Chapter 5. Securing the Management Interfaces with LDAP

There are two different styles that can be used when searching for group membership information: Principal to Group and Group to Principal. Principal to Group has the user’s entry containing references to the groups it is a member of, using the memberOf attribute. Group to Principal has the group’s entry contain the references to the users who are members of it, using the uniqueMember attribute.

Both Principal to Group and Group to Principal use group-search which contains the following attributes:

To use this type of searching, the principal-to-group element is added to the group-search element:

/core-service=management/security-realm=ldap-security-realm:add

batch

/core-service=management/security-realm=ldap-security-realm/authorization=ldap:add(connection=ldap-connection)

/core-service=management/security-realm=ldap-security-realm/authorization=ldap/group-search=principal-to-group:add(group-attribute="memberOf",iterative=true,group-dn-attribute="dn", group-name="SIMPLE",group-name-attribute="cn")

run-batch

Notice that the group-attribute attribute is used with the group-search=principal-to-group. For reference:

To use this type of searching, the group-to-principal element is added to the group-search element:

/core-service=management/security-realm=ldap-security-realm:add

batch

/core-service=management/security-realm=ldap-security-realm/authorization=ldap:add(connection=ldap-connection)

/core-service=management/security-realm=ldap-security-realm/authorization=ldap/group-search=group-to-principal:add(iterative=true, group-dn-attribute="dn", group-name="SIMPLE", group-name-attribute="uid", base-dn="ou=groups,dc=group-to-principal,dc=example,dc=org", principal-attribute="uniqueMember", search-by="DISTINGUISHED_NAME")

run-batch

Notice that the principal-attribute attribute is used with group-search=group-to-principal. group-to-principal is used to define how searches for groups that reference the user entry will be performed, and principal-attribute is used to define the group entry that references the principal.

For reference:

It is possible to define rules within the authorization section to convert a user’s simple user name to their distinguished name. The username-to-dn element specifies how to map the user name to the distinguished name of their entry in the LDAP directory. This element is optional and only required when both of the following are true:

It contains the following attributes:

username-to-dn can be configured with one of the following:

Once the connection to the LDAP server has been created and the group searching has been properly configured, a mapping needs to be created between the LDAP groups and RBAC roles. This mapping can be both inclusive as well as exclusive, and enables users to be automatically assigned one or more roles based on their group membership.

/core-service=management/access=authorization:read-attribute(name=provider)

It should yield the following result:

{ "outcome" => "success", "result" => "rbac" }

For more information on enabling and configuring RBAC, see Enabling Role-Based Access Control in How to Configure Server Security for JBoss EAP.

/core-service=management/access=authorization:read-children-names(child-type=role-mapping)

Which should yield a list of roles:

{
  "outcome" => "success",
  "result" =>
    [ "Administrator", "Deployer", "Maintainer", "Monitor", "Operator", "SuperUser" ]
}

In addition, all existing mappings for a role can be checked:

/core-service=management/access=authorization/role-mapping=Administrator:read-resource(recursive=true)

{
  "outcome" => "success",
  "result" =>
  {
    "include-all" => false,
    "exclude" => undefined,
    "include" => {
      "user-theboss" => {
        "name" => "theboss",
        "realm" => undefined,
        "type" => "USER"
      },
      "user-harold" => {
        "name" => "harold",
        "realm" => undefined,
        "type" => "USER"
      },
      "group-SysOps" => {
        "name" => "SysOps",
        "realm" => undefined,
        "type" => "GROUP"
      }
    }
  }
}

/core-service=management/access=authorization/role-mapping=Auditor:read-resource()

{
  "outcome" => "failed",
  "failure-description" => "WFLYCTL0216: Management resource '[ (\"core-service\" => \"management\"), (\"access\" => \"authorization\"), (\"role-mapping\" => \"Auditor\") ]' not found"
}

To add a role mapping:

/core-service=management/access=authorization/role-mapping=Auditor:add()

{
  "outcome" => "success"
}

To verify:

/core-service=management/access=authorization/role-mapping=Auditor:read-resource()

{
  "outcome" => "success",
  "result" => {
    "include-all" => false,
    "exclude" => undefined,
    "include" => undefined
  }
}

To add a group for inclusion:

/core-service=management/access=authorization/role-mapping=Auditor/include=group-GroupToInclude:add(name=GroupToInclude, type=GROUP)

To add a group for exclusion:

/core-service=management/access=authorization/role-mapping=Auditor/exclude=group-GroupToExclude:add(name=GroupToExclude, type=GROUP)

To check the result:

/core-service=management/access=authorization/role-mapping=Auditor:read-resource(recursive=true)

{
  "outcome" => "success",
  "result" => {
    "include-all" => false,
    "exclude" => {
      "group-GroupToExclude" => {
        "name" => "GroupToExclude",
        "realm" => undefined,
        "type" => "GROUP"
      }
    },
    "include" => {
      "group-GroupToInclude" => {
        "name" => "GroupToInclude",
        "realm" => undefined,
        "type" => "GROUP"
      }
    }
  }
}

/core-service=management/access=authorization/role-mapping=Auditor/include=group-GroupToInclude:remove

To remove a group from exclusion:

/core-service=management/access=authorization/role-mapping=Auditor/exclude=group-GroupToExclude:remove

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:add(eviction-time=300, cache-failures=true, max-cache-size=100)

This commands adds a by-access-time cache for authentication with an eviction time of 300 seconds (5 minutes) and a maximum cache size of 100 items. In addition, failed searches will be cached. Alternatively, a by-search-time cache could also be configured:

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-search-time:add(eviction-time=300, cache-failures=true, max-cache-size=100)

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:read-resource(include-runtime=true)

{
  "outcome" => "success",
  "result" => {
    "cache-failures" => true,
    "cache-size" => 1,
    "eviction-time" => 300,
    "max-cache-size" => 100
  }
}

The include-runtime attribute adds cache-size, which displays the current number of items in the cache. It is 1 in the above output.

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:contains(name=TestUserOne)

{
  "outcome" => "success",
  "result" => true
}

This shows that an entry for TestUserOne exists the in the cache.

You can flushing a single item from a cache, or flush the entire cache.

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:flush-cache(name=TestUserOne)

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:flush-cache()