Skip to content
IT // Adventures

Apache Tomcat and Active Directory Authentication

1 min read
Contents

Via a JNDI realm, Apache Tomcat can be instructed to load users, groups and roles from an LDAP source, e.g. Active Directory. The biggest challenge is to “map” the AD groups to Tomcat roles.

Problem

If the role of the Tomcat application matches the name of the AD group, the mapping is trivial. If it doesn’t - e.g. because there is a naming convention for AD groups and the legacy Tomcat application expects hard-coded role names - see the workaround below.

Solution (workaround)

In the example, we will link the Tomcat role “reporting” to the AD group “Tomcat_Reporting”.

  • First, we create an AD group named “Tomcat_Reporting” and assign the desired AD users to it.
  • In the group’s “Notes” field (aka “info”), we enter the name of the Tomcat role “reporting”.
  • Next, we need to configure the JNDI realm in the “server.xml” configuration file. (See the example below.)
  • The entries starting with “connection…” point to the AD infrastructure and the login account for the LDAP query,
  • the “user…” configuration sets the search filters for the query, and
  • entries starting with “role…” specify (a) which AD groups are considered and (b) in which field the role name is looked up. (In the example, the mapping happens via roleName=“info”.)

Example configuration (server.xml)

<Realm className="org.apache.catalina.realm.JNDIRealm"
  referrals="follow"
  connectionURL="ldap://ad.domain.com:3268"
  connectionName="CN=Tomcat Serviceuser,OU=ServiceUser,DC=ad,DC=domain,DC=com"
  connectionPassword="complex password of the Tomcat service user"
  userBase="DC=ad,DC=domain,DC=com"
  userSearch="(sAMAccountName={0})"
  userSubtree="true"
  userRoleName="memberOf"
  roleBase="OU=Tomcat Application,OU=Security Groups,DC=ad,DC=domain,DC=com"
  roleSearch="(member={0})"
  roleName="info"
  roleSubtree="false"
/>

PS: Please let me know if there is a more elegant way to solve this problem.