<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: SpringOne 2GX Sample Apps &#8211; Spring Security LDAP Login</title>
	<atom:link href="http://burtbeckwith.com/blog/?feed=rss2&#038;p=228" rel="self" type="application/rss+xml" />
	<link>http://burtbeckwith.com/blog/?p=228</link>
	<description>Burt Beckwith's Java Blog</description>
	<lastBuildDate>Thu, 26 Aug 2010 12:11:31 -0400</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Bob White</title>
		<link>http://burtbeckwith.com/blog/?p=228&#038;cpage=1#comment-31474</link>
		<dc:creator>Bob White</dc:creator>
		<pubDate>Tue, 11 May 2010 00:11:55 +0000</pubDate>
		<guid isPermaLink="false">http://burtbeckwith.com/blog/?p=228#comment-31474</guid>
		<description>I am using STS.  I found it necessary, after installing the acegi plugin and running &quot;create-auth-domains&quot; to right-click on the project, select Grails Tools -&gt; Refresh Dependencies.</description>
		<content:encoded><![CDATA[<p>I am using STS.  I found it necessary, after installing the acegi plugin and running &#8220;create-auth-domains&#8221; to right-click on the project, select Grails Tools -&gt; Refresh Dependencies.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Bob White</title>
		<link>http://burtbeckwith.com/blog/?p=228&#038;cpage=1#comment-31219</link>
		<dc:creator>Bob White</dc:creator>
		<pubDate>Wed, 05 May 2010 04:13:43 +0000</pubDate>
		<guid isPermaLink="false">http://burtbeckwith.com/blog/?p=228#comment-31219</guid>
		<description>Oh, and thanks a million to Burt for this article!</description>
		<content:encoded><![CDATA[<p>Oh, and thanks a million to Burt for this article!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Bob White</title>
		<link>http://burtbeckwith.com/blog/?p=228&#038;cpage=1#comment-31218</link>
		<dc:creator>Bob White</dc:creator>
		<pubDate>Wed, 05 May 2010 04:11:32 +0000</pubDate>
		<guid isPermaLink="false">http://burtbeckwith.com/blog/?p=228#comment-31218</guid>
		<description>In an ideal situation, one knows exactly what LDAP values to use with one&#039;s LDAP database.  I did not.

I was using Active Directory.  Here are the values I eventually ended up using in my SecurityConfig.groovy class:
	useLdap = true
	ldapServer = &#039;ldap://myADserver:389&#039;
	ldapManagerDn = &#039;mydomain\\myuser&#039;
	ldapManagerPassword = &#039;myPrivatePasswd&#039;
	ldapSearchBase = &#039;OU=Someplace,DC=corp,DC=myCompany,DC=com&#039;
	ldapSearchFilter = &#039;(sAMAccountName={0})&#039;
	ldapGroupSearchBase = &#039;OU=Users,DC=corp,DC=myCompany,DC=com&#039;
	ldapGroupSearchFilter = &#039;(member={0})&#039;
	ldapUsePassword = false

I never got the ldapGroup query to return any values, but that may be because my company does not use them that way. Instead, there was a &quot;memberOf&quot; attribute in the LDAP entry for each user.  (I don&#039;t know if this is a standard, a best practice or just what my company uses).

To set breakpoints in spring code, one must first download the appropriate sources jars and link to them in STS. I downloaded the jars (see below) and put them in my c:\grails-1.2.2\lib folder.

For the acegi plugin sources, I downloaded the plugin as a zip and put it in c:\grails-plugins.

To link to them, one has to know the class names of the relevant Spring classes.

Jar files:
  spring-security-core-2.0.4-sources.jar
  spring-ldap-1.2.1-sources.jar

Relevant classes &amp; methods:
  org.springframework.security... 


...ldap.SpringSecurityLdapTemplate.searchForSingleEntry()

...ldap.SpringSecurityLdapTemplate.searchForSingleAttributeValues()

...providers.ldap.authenticator.BindAuthenticator.bindWithDn()

...userdetails.ldap.LdapUserDetailsMapper.mapUserFromContext()

org.springframework.ldap.core.LdapTemplate.search()
 
And from the acegi plugin zip:
  grails-acegi-0.5.3.zip

org.codehaus.groovy.grails.plugins.springsecurity...

...GrailsDaoImpl.loadUserByUserName()

...ldap.GrailsUserDetailsMapper.mapUserFromContext()

I hope this helps somebody get started debugging using LDAP with the grails-acegi plugin.</description>
		<content:encoded><![CDATA[<p>In an ideal situation, one knows exactly what LDAP values to use with one&#8217;s LDAP database.  I did not.</p>
<p>I was using Active Directory.  Here are the values I eventually ended up using in my SecurityConfig.groovy class:<br />
	useLdap = true<br />
	ldapServer = &#8216;ldap://myADserver:389&#8242;<br />
	ldapManagerDn = &#8216;mydomain\\myuser&#8217;<br />
	ldapManagerPassword = &#8216;myPrivatePasswd&#8217;<br />
	ldapSearchBase = &#8216;OU=Someplace,DC=corp,DC=myCompany,DC=com&#8217;<br />
	ldapSearchFilter = &#8216;(sAMAccountName={0})&#8217;<br />
	ldapGroupSearchBase = &#8216;OU=Users,DC=corp,DC=myCompany,DC=com&#8217;<br />
	ldapGroupSearchFilter = &#8216;(member={0})&#8217;<br />
	ldapUsePassword = false</p>
<p>I never got the ldapGroup query to return any values, but that may be because my company does not use them that way. Instead, there was a &#8220;memberOf&#8221; attribute in the LDAP entry for each user.  (I don&#8217;t know if this is a standard, a best practice or just what my company uses).</p>
<p>To set breakpoints in spring code, one must first download the appropriate sources jars and link to them in STS. I downloaded the jars (see below) and put them in my c:\grails-1.2.2\lib folder.</p>
<p>For the acegi plugin sources, I downloaded the plugin as a zip and put it in c:\grails-plugins.</p>
<p>To link to them, one has to know the class names of the relevant Spring classes.</p>
<p>Jar files:<br />
  spring-security-core-2.0.4-sources.jar<br />
  spring-ldap-1.2.1-sources.jar</p>
<p>Relevant classes &amp; methods:<br />
  org.springframework.security&#8230; </p>
<p>&#8230;ldap.SpringSecurityLdapTemplate.searchForSingleEntry()</p>
<p>&#8230;ldap.SpringSecurityLdapTemplate.searchForSingleAttributeValues()</p>
<p>&#8230;providers.ldap.authenticator.BindAuthenticator.bindWithDn()</p>
<p>&#8230;userdetails.ldap.LdapUserDetailsMapper.mapUserFromContext()</p>
<p>org.springframework.ldap.core.LdapTemplate.search()</p>
<p>And from the acegi plugin zip:<br />
  grails-acegi-0.5.3.zip</p>
<p>org.codehaus.groovy.grails.plugins.springsecurity&#8230;</p>
<p>&#8230;GrailsDaoImpl.loadUserByUserName()</p>
<p>&#8230;ldap.GrailsUserDetailsMapper.mapUserFromContext()</p>
<p>I hope this helps somebody get started debugging using LDAP with the grails-acegi plugin.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Bob White</title>
		<link>http://burtbeckwith.com/blog/?p=228&#038;cpage=1#comment-31166</link>
		<dc:creator>Bob White</dc:creator>
		<pubDate>Mon, 03 May 2010 20:52:19 +0000</pubDate>
		<guid isPermaLink="false">http://burtbeckwith.com/blog/?p=228#comment-31166</guid>
		<description>I got the sample app working, and am now trying to bind to my corporate LDAP server.  I think the bind is failing because I cannot login using my username/password (credentials I know to be correct).  However, although I can get DEBUG logging messages from springsecurity when the authentication request fails, I am not getting any debug messages regarding binding.

I think the parameters I am using in SecurityConfig.groovy are wrong, but I cannot debug them without visibility.

I would love to set breakpoints and walk through the spring code, but I cannot figure out how to do this using STS. I can hit breakpoints in my code and select acegi plugin classes, but not in spring code (e.g. org.springframework.security.providers.ldap.authenticator.BindAuthenticator.java).</description>
		<content:encoded><![CDATA[<p>I got the sample app working, and am now trying to bind to my corporate LDAP server.  I think the bind is failing because I cannot login using my username/password (credentials I know to be correct).  However, although I can get DEBUG logging messages from springsecurity when the authentication request fails, I am not getting any debug messages regarding binding.</p>
<p>I think the parameters I am using in SecurityConfig.groovy are wrong, but I cannot debug them without visibility.</p>
<p>I would love to set breakpoints and walk through the spring code, but I cannot figure out how to do this using STS. I can hit breakpoints in my code and select acegi plugin classes, but not in spring code (e.g. org.springframework.security.providers.ldap.authenticator.BindAuthenticator.java).</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: John Cee</title>
		<link>http://burtbeckwith.com/blog/?p=228&#038;cpage=1#comment-27480</link>
		<dc:creator>John Cee</dc:creator>
		<pubDate>Wed, 24 Feb 2010 01:35:59 +0000</pubDate>
		<guid isPermaLink="false">http://burtbeckwith.com/blog/?p=228#comment-27480</guid>
		<description>Hi Burt,
Really good tutorial. Thanks! We have a couple thousand users we&#039;d like to authenticate and authorize against an LDAP server. Is there any way to avoid having to duplicate those users in the database? We&#039;d like to authorize and authenticate just from LDAP and if a user has a matching entry in the database to include those roles as well.
Regards,
John</description>
		<content:encoded><![CDATA[<p>Hi Burt,<br />
Really good tutorial. Thanks! We have a couple thousand users we&#8217;d like to authenticate and authorize against an LDAP server. Is there any way to avoid having to duplicate those users in the database? We&#8217;d like to authorize and authenticate just from LDAP and if a user has a matching entry in the database to include those roles as well.<br />
Regards,<br />
John</p>
]]></content:encoded>
	</item>
</channel>
</rss>
