Tomcat - OpenLDAP authentication

Question

What is the Realm configuration required in Tomcat 8 server.xml for authentication using OpenLDAP ?

<-- Active Directory, Working Fine-->
<Realm adCompat="true" alternateURL="ldap://a.b.c.d:3268"
      className="org.apache.catalina.realm.JNDIRealm" commonRole="CommonRole"
      connectionName="CN=admin,DC=test,DC=com"
      connectionPassword="test_password" connectionURL="ldap://a.b.c.d:3268"
      userBase="DC=test,DC=com" userRoleName="displayName"
      userSearch="(&amp;(objectCategory=user)(sAMAccountName={0}))"
      userSubtree="true" />

<!-- OpenLDAP, Not Working -->
<Realm alternateURL="ldap://a.b.c.d:4689"
      className="org.apache.catalina.realm.JNDIRealm" commonRole="CommonRole"
      connectionName="cn=admin,dc=test,dc=com"
      connectionPassword="test_password" connectionURL="ldap://a.b.c.d:4689"
      userBase="dc=test,dc=com" userRoleName="displayName"
      userSearch="(&amp;(objectClass=person)(cn={1}))"
      userSubtree="true" />

Did you check the [official documentation](http://tomcat.apache.org/tomcat-9.0-doc/config/realm.html#JNDI_Directory_Realm_-_org.apache.catalina.realm.JNDIRealm)? `connectionURL` is the only attribute always required (besides `className` of course). — Piotr P. Karwasz, Aug 04 '21 at 21:12
The `userSearch` attribute uses a `{0}` placeholder for the username, you used `{1}`. — Piotr P. Karwasz, Aug 05 '21 at 08:47

score 1 · Answer 1 · answered Aug 06 '21 at 06:03

I have modified as mentioned by Piotr P. Karwasz and it worked. Thanks a lot!
The userSearch attribute uses a {0} placeholder for the username, you used {1}.
  
  <Realm alternateURL="ldap://a.b.c.d:4689"
                 className="org.apache.catalina.realm.JNDIRealm" commonRole="CommonRole"
                 connectionName="cn=admin,dc=test,dc=com"
                 connectionPassword="admin_pass" connectionURL="ldap://a.b.c.d:4689"
                 debug="9" userBase="dc=test,dc=com" userRoleName="displayName"
                 userSearch="(&amp;(objectClass=person)(cn={0}))"
                 userSubtree="true" />

Tomcat - OpenLDAP authentication

1 Answers1