Wednesday, 18 November 2015

LDAP in AEM 6.x

Starting in Adobe Experience Manager 6.0, there has been a significant change in the way LDAP Authentication is managed. Rather than using the jaas.conf file of earlier releases, AEM 6.0 comes with Jackrabbit Oak, which has its own LDAP integration. Although the Apache Jackrabbit developershave provided documentation for configuring the system, we felt that it would be helpful if we could provide an example of this configuration.
There are three things we need to configure in Adobe Experience Manager: the LdapIdentityProvider, a DefaultSyncHandler, and an ExternalLoginModule. While in these examples we will be using the Felix Console, we at Axis41 always recommend that all Production OSGi configurations be saved in your source code repository, and become a regular part of your deployment process.
You should take the time to understand all the options in each configuration; however, we will be focusing on the options that you most likely will need to configure.

Apache Jackrabbit Oak LDAP Identity Provider (LdapIdentityProvider)

LdapIdentityProvider
provider.nameThe “idp.name” we will provide to the ExternalLoginModule
host.nameThe host where your LDAP server is running
bind.dnThe Distinguished Name (DN) to bind to LDAP with
bind.passwordThe username to bind to LDAP with
user.baseDNThe LDAP DN that is the base for user accounts that will be allowed to authenticate with AEM
user.objectclassThe LDAP objectclass for user objects that will be allowed to authenticate with AEM
user.idAttributeThe LDAP attribute that will determine the AEM username
group.baseDNThe LDAP DN that is the base for group objects that will be searched by AEM

Apache Jackrabbit Oak Default Sync Handler (DefaultSyncHandler)

DefaultSyncHandler
handler.nameThe “sync.handlerName” we will provide to the ExternalLoginModule
user.expirationTimeHow long after synchronization a user object should be considered valid
user.autoMembershipSynchronized users will automatically be added to this group.
user.propertyMappingA String[] of “key=value” pairs; keys will be the AEM property name, values the LDAP property which will be copied.
user.pathPrefixLocation where synced users will be stored; the value will be appended to /home/users.
group.pathPrefixLocation where synced groups will be stored; the value will be appended to /home/groups.

Apache Jackrabbit Oak External Login Module (ExternalLoginModule)

ExternalLoginModule
idp.nameprovider.name from the LdapIdentityProvider
sync.handlerNamehandler.name from the DefaultSyncHandler

What it looks like after it syncs

One of the things we found to be a surprise was the name Adobe Experience Manager chooses for the node as it syncs the user from LDAP. Here’s a CRXDE Lite view of a set of objects created using the OSGi configs I shared above. You can see the machine-generated name of both the user and group nodes after the sync took place.
crxde

No comments :

Post a comment