[AMQ-3064] Security: LDAPLoginModule: Specifying userRoleName as 'memberOf' fetches the full DN of the group, and initializes a GroupPrincipal with full DN

• Type: Wish
• Status: Closed
• Priority: Minor
• Resolution: Abandoned
• Affects Version/s: 5.3.0
• Assignee: Unassigned
• Reporter: Amit Kumar
• Created: 01/Dec/10 15:50
• Updated: 13/Mar/22 14:02
• Resolved: 13/Mar/22 14:02

Description

In the sample below, when I specify the userRoleName as 'memberOf', it initializes a GroupPrincipal with the name as full DN. e.g. 'CN=somegroupIAMMemberOf,OU=Groups,O=domain'...
This may not work if the expected role is 'somegroupIAMMemberOf'.

TestLogin {
org.apache.activemq.jaas.LDAPLoginModule required
debug=false
initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory
connectionURL="ldap://something:389"
connectionUsername="uid=generic.gen,OU=Generics,O=something"
connectionPassword="generic123"
connectionProtocol=""
authentication=simple
userBase="OU=Users,O=something"
userSearchMatching="(uid=

{0})"
userSearchSubtree=true
userRoleName="memberOf"
roleName="CN"
roleBase="OU=Groups,O=something"
roleSearchMatching="member={0}

"
roleSearchSubtree=true
;
};