Веб-консоль ActiveMQ с использованием аутентификации LDAP Active Directory

Question

Пытается заставить веб-консоль ActiveMQ использовать LDAP и проходить проверку подлинности в Active Directory.При запуске MQ ошибок нет, появляется окно ввода имени пользователя и пароля, но оно не отображается при вводе правильных учетных данных.

Версия 5.15.6

login.config

amqLdapLoginModule {
   org.eclipse.jetty.jaas.spi.LdapLoginModule required
   debug="true"
   contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
   hostname="ad-server1.domain.com"
   port="389"
   bindDn="CN=readonly-user,OU=Accounts,DC=domain,DC=com"
   bindPassword="readonly-user-password"
   authenticationMethod="simple"
   forceBindingLogin="false"
   userBaseDn="CN=users,DC=domain,DC=com"
   userRdnAttribute="uid"
   userIdAttribute="uid"
   userPasswordAttribute="userPassword"
   userObjectClass="inetOrgPerson"
   roleBaseDn="CN=groups,DC=domain,dc=com"
   roleNameAttribute="cn"
   roleMemberAttribute="uniqueMember"
   roleObjectClass="groupOfUniqueNames";
   };

jetty.xml

    <bean id="ldapLoginService" class="org.eclipse.jetty.jaas.JAASLoginService">
        <property name="name" value="LdapRealm" />
        <property name="loginModuleName" value="amqLdapLoginModule" />
        <property name="roleClassNames" value="org.eclipse.jetty.jaas.JAASRole" />
        <property name="identityService" ref="identityService" />
    </bean>
    <bean id="identityService" class="org.eclipse.jetty.security.DefaultIdentityService"/>

    <bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
        <property name="name" value="BASIC" />
        <property name="roles" value="admins-group" />
        <!-- set authenticate=false to disable login -->
        <property name="authenticate" value="true" />
    </bean>
    <bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
        <property name="name" value="BASIC" />
        <property name="roles" value="admins-group" />
         <!-- set authenticate=false to disable login -->
        <property name="authenticate" value="true" />
    </bean>


    <bean id="securityHandlerLdap" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
        <property name="loginService" ref="ldapLoginService" />
        <property name="identityService" ref="identityService" />
        <property name="realmName" value="LdapRealm" />
        <property name="authenticator">
            <bean class="org.eclipse.jetty.security.authentication.BasicAuthenticator" />
        </property>
        <property name="constraintMappings">
            <list>
                <ref bean="adminSecurityConstraintMapping" />
                <ref bean="securityConstraintMapping" />
            </list>
        </property>
        <property name="handler" ref="secHandlerCollection" />
    </bean>

    <bean id="contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection">
    </bean>

Answer 1

Следуя указаниям http://bacedifo.blogspot.com/2013/06/securing-activemq-580-web-console-using.html и используя jd-библиотеку ldaptive ldap с некоторыми изменениями в конфигах, мне удалось заставить это работать в нашей среде AD.

Скопировал ldaptive- {номер версии} .jar и jetty-jass- {номер версии} .jar в каталог / activemq / lib.

login.conf

activemq {
    org.ldaptive.jaas.LdapLoginModule required
        debug=true
        storePass="true"
        ldapUrl="ldap://ldap-server1.domainname.com:389 ldap://ldap-server2.domainname.com:389"
        connectionStrategy="ACTIVE_PASSIVE"
        bindDn="CN=ldap-readaccount,OU=Read Accounts,DC=domainname,DC=com"
        baseDn="OU=accounts,DC=domainname,DC=com"
        bindCredential="ldapuser-password"
        useStartTLS="false"
        userFilter="(sAMAccountName={user})";

    org.ldaptive.jaas.LdapRoleAuthorizationModule required
        useFirstPass="true"
        ldapUrl="ldap://ldap-server1.domainname.com:389 ldap://ldap-server2.domainname.com:389"
        connectionStrategy="ACTIVE_PASSIVE"
        bindDn="CN=ldap-readaccount,OU=Read Accounts,DC=domainname,DC=com"
        baseDn="OU=groups,DC=domainname,DC=com"
        bindCredential="ldapuser-password"
        roleFilter="(&(cn=webconsoleadmins)(member={user}))"
        useStartTLS="false"
        defaultRole="admins"
        roleAttribute="cn";

};

jetty.xml

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

<bean id="securityLoginService" class="org.eclipse.jetty.jaas.JAASLoginService">
    <property name="name" value="LdapRealm" />
    <property name="loginModuleName" value="activemq" />
    <property name="roleClassNames" value="org.ldaptive.jaas.LdapRole" />
    <property name="identityService" ref="identityService" />
</bean>
<bean id="identityService" class="org.eclipse.jetty.security.DefaultIdentityService"/>


<bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
    <property name="name" value="BASIC" />
    <property name="roles" value="admins,webconsoleadmins" />
    <!-- set authenticate=false to disable login -->
    <property name="authenticate" value="true" />
</bean>
<bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
    <property name="name" value="BASIC" />
    <property name="roles" value="admins,webconsoleadmins" />
     <!-- set authenticate=false to disable login -->
    <property name="authenticate" value="true" />
</bean>

...

<bean id="securityHandler" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
    <property name="loginService" ref="securityLoginService" />
    <property name="identityService" ref="identityService" />
    <property name="authenticator">
        <bean class="org.eclipse.jetty.security.authentication.BasicAuthenticator" />
    </property>
    <property name="constraintMappings">
        <list>
            <ref bean="adminSecurityConstraintMapping" />
            <ref bean="securityConstraintMapping" />
        </list>
    </property>
    <property name="handler" ref="secHandlerCollection" />
</bean>