CMDBuild Authentication (file auth.conf) 1
Indice Introduction...3 1. Authentication type selection...3 auth.methods...3 serviceusers...3 force.ws.password.digest...3 2. Header authentication configuration...3 header.attribute.name...4 3. LDAP protocol configuration...4 ldap.server.address...4 ldap.server.port...4 ldap.basedn...4 ldap.bind.attribute...4 ldap.search.filter...4 ldap.search.auth.type...5 ldap.search.auth.principal...5 ldap.search.auth.password...5 2
Introduction Starting with version 1.2.3 the file auth.conf has been introduced. From this file it is possible to configure the behaviour of CMDBuild in the authentication phase. The file is divided in three sections: authentication type selection header authentication configuration LDAP protocol configuration 1. Authentication type selection In this section it is possible to configure how the authentication should happen in CMDBuild. auth.methods This parameter defines the authentication chain. It is though possible to define the authentication types to use, and their priority. Example: auth.methods=ldapauthenticator,dbauthenticator This configuration tells CMDBuild that every time a use executes the login on the system, it should verify the credentials first on the LDAP server and, when it fails, on the database user table. The accepted parameters are: HeaderAuthenticator LdapAuthenticator DBAuthenticator (the standard authentication method) serviceusers This parameter defines the "service users" in CMDBuild. This kind of users are meant to be used by external systems like the Portlet component, thus the Web interface login is disabled. force.ws.password.digest This parameter forces the password digest on the Username Token Web Service authentication. If set to false, plain text password will be allowed. It is mandatory to set it to false to use any asymmetric password encryption, as LDAP does. 2. Header authentication configuration From this section it is possible to configure an authentication mechanism that scans the request header. It might be useful if CMDBuild is shielded by a reverse proxy that handles the Single Sign On, adding a custom header with the user name. No password check is performed if the header is found. 3
header.attribute.name Specifies the header name containing the authenticated user. 3. LDAP protocol configuration In this section we will see the configuration options for the LDAP protocol. CMDBuild currently supports only the authentication with simple bind. It is however possible to use the anonymous bind to search for the user in the LDAP tree. To handle user privileges in CMDBuild, it is necessary that the users to be authenticated are present in the user database table. For example if the user with LDAP UID j.doe needs to access CMDBuild using the Tech group, these steps have to be followed: create user j.doe in CMDBuild with any password create the Tech group and define its privileges add j.doe to the Tech group When the user j.doe will try to authenticate himself, the system will verify the provided credentials on the LDAP server (in the order specified by the authentication type chain). The description of the configuration parameters follows. ldap.server.address Defines the address of the LDAP server to be used. Example: ldap.server.address=localhost ldap.server.port Allows to specifies the LDAP server port. Defaults to 389. Example: ldap.server.port=389 ldap.basedn In this parameter there must be specified the Base DN user to query the LDAP tree. Example: ldap.basedn=dc=example,dc=com ldap.bind.attribute This parameter defines the attribute on which the user bind should be executed. For example if the bind attribute is uid and the base dn is dc=example,dc=com, the resulting LDAP query would be uid=j.doe,dc=example,dc=com. Example: ldap.bind.attribute=uid ldap.search.filter It is possible to specify a search filter to be used for searching the user in the LDAP tree. 4
Example: ldap.search.filter=(&(objectclass=myclass1)(objectclass=myclass2)) ldap.search.auth.type This attribute specifies the binding type to be used to search the user on the LDAP tree. Accepted values are none (anonymous bind) and simple (simple bind) Example: ldap.search.auth.type=none ldap.search.auth.principal If using simple bind to search the users, this parameter defines the user to be used. Example: ldap.search.auth.principal=uid=myuser,ou=people,dc=example,dc=com ldap.search.auth.password If using simple bind to search the users, this parameter defines the password for the principal user. Example: ldap.search.auth.password=mypassword 5