Java TM LDAP Dynamic Group Realm Sample Application

  Samples Index



LDAP Dynamic Group Realm Sample Application

This document describes an LDAP Dynamic Group realm based security application in the Sun Java System Application Server 8.1 2005Q1.

This document contains the following sections:



Overview

The LDAP Dynamic Group Realm Sample Application demonstrates:

The application described here defines an enterprise bean and an application client. The methods of the enterprise bean have been associated with either the Administrator or the SecretRole in the enterprise bean deployment descriptor. The idea is to associate the Administrator role with a dynamic LDAP group, called ldapdynamicgroup.Then the application client verifies that usernames belonging to the ldapdynamicgroup group have access to methods of the EJB that have been associated with the Administrator role, while access to methods not associated with that role will be denied.

To associate the Administrator role with the dynamic group ldapdynamicgroup of an LDAP server, we follow these basic steps:

  1. Create a username sjsasuser, with password password, on a given LDAP server. The first entry in the setup/sjsas8.samples.ldif can be imported into an LDAP server to accomplish this requirement.
  2. Create a dynamic group named ldapdynamicgroup in the LDAP server so that its dynamic query includes the username created in Step 1. The second entry in the setup/sjsas8.samples.ldif can be imported into an LDAP server to accomplish this requirement.
  3. In the src/conf/sun-application.xml deployment descriptor of the application, we associate the Administrator role with the ldapdynamicgroup group, and this application with the ldaprealmperapp Realm. In the next step we explain how to associate this Realm with an LDAP realm.
  4. Finally, associate ldaprealmperapp with an LDAP realm by adding an entry like the one below in the <install_dir>/domains/<domain-name>/domain.xml file of the application server:
  5. <auth-realm classname="com.sun.enterprise.security.auth.realm.ldap.LDAPRealm" name="ldaprealmperapp">
    <property name="directory" value="ldap://localhost:389"/>
    <property name="base-dn" value="dc=top,dc=org,dc=company,dc=com"/>
    <property name="jaas-context" value="ldapRealm"/> </auth-realm>
    Make sure to configure the directory and base-dn properties according to the LDAP server to be used for testing.


The Sample Application

The LDAP Dynamic Group Realm sample application contains an application client and an enterprise bean.

The directory structure of the Sample Application is as follows (all paths are relative to <install_dir>/samples/security/ldaprealm/apps/dynamicgroup):

dynamicgroup-client/src/conf - the application client deployment descriptors required for deployment on the Application Server
dynamicgroup-client/src/java/samples/security/ldaprealm/dynamicgroup/client - source code for the application client
dynamicgroup-ejb/src/java/samples/security/ldaprealm/dynamicgroup/ejb - source code for the enterprise bean


Compiling and Assembling the Application



This section contains instructions on how to build and assemble the application.

  1. Compile and assemble the application.
    1. Change directory to: <install_dir>/samples/security/ldaprealm/apps/dynamicgroup.
    2. Execute the command asant core. This command compiles all source files and assembles the following module:
      • ldaprealm-dynamicgroup.ear
      • Main application, containing an application client and an enterprise bean that illustrate how to use LDAP Dynamic Group Realms

  2. Deploy the application.
  3. After compiling the sources and assembling the EAR file, you may proceed to Deploying the Sample Application. Steps 3 and 4 are optional.
  4. Clean the application project area (optional).
  5. Execute the command asant clean to remove all the files generated in Step 1.
  6. Generate API documentation (optional).
  7. Execute the command asant javadocs under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup. The API documentation will be located under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup/javadocs.


Deploying the Sample Application

This section contains instructions on how to deploy the application on the Application Server.


Note

Before deploying this application, an entry like the one shown below must be added to the <install_dir>/domains/<domain-name>/domain.xml file to associate the ldaprealmperapp realm with an LDAP realm that is associated with the LDAP server to be used to test this application. Make sure to configure the directory and base-dn properties according to the LDAP server to be used for testing:

<auth-realm classname="com.sun.enterprise.security.auth.realm.ldap.LDAPRealm" name="ldaprealmperapp">
<property name="directory" value="ldap://localhost:389"/>
<property name="base-dn" value="dc=top,dc=org,dc=company,dc=com"/>
<property name="jaas-context" value="ldapRealm"/>
</auth-realm>
You must also create the ldapdynamicgroup dynamic group in the LDAP server indicated above and make sure that it includes the user name sjsasuser, with password password. This is the user name to be used when running the application client. It is also defined in the username environment entry of the application-client.xml deployment descriptor.


Execute the command asant deploy under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup.

This command deploys the EAR file of the LDAP Dynamic Group Realm sample application, ldaprealm-dynamicgroup.ear.


Verifying Deployment

As an optional step, you can use the asadmin command to verify that the application has been registered. Otherwise, proceed directly to Running the Sample Application.

To verify the registration of the application, execute the command asadmin list-components to look at applications deployed with a server instance. For example:

<install_dir>/bin/asadmin list-components --user <username> --password <password>

You will see the sample LDAP Dynamic Group Realm listed as a J2EE application:

ldaprealm-dynamicgroup <j2ee-application>

Running the Sample Application

Execute the command asant run under <install_dir>/samples/security/ldaprealm/apps/dynamicgroup.

This command invokes the application client of the LDAP Dynamic Group Realm sample application. The application client looks up the enterprise bean and invokes some of its methods. Those methods associated with the Administrator role will be successfully executed. Access to the ones associated with the SecretRole will be denied. This is the expected output:


[echo] Running the ldaprealm-dynamicgroup program:
[exec] ****************************************************************
[exec] *  LDAP LdapRealmAppClient with DynamicGroup *
[exec] ****************************************************************
[exec] Testing with user: sjsasuser; role:Administrator
[exec] [1] Calling testIsCallerInRole()...
[exec] [1] PASSED
[exec] [2] Calling testIsCallerExpected()...
[exec] [2] PASSED
[exec] [3] Calling authorized method - methodIsAuthorized()
[exec] [3] PASSED
[exec] [4] Calling unauthorized method - methodIsNotAuthorized():
[exec] [4] PASSED: Got expected AccessException!


Troubleshooting

If you encounter problems when running the application, review the Application Server log file located at

<install_dir>/domains/<domain-name>/logs/server.log

to learn what exactly went wrong.


Copyright © 2004 Sun Microsystems, Inc. All rights reserved.

Last Updated August 3, 2004