The LDAP Security Manager provides the ability to pull users and groups from LDAP. By default, eXist stores passwords internally. If this feature is enabled, the users and groups are pulled from an LDAP directory server.
This implementation currently only supports reading users and groups. Creation or modification is not supported.
The LDAP Security Manager provides the ability to pull users and groups from LDAP. By default, eXist stores passwords internally. If this feature is enabled, the users and groups are pulled from an LDAP directory server.
Just place the following security element as a child of
db-connection:
For the LDAP security manager you need to distinguished names (DN)--one for the users
and one for the groups. Each user must be represented by a single entry under the user DN
as an RFC 2307 posixAccount entry.
Each group is represented by a single entry under the groupDN as a union of RFC 2307
posixGroup and RFC 2256 groupOfUniqueNames.
When eXist is started, you must specify the follow java properties:
security.ldap.connection.url |
The connection URL of the LDAP server. |
|---|---|
security.ldap.dn.user |
The user list DN. |
security.ldap.dn.group |
The group list DN. |
If you choose not to use the recommended entries under the user list DN, you can control each facet location by the following properties:
security.ldap.userClass |
The class name on which to query the user list DN. |
|---|---|
security.ldap.attr.uid |
The username. |
security.ldap.attr.uidNumber |
The user id number. |
security.ldap.attr.gidNumber |
The primary group associated with the user. |
security.ldap.attr.userPassword |
The encoded password of the user. |
security.ldap.attr.userDigestPassword |
The encoded digest password of the user (for WebDAV). |
If you choose not to use the recommended entries under the group list DN, you can control each facet location by the following properties:
security.ldap.groupClass |
The class name on which to query the group list DN. |
|---|---|
security.ldap.attr.groupName |
The group name. |
security.ldap.attr.gidNumber |
The group id. This must be the same in the user and group. |
security.ldap.attr.groupMemberName |
The name of the member entry which contains the user's DN. |
Finally, you can control the LDAP implementation by:
security.ldap.contextFactory |
The class name of the JNDI context factory for LDAP. |
|---|
In this example exist would use the following DN values:
ou=Users,dc=exist,dc=example, dc=com, dc=authority |
The user list DN |
|---|---|
ou=Groups,dc=exist,dc=example, dc=com, dc=authority |
The group list DN |
