Red Hat JBoss Enterprise Application Platform Administration I

Instructions

1. Start the standalone instance of Red Hat JBoss Enterprise Application Platform (JBoss EAP) by running the following command that uses /home/student/AD248/labs/security-ldaprealm/standalone as the base directory:

   [student@workstation ~]$ cd /opt/jboss-eap-7.4/bin
   [student@workstation bin]$ ./standalone.sh \
   -Djboss.server.base.dir=/home/student/AD248/labs/security-ldaprealm/standalone/

2. Review the guessLDAP application security configuration.

   The guessLDAP application is already configured to require authentication. Step through the following configuration files to see how it requires authentication.

   1. Inspect the application in the /home/student/AD248/labs/security-ldaprealm/guessLDAP directory.

      Explore the /home/student/AD248/labs/security-ldaprealm/guessLDAP/src/main/webapp/WEB-INF/jboss-web.xml file.

   ...output omitted...
   <jboss-web>
           <security-domain>ad248_ldap</security-domain>
   </jboss-web>

   The security-domain points to an ad248_ldap security domain used by the application.

3. Configure the ad248_ldap security domain.

   1. The LDAP server is running in a ldap container on the workstation machine on the 10389 port. In a new terminal window, run the following command to execute an ldapsearch within the LDAP container:

      [student@workstation ~]$ podman exec -it ldap \
      ldapsearch -x -D "cn=admin,dc=example,dc=com" \
      -w redhat123 -b "dc=example,dc=com"
      ...output omitted...
      # Admin, Roles, example.com
      dn: cn=Admin,ou=Roles,dc=example,dc=com
      objectClass: top
      objectClass: groupOfNames
      cn: Admin
      member: uid=alice,ou=Users,dc=example,dc=com
      
      # search result
      search: 2
      result: 0 Success
      
      # numResponses: 7
      # numEntries: 6

   2. Start the management CLI with the following commands:

      [student@workstation ~]$ cd /opt/jboss-eap-7.4/bin
      [student@workstation bin]$ ./jboss-cli.sh --connect

   3. Create the ad248_ldap security domain with a default cache type:

      [standalone@localhost:9990] /subsystem=security/security-domain\
      =ad248_ldap:add(cache-type=default)
      {"outcome" => "success"}

   4. Create the authentication child of the security domain:

      [standalone@localhost:9990] /subsystem=security/security-domain\
      =ad248_ldap/authentication=classic:add
      {
          "outcome" => "success",
          "response-headers" => {
              "operation-requires-reload" => true,
              "process-state" => "reload-required"
          }
      }

      Note

      The output indicates that a server reload is required. You can safely ignore that message, because you reload the server in next steps.

   5. Create an LDAP login module within the new legacy security domain with the following characteristics:

      Parameter	Value
      Name	LdapExtended
      Code	LdapExtended
      Module option java.naming.factory.initial	com.sun.jndi.ldap.LdapCtxFactory
      Module option java.naming.provider.url	ldap://localhost:10389
      Module option java.naming.security.authentication	simple
      Module option bindDN	cn=admin,dc=example,dc=com
      Module option bindCredential	redhat123
      Module option baseCtxDN	ou=Users,dc=example,dc=com
      Module option baseFilter	(uid={0})
      Module option rolesCtxDN	ou=Roles,dc=example,dc=com
      Module option roleFilter	(member={1})
      Module option roleAttributeID	uid

      Use the following command to create the security domain:

      [standalone@localhost:9990] /subsystem=security/security-domain=ad248_ldap\
      /authentication=classic/login-module=LdapExtended:add\
      (code=LdapExtended, flag=required, module-options=\
      [("java.naming.factory.initial"=>"com.sun.jndi.ldap.LdapCtxFactory"),\
      ("java.naming.provider.url"=>"ldap://localhost:10389"),\
      ("java.naming.security.authentication"=>"simple"),\
      ("bindDN"=>"cn=admin,dc=example,dc=com"),("bindCredential"=>"redhat123"),\
      ("baseCtxDN"=>"ou=Users,dc=example,dc=com"),\
      ("baseFilter"=>"(uid={0})"),("rolesCtxDN"=>"ou=Roles,dc=example,dc=com"),\
      ("roleFilter"=>"(member={1})"), ("roleAttributeID"=>"uid")])
      {
          "outcome" => "success",
          "response-headers" => {
              "operation-requires-reload" => true,
              "process-state" => "reload-required"
          }
      }

   6. Enter the following command in the CLI to verify the ad248_ldap security domain settings:

      [standalone@localhost:9990] /subsystem=security/security-domain=\
      ad248_ldap:read-resource(recursive=true)
      
      {
          "outcome" => "success",
          "result" => {
              "cache-type" => "default",
              "acl" => undefined,
              "audit" => undefined,
              "authentication" => {"classic" => {
                  "login-modules" => [{
                      "code" => "LdapExtended",
                      "flag" => "required",
                      "module" => undefined,
                      "module-options" => {
                          "java.naming.factory.initial" => "com.sun.jndi.ldap.LdapCtxFactory",
                          "java.naming.provider.url" => "ldap://localhost:10389",
                          "java.naming.security.authentication" => "simple",
                          "bindDN" => "cn=admin,dc=example,dc=com",
                          "bindCredential" => "redhat123",
                          "baseCtxDN" => "ou=Users,dc=example,dc=com",
                          "baseFilter" => "(uid={0})",
                          "rolesCtxDN" => "ou=Roles,dc=example,dc=com",
                          "roleFilter" => "(member={1})",
                          "roleAttributeID" => "uid"
                      }
                  }],
                  "login-module" => {"LdapExtended" => {
                      "code" => "LdapExtended",
                      "flag" => "required",
                      "module" => undefined,
                      "module-options" => {
                          "java.naming.factory.initial" => "com.sun.jndi.ldap.LdapCtxFactory",
                          "java.naming.provider.url" => "ldap://localhost:10389",
                          "java.naming.security.authentication" => "simple",
                          "bindDN" => "cn=admin,dc=example,dc=com",
                          "bindCredential" => "redhat123",
                          "baseCtxDN" => "ou=Users,dc=example,dc=com",
                          "baseFilter" => "(uid={0})",
                          "rolesCtxDN" => "ou=Roles,dc=example,dc=com",
                          "roleFilter" => "(member={1})",
                          "roleAttributeID" => "uid"
                      }
                  }}
              }},
              "authorization" => undefined,
              "identity-trust" => undefined,
              "jsse" => undefined,
              "mapping" => undefined
          },
          "response-headers" => {"process-state" => "reload-required"}
      }

   7. Reload the server to allow the changes to take effect.

      [standalone@localhost:9990] :reload

4. Test the LDAP security domain.

   1. Package the guessLDAP application.

      Open a new terminal and enter the following command to create a WAR file:

      [student@workstation ~]$ cd /home/student/AD248/labs/security-ldaprealm/\
      guessLDAP/src/main/webapp
      [student@workstation webapp]$ jar -cvf /tmp/guessLDAP.war .

   2. Use the management console or the management CLI, deploy the /tmp/guessLDAP.war file.

      [standalone@localhost:9990 /] deploy /tmp/guessLDAP.war

   3. On the workstation machine, navigate to http://localhost:8080/guessLDAP. You should be prompted to log in if the login module was configured correctly.

   4. Use alice as the username and password123 as the password to log in successfully.

      If authentication is successful, then you should see the guessLDAP application.

   5. Undeploy the guessLDAP application form the standalone server using the CLI:

      [standalone@localhost:9990] undeploy guessLDAP.war

   6. Exit the CLI and stop the running instance of JBoss EAP.