Borland VisiBroker® 7.0 - Borland Technical Publications

Borland LoginModulesLDAP LoginModuleSimilar to the JDBC LoginModule, but using LDAP as its authentication backend.realm-name {com.borland.security.provider.authn.LDAPLoginModule authenticationrequirements-flagINITIALCONTEXTFACTORY=connection-factory-namePROVIDERURL=database-URLSEARCHBASE=search-start-pointUSERATTRIBUTES=attribute1, attribute2, ...USERNAMEATTRIBUTE=attributeQUERY=dynamic-query};PropertyDescriptionINITIALCONTEXTFACTORY The InitialContextFactory class that is used by JNDI to bind to LDAP.PROVIDERURL The URL to the LDAP server of the form ldap://: .SEARCHBASEThe search base for the Directory to lookup.USERATTRIBUTESThis option controls the attributes that are retrieved for a given user. This is a commaseparated list of attributes that will be retrieved and stored for an authenticated user.These attributes can then be used in the authorization rules to determine whether a userbelongs to a given role.USERNAMEATTRIBUTE This attribute represents what the user types in as the username. If set to uid, it wouldallow users to type their uid when asked for a username. If set to mail, it would allow theuser to type their email when asked for a user name. When set to DN, the user will typestheir full DN to authenticate themselves.QUERYThe Query options provides a mechanism to dynamically query the LDAP for otherinformation and represent the results as attributes. For example, a user can be amember of a set of groups. It is useful to extract this information as the GROUP attribute sothat it can be used in rules in the authorization domain. To achieve this, you can specifya query. Queries are of the format:query.="=";The suffix can be anything that uniquely identifies this entry and there can beany number of queries specified. To insert the user's DN as part of the query,you should use {0}. The LDAPLoginModule will then replace the {0} with theactual DN of the user. For example, to query groups and store the results in theGROUP attribute, you say:query.1="GROUP=(&(ou=groups)(uniquemember={0}))";This will select all the groups (whose ou attribute has the value groups) that theuser belongs to whose uniquemember attribute contains the user's DN, thenstores the CN of the objects returned as the result as the values for the GROUPattribute for that user. If the attribute name specified is ROLE, then this attribute'streatment is exactly like that of the JDBCLoginModule. This mechanism can beused to store user roles in LDAP.Host LoginModuleThe HostLoginModule is used to authenticate to a UNIX or NT-based network.realm-name {com.borland.security.provider.authn.HostLoginModule authenticationrequirements-flag;};Chapter 3: Authentication 35