2

Struggling to get ActiveMQ web console to use LDAP and authenticated against Active Directory. No errors when starting MQ, username/password login box prompt appears but doesn't progress when inserting the correct credentials.

Version 5.15.6

login.config

amqLdapLoginModule {
   org.eclipse.jetty.jaas.spi.LdapLoginModule required
   debug="true"
   contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
   hostname="ad-server1.domain.com"
   port="389"
   bindDn="CN=readonly-user,OU=Accounts,DC=domain,DC=com"
   bindPassword="readonly-user-password"
   authenticationMethod="simple"
   forceBindingLogin="false"
   userBaseDn="CN=users,DC=domain,DC=com"
   userRdnAttribute="uid"
   userIdAttribute="uid"
   userPasswordAttribute="userPassword"
   userObjectClass="inetOrgPerson"
   roleBaseDn="CN=groups,DC=domain,dc=com"
   roleNameAttribute="cn"
   roleMemberAttribute="uniqueMember"
   roleObjectClass="groupOfUniqueNames";
   };

jetty.xml

    <bean id="ldapLoginService" class="org.eclipse.jetty.jaas.JAASLoginService">
        <property name="name" value="LdapRealm" />
        <property name="loginModuleName" value="amqLdapLoginModule" />
        <property name="roleClassNames" value="org.eclipse.jetty.jaas.JAASRole" />
        <property name="identityService" ref="identityService" />
    </bean>
    <bean id="identityService" class="org.eclipse.jetty.security.DefaultIdentityService"/>

    <bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
        <property name="name" value="BASIC" />
        <property name="roles" value="admins-group" />
        <!-- set authenticate=false to disable login -->
        <property name="authenticate" value="true" />
    </bean>
    <bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
        <property name="name" value="BASIC" />
        <property name="roles" value="admins-group" />
         <!-- set authenticate=false to disable login -->
        <property name="authenticate" value="true" />
    </bean>


    <bean id="securityHandlerLdap" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
        <property name="loginService" ref="ldapLoginService" />
        <property name="identityService" ref="identityService" />
        <property name="realmName" value="LdapRealm" />
        <property name="authenticator">
            <bean class="org.eclipse.jetty.security.authentication.BasicAuthenticator" />
        </property>
        <property name="constraintMappings">
            <list>
                <ref bean="adminSecurityConstraintMapping" />
                <ref bean="securityConstraintMapping" />
            </list>
        </property>
        <property name="handler" ref="secHandlerCollection" />
    </bean>

    <bean id="contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection">
    </bean>

1 Answer 1

0

Following the guide from http://bacedifo.blogspot.com/2013/06/securing-activemq-580-web-console-using.html and using the ldaptive ldap java library with some tweaks to the configs I managed to get this working for our AD environment.

Copied the ldaptive-{version number}.jar and jetty-jass-{version number}.jar to /activemq/lib directory.

login.conf

activemq {
    org.ldaptive.jaas.LdapLoginModule required
        debug=true
        storePass="true"
        ldapUrl="ldap://ldap-server1.domainname.com:389 ldap://ldap-server2.domainname.com:389"
        connectionStrategy="ACTIVE_PASSIVE"
        bindDn="CN=ldap-readaccount,OU=Read Accounts,DC=domainname,DC=com"
        baseDn="OU=accounts,DC=domainname,DC=com"
        bindCredential="ldapuser-password"
        useStartTLS="false"
        userFilter="(sAMAccountName={user})";

    org.ldaptive.jaas.LdapRoleAuthorizationModule required
        useFirstPass="true"
        ldapUrl="ldap://ldap-server1.domainname.com:389 ldap://ldap-server2.domainname.com:389"
        connectionStrategy="ACTIVE_PASSIVE"
        bindDn="CN=ldap-readaccount,OU=Read Accounts,DC=domainname,DC=com"
        baseDn="OU=groups,DC=domainname,DC=com"
        bindCredential="ldapuser-password"
        roleFilter="(&(cn=webconsoleadmins)(member={user}))"
        useStartTLS="false"
        defaultRole="admins"
        roleAttribute="cn";

};

jetty.xml

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

<bean id="securityLoginService" class="org.eclipse.jetty.jaas.JAASLoginService">
    <property name="name" value="LdapRealm" />
    <property name="loginModuleName" value="activemq" />
    <property name="roleClassNames" value="org.ldaptive.jaas.LdapRole" />
    <property name="identityService" ref="identityService" />
</bean>
<bean id="identityService" class="org.eclipse.jetty.security.DefaultIdentityService"/>


<bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
    <property name="name" value="BASIC" />
    <property name="roles" value="admins,webconsoleadmins" />
    <!-- set authenticate=false to disable login -->
    <property name="authenticate" value="true" />
</bean>
<bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
    <property name="name" value="BASIC" />
    <property name="roles" value="admins,webconsoleadmins" />
     <!-- set authenticate=false to disable login -->
    <property name="authenticate" value="true" />
</bean>

...

<bean id="securityHandler" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
    <property name="loginService" ref="securityLoginService" />
    <property name="identityService" ref="identityService" />
    <property name="authenticator">
        <bean class="org.eclipse.jetty.security.authentication.BasicAuthenticator" />
    </property>
    <property name="constraintMappings">
        <list>
            <ref bean="adminSecurityConstraintMapping" />
            <ref bean="securityConstraintMapping" />
        </list>
    </property>
    <property name="handler" ref="secHandlerCollection" />
</bean>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.