Chapter 2. Securing the Management Interfaces with LDAP

There are two different styles that can be used when searching for group membership information: Principal to Group and Group to Principal. Principal to Group has the user’s entry containing references to the group(s) it is a member of, memberOf attribute. Group to Principal has the group’s entry contain the references to the user(s) who are members of it, uniqueMember attribute.

Both Principal to Group and Group to Principal use group-search which contains the following attributes:

To use this type of searching, the principal-to-group element is added to the group-search element:

/core-service=management/security-realm=ldap-security-realm:add

batch

/core-service=management/security-realm=ldap-security-realm/authorization=ldap:add(connection=ldap-connection)

/core-service=management/security-realm=ldap-security-realm/authorization=ldap/group-search=principal-to-group:add(group-attribute="memberOf",iterative=true,group-dn-attribute="dn", group-name="SIMPLE",group-name-attribute="cn")

run-batch

Notice that the group-attribute attribute is used with the group-search=principal-to-group. For reference:

To use this type of searching, the group-to-principal element is added to the group-search element:

/core-service=management/security-realm=ldap-security-realm:add

batch

/core-service=management/security-realm=ldap-security-realm/authorization=ldap:add(connection=ldap-connection)

/core-service=management/security-realm=ldap-security-realm/authorization=ldap/group-search=group-to-principal:add(iterative=true, group-dn-attribute="dn", group-name="SIMPLE", group-name-attribute="uid", base-dn="ou=groups,dc=group-to-principal,dc=example,dc=org", principal-attribute="uniqueMember", search-by="DISTINGUISHED_NAME")

run-batch

Notice that the principal-attribute attribute is used with group-search=group-to-principal. group-to-principal is used to define how searches for groups that reference the user entry will be performed, and principal-attribute is used to define the group entry that references the principal.

For reference:

It is possible to define rules within the authorization section to convert a user’s simple user name to their distinguished name. The username-to-dn element specifies how to map the user name to the distinguished name of their entry in the LDAP directory. This element is optional and only required when both of the following are true:

It contains the following attributes:

username-to-dn can be configured with one of the following:

Once the connection to the LDAP server has been created and the group searching has been properly configured, a mapping needs to be created between the LDAP groups and RBAC roles. This mapping can be both inclusive as well as exclusive and enables users to be automatically assigned one or more roles based on their group membership information.

/core-service=management/access=authorization:read-attribute(name=provider)

It should yield the following result:

{ "outcome" => "success", "result" => "rbac" }

For more information on enabling and configuring RBAC, please see the Enabling Role-Based Access Control section of the Red Hat JBoss Enterprise Application Platform How to Configure Server Security guide.

/core-service=management/access=authorization:read-children-names(child-type=role-mapping)

Which should yield a list of roles:

{
  "outcome" => "success",
  "result" =>
    [ "Administrator", "Deployer", "Maintainer", "Monitor", "Operator", "SuperUser" ]
}

In addition, all existing mappings for a role may be checked:

/core-service=management/access=authorization/role-mapping=Administrator:read-resource(recursive=true)

{
  "outcome" => "success",
  "result" =>
  {
    "include-all" => false,
    "exclude" => undefined,
    "include" => {
      "user-theboss" => {
        "name" => "theboss",
        "realm" => undefined,
        "type" => "USER"
      },
      "user-harold" => {
        "name" => "harold",
        "realm" => undefined,
        "type" => "USER"
      },
      "group-SysOps" => {
        "name" => "SysOps",
        "realm" => undefined,
        "type" => "GROUP"
      }
    }
  }
}

/core-service=management/access=authorization/role-mapping=Auditor:read-resource()

{
  "outcome" => "failed",
  "failure-description" => "WFLYCTL0216: Management resource '[ (\"core-service\" => \"management\"), (\"access\" => \"authorization\"), (\"role-mapping\" => \"Auditor\") ]' not found"
}

To add a role mapping:

/core-service=management/access=authorization/role-mapping=Auditor:add()

{
  "outcome" => "success"
}

To verify:

/core-service=management/access=authorization/role-mapping=Auditor:read-resource()

{
  "outcome" => "success",
  "result" => {
    "include-all" => false,
    "exclude" => undefined,
    "include" => undefined
  }
}

To add a group for inclusion:

/core-service=management/access=authorization/role-mapping=Auditor/include=group-GroupToInclude:add(name=GroupToInclude, type=GROUP)

To add a group for exclusion:

/core-service=management/access=authorization/role-mapping=Auditor/exclude=group-GroupToExclude:add(name=GroupToExclude, type=GROUP)

To check the result:

/core-service=management/access=authorization/role-mapping=Auditor:read-resource(recursive=true)

{
  "outcome" => "success",
  "result" => {
    "include-all" => false,
    "exclude" => {
      "group-GroupToExclude" => {
        "name" => "GroupToExclude",
        "realm" => undefined,
        "type" => "GROUP"
      }
    },
    "include" => {
      "group-GroupToInclude" => {
        "name" => "GroupToInclude",
        "realm" => undefined,
        "type" => "GROUP"
      }
    }
  }
}

/core-service=management/access=authorization/role-mapping=Auditor/include=group-GroupToInclude:remove

To remove a group from exclusion:

/core-service=management/access=authorization/role-mapping=Auditor/exclude=group-GroupToExclude:remove

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:add(eviction-time=300, cache-failures=true, max-cache-size=100)

This commands adds a by-access-time cache for authentication with an eviction time of 300 seconds (5 minutes) and a max cache size of 100 items. In addition, failed searches will be cached. Alternatively, a by-search-time cache could also be configured:

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-search-time:add(eviction-time=300, cache-failures=true, max-cache-size=100)

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:read-resource(include-runtime=true)

{
  "outcome" => "success",
  "result" => {
    "cache-failures" => true,
    "cache-size" => 1,
    "eviction-time" => 300,
    "max-cache-size" => 100
  }
}

The include-runtime attribute adds the cache-size element, which displays the current number of items in the cache (1 in this case).

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:contains(name=TestUserOne)

{
  "outcome" => "success",
  "result" => true
}

This shows that an entry for TestUserOne exists the in the cache.

An entire cache may be flushed as can individual items from a cache.

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:flush-cache(name=TestUserOne)

/core-service=management/security-realm=LDAPRealm/authentication=ldap/cache=by-access-time:flush-cache()