Problem mapping custom LDAP groups to roles in Jazz
Is there anything that I am doing incorrectly? Let's assume I wanted to go with the second method to define groups locally. Are there any other changes I need to make to the web.xml file of each webapp?
Accepted answer
Another thing with Tomcat and LDAP is that you need to replace some descriptor files for all the applications JTS, CCM, RM, QM (save the old ones and copy the new ones over) This used to be described in the setup LDAP setup step, after setting - as described in the LDAP setup using the button Save Tomcat Config Files and the related description.
show details
You need to restart the server after that.
I would suggest to really follow http://www.ibm.com/support/docview.wss?uid=swg21445366 to make sure your settings are correct.
Also, you need to have the new user you want to use for the login in LDAP, with the right repository groups. the steps above should provide you with the information.
Comments
Most of the steps mentioned above you did. We described the process here, I think: https://jazz.net/library/article/831 maybe that helps a bit.
Ralph, that was really all it was - I just needed to verify the LDAP settings. I followed the link that you posted, and I even got the LDAP Browser tool installed. Ultimately, even though I could provide user level access, my roles were not working because the top-level group I was trying to assign as a role, CN=Users,DC=Domain,DC=Com, was in fact not a group, but a container. According to the protocol of LDAP, it doesn't work this way - I cannot assign a role to a container, only to a group. So, I just went ahead and got a group created and everything worked fine - I got the warm fuzzy green when I went to test the settings (this is required for it to work - not getting a warm fuzzy green when you hit test connection will not allow your setup to work), and it works fine now.
The final unanswered question is how to get local role mapping to work. I am no longer interested in this because I now have the ability to have LDAP groups organized in my company, but I followed the article and could not get it to work the way it said it should.
Great you got it working Michael. Sadly I am not an expert for all this. I just get along somehow. Maybe you could contact support if the description you have does not work.
Comments
Donald Nong
Sep 29 '14, 8:02 p.m.Two things that you did not mention and you may need to double check - the mapping file and the LDAPLocalGroupRegistryProvider advanced properties in JTS. You may also turn on the LDAP debugging using the log4j.properties file of JTS (although I am not sure whether it will reveal anything about local group mapping).
Michael Plautz
Sep 30 '14, 4:27 p.m.So I did find, after asking my company's LDAP administrator, that the group I was trying to authenticate against was actually not a group, but a container, and therefore did not have a member property. I actually never got a "warm fuzzy green" when I clicked Test Connection for LDAP. I got a message saying "Some of the users in this group do not have a member attribute," which was to be expected, since I was creating a global account, and I knew there would be some users in this group that didn't have all the attributes.
What I still can't figure out is how to do what the second article mentions, which is how to do the mapping file and get it to be recognized without getting the user ID not recognizable error. I did what the article said (as I described above). I can enable the log4j for JTS, but the article never talked about going into the JTS advanced properties. I was maybe hoping for clarification on how to do the local group mapping. After I create the mapping file, and make an entry in the server.xml file for it, what do I need to do to each webapp's web.xml? How do I format jts.xml? Does it just have one element?