Chapter 19. Using LdapExtLoginModule with JaasSecurityDomain

Procedure 19.1. 

1. Define JaasSecurityDomain MBean

   Define the JaasSecurityDomain MBean used to decrypt the encrypted version of the password. You can add the MBean to JBOSS_HOME/server/PROFILE/conf/jboss-service.xml, or to a *-service.xml deployment descriptor in the JBOSS_HOME/server/ PROFILE /deploy folder.

         <mbean code="org.jboss.security.plugins.JaasSecurityDomain"
         name="jboss.security:service=JaasSecurityDomain,domain=jmx-console">
         <constructor>
            <arg type="java.lang.String" value="jmx-console"></arg>
         </constructor>
         <attribute name="KeyStorePass">some_password</attribute>
         <attribute name="Salt">abcdefgh</attribute>
         <attribute name="IterationCount">66</attribute>
      </mbean>
   

   Copy to Clipboard Toggle word wrap

   Note

   The default cipher algorithm used by the JaasSecurityDomain implementation is PBEwithMD5andDES. Other cipher algorithms include DES, TripleDES, Blowfish, and PBEWithMD5AndTripleDES. All algorithms are symmetric algorithms. You specify a cipher algorithm by appending an <attribute> element with the CypherElement attribute set to one of these values.

2. Adjust password, salt, and iteration count

   Step One contains a simple configuration where the required password, Salt, and Iteration Count used for the encryption or decryption are contained within the MBean definition.
   Ensure you change the KeyStorePass, Salt, and IterationCount values suitable for your own deployment.

3. Start the platform

   Start the server after configuring the MBean, password, salt, and iteration counts. Ensure you start the platform by specifying the server profile containing the configuration.

   [bin]$ ./run.sh -c PROFILE

   Copy to Clipboard Toggle word wrap

4. Open the JMX Console

   Navigate to the JMX Console (http://localhost:8080/jmx-console/ by default) and select the org.jboss.security.plugins.JaasSecurityDomain MBean.

5. Invoke the LdapExtLoginModule

   1. On the org.jboss.security.plugins.JaasSecurityDomain page, find the encode64(String password) method.
   2. Pass the plain text version of the password the LdapExtLoginModule will use to this method.
   3. Invoke the encode64(String password) method.
   4. The return value is the encrypted version of the password encoded as Base64.

6. Configure Login Module

   Within the login module configuration, the following module-options should be set:

   <module-option name="jaasSecurityDomain">jboss.security:service=JaasSecurityDomain,domain=jmx-console</module-option>
     <module-option name="bindCredential">2gx7gcAxcDuaHaJMgO5AVo</module-option>

   Copy to Clipboard Toggle word wrap
   The first option specifies the JaasSecurityDomain configured in Step 1 is used to decrypt the password.
   The bindCredential is replaced with the encrypted Base64 password obtained in Step 5.