter=(&(objectclass=group)(memberOf=CN=OpenKM,CN=users,DC=weyler,DC=local))
This means that only users within the UserRole groups will be shown as valid OpenKM users, and only roles which are included in the OpenKM group will be shown in OpenKM.
Also add this option one in login-config.xml:
<module-option name="baseFilter">(&(sAMAccountName={0})(memberOf=CN=UserRole,CN=users,DC=weyler,DC=local))</module-option>
And remove this one:
<module-option name="defaultRole">UserRole</module-option>
All this means that only users member of the UserRole groups are able to log into OpenKM.
|
If you see an exception like this:
javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'cn=users,dc=weyler,dc=local' read these articles: |
