Configuring Tomcat to authenticate using Windows Active Directory

Question

What is the best way to configure Tomcat 5.5 or later to authenticate users from Windows Active Directory?

Answer 1

from www.jspwiki.org

See : ActiveDirectoryIntegration

Try this in the server.xml with your ldap-settings :

<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"

           connectionURL="ldap://youradsserver:389"
           alternateURL="ldap://youradsserver:389"         
           userRoleName="member"
           userBase="cn=Users,dc=yourdomain"
           userPattern="cn={0},cn=Users,dc=yourdomain"
           roleBase="cn=Users,dc=yourdomain"
           roleName="cn"
           roleSearch="(member={0})"
           roleSubtree="false"
           userSubtree="true" 
   />

and define the role in the tomcat-users.xml and the web.xml of your application

edit webapp_root/WEB_INF/Web.xml file as follows:

<security-constraint>
   <display-name>your web app display name</display-name>
   <web-resource-collection>
     <web-resource-name>Protected Area</web-resource-name>
     <url-pattern>*.jsp</url-pattern>
     <url-pattern>*.html</url-pattern>
     <url-pattern>*.xml</url-pattern>
   </web-resource-collection>
   <auth-constraint>
     <role-name>yourrolname(ADS Group)</role-name>
   </auth-constraint>
 </security-constraint>
 <login-config>
   <auth-method>FORM</auth-method>
   <form-login-config>
     <form-login-page>/login.jsp</form-login-page>
     <form-error-page>/error.jsp</form-error-page>
   </form-login-config>
 </login-config>
 <security-role>
   <description>your role description</description>
   <role-name>yourrolename(i.e ADS group)</role-name>
 </security-role>

Answer 2

Hi Does anyone know if Tomcat running on Unix (solaris) can authenticate against Windows Active Directory?

Or does Tomcat have to reside on Windows before it can?

Answer 3

The LDAP based authentication works without any additional steps on any operating system.

http://spnego.sf.net can be used for silent authentication of users logged into the Windows Domain. This needs an domain account that is registered in the domain to be authoritative for the provided service. It works on both Windows and Linux.