[KNOX-4] Extend Shiro Provider to Include Groups

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.2.0
• Fix Version/s: 0.4.0
• Component/s: Server
• Labels: Authorization LDAP Security Shiro
• Assignee: Dilli Arumugam
• Reporter: Larry McCay
• Created: 25/Mar/13 22:39
• Updated: 28/Mar/19 14:12
• Resolved: 30/Dec/13 18:26

Description

The OOTB Shiro JndiLdapRealm implementation does not provide authorization info - ie. group membership information. Extend the JndiLdapRealm to override queryForAuthorizationInfo() - for example see: http://stackoverflow.com/questions/12173492/shiro-jndildaprealm-authorization-agains-ldap

Sub-Tasks

• Add classes KnoxLdapRealm, KnoxLdapContextFactory: Closed
• provide sample topology files to work with KnoxLdapRealm: Closed
• ShiroSubjectIdentityAdapter needs to map ldap groups looked up by shiro to java subject principals: Closed
• enhance AbstractIdentityAssertionFilter to make use of ldap groups looked up by shiro: Closed
• add functional tests to test ldap group lookup and usage: Closed
• enhance KnoxLdapGroupRealm to accept password alias in place of plain text password: Closed
• provide sample ldif file to work with KnoxLdapRealm: Closed
• update sample ldif file with ldapgroups to work with apache ds 2: Closed