主页
产品
Red Hat JBoss Enterprise Application Platform
7.3
How to Configure Identity Management
5.4.2. 示例

5.4.2. 示例

注意

此示例假定已创建了名为 LDAPRealm 的安全域。它连接到现有的 LDAP 服务器，并配置为进行身份验证和授权。用于显示当前配置的命令包括在阅读当前缓存配置中。有关创建使用 LDAP 的安全域的更多详细信息，请参阅使用传统核心管理身份验证。

基本配置示例

"core-service" : { 
  "management" : { 
    "security-realm" : { 
      "LDAPRealm" : { 
        "authentication" : {
          "ldap" : {
            "allow-empty-passwords" : false,
            "base-dn" : "...", 
            "connection" : "MyLdapConnection", 
            "recursive" : false, 
            "user-dn" : "dn", 
            "username-attribute" : "uid", 
            "cache" : null
          }
        },
        "authorization" : {
          "ldap" : {
            "connection" : "MyLdapConnection", 
            "group-search" : {
              "group-to-principal" : { 
                "base-dn" : "...", 
                "group-dn-attribute" : "dn", 
                "group-name" : "SIMPLE", 
                "group-name-attribute" : "uid", 
                "iterative" : true, 
                "principal-attribute" : "uniqueMember", 
                "search-by" : "DISTINGUISHED_NAME", 
                "cache" : null 
              }
            }, 
            "username-to-dn" : {
              "username-filter" : { 
                "attribute" : "uid", 
                "base-dn" : "...", 
                "force" : false, 
                "recursive" : false, 
                "user-dn-attribute" : "dn", 
                "cache" : null 
                }
              } 
            }
          }, 
        } 
      } 
  }
}

"core-service" : { 
  "management" : { 
    "security-realm" : { 
      "LDAPRealm" : { 
        "authentication" : {
          "ldap" : {
            "allow-empty-passwords" : false,
            "base-dn" : "...", 
            "connection" : "MyLdapConnection", 
            "recursive" : false, 
            "user-dn" : "dn", 
            "username-attribute" : "uid", 
            "cache" : null
          }
        },
        "authorization" : {
          "ldap" : {
            "connection" : "MyLdapConnection", 
            "group-search" : {
              "group-to-principal" : { 
                "base-dn" : "...", 
                "group-dn-attribute" : "dn", 
                "group-name" : "SIMPLE", 
                "group-name-attribute" : "uid", 
                "iterative" : true, 
                "principal-attribute" : "uniqueMember", 
                "search-by" : "DISTINGUISHED_NAME", 
                "cache" : null 
              }
            }, 
            "username-to-dn" : {
              "username-filter" : { 
                "attribute" : "uid", 
                "base-dn" : "...", 
                "force" : false, 
                "recursive" : false, 
                "user-dn-attribute" : "dn", 
                "cache" : null 
                }
              } 
            }
          }, 
        } 
      } 
  }
}

Copy to Clipboard

Toggle word wrap

在所有出现 "cache": null 的区域中，可以配置一个缓存：

身份验证: 身份验证期间，使用此定义发现用户的可分辨名称，并尝试连接到 LDAP 服务器并验证其身份是否使用这些凭据来实现。
group-search 定义: 有组搜索定义。在本例中，它是迭代搜索，因为在上面的示例配置中，它 被设置为 true。首先，将执行搜索以查找用户是以下直接成员的所有组：之后，将对每个组执行搜索，以确定它们是否与其他组成员资格。此过程将继续，直到检测到循环引用或最终组不属于任何其他组。
组搜索 中的用户名到dn 定义: 组搜索取决于用户的可分辨名称的可用性。本节并不适用于所有情况，但可以作为第二次尝试来发现用户的可分辨名称。当支持第二种身份验证形式（如本地身份验证）时，这可能很有用，甚至也可以是必需的。

5.4.2.1. 阅读 Current Cache 配置
复制链接

注意

本节和后续小节中使用的 CLI 命令使用 LDAPRealm 作为安全域的名称。这应当替换为正在配置的实际域的名称。

读取当前缓存配置的 CLI 命令

/core-service=management/security-realm=LDAPRealm:read-resource(recursive=true)

/core-service=management/security-realm=LDAPRealm:read-resource(recursive=true)

Copy to Clipboard

Toggle word wrap

输出。

{ 
  "outcome" => "success", 
  "result" => { 
    "map-groups-to-roles" => true, 
    "authentication" => {
      "ldap" => { 
        "advanced-filter" => undefined, 
        "allow-empty-passwords" => false, 
        "base-dn" => "dc=example,dc=com", 
         "connection" => "ldapConnection", 
         "recursive" => true, 
         "user-dn" => "dn", 
         "username-attribute" => "uid",
         "cache" => undefined 
        }
      }, 
      "authorization" => {
        "ldap" => { 
          "connection" => "ldapConnection", 
          "group-search" => {
            "principal-to-group" => { 
              "group-attribute" => "description", 
              "group-dn-attribute" => "dn", 
              "group-name" => "SIMPLE", 
              "group-name-attribute" => "cn", 
              "iterative" => false, 
              "prefer-original-connection" => true, 
              "skip-missing-groups" => false, 
              "cache" => undefined 
            }
          }, 
          "username-to-dn" => {
            "username-filter" => { 
              "attribute" => "uid", 
              "base-dn" => "ou=Users,dc=jboss,dc=org", 
              "force" => true, 
              "recursive" => false, 
              "user-dn-attribute" => "dn", 
              "cache" => undefined 
            }
          } 
        }
      }, 
      "plug-in" => undefined, 
      "server-identity" => undefined 
    }
  }

{ 
  "outcome" => "success", 
  "result" => { 
    "map-groups-to-roles" => true, 
    "authentication" => {
      "ldap" => { 
        "advanced-filter" => undefined, 
        "allow-empty-passwords" => false, 
        "base-dn" => "dc=example,dc=com", 
         "connection" => "ldapConnection", 
         "recursive" => true, 
         "user-dn" => "dn", 
         "username-attribute" => "uid",
         "cache" => undefined 
        }
      }, 
      "authorization" => {
        "ldap" => { 
          "connection" => "ldapConnection", 
          "group-search" => {
            "principal-to-group" => { 
              "group-attribute" => "description", 
              "group-dn-attribute" => "dn", 
              "group-name" => "SIMPLE", 
              "group-name-attribute" => "cn", 
              "iterative" => false, 
              "prefer-original-connection" => true, 
              "skip-missing-groups" => false, 
              "cache" => undefined 
            }
          }, 
          "username-to-dn" => {
            "username-filter" => { 
              "attribute" => "uid", 
              "base-dn" => "ou=Users,dc=jboss,dc=org", 
              "force" => true, 
              "recursive" => false, 
              "user-dn-attribute" => "dn", 
              "cache" => undefined 
            }
          } 
        }
      }, 
      "plug-in" => undefined, 
      "server-identity" => undefined 
    }
  }

Copy to Clipboard

Toggle word wrap

5.4.2. 示例

5.4.2.1. 阅读 Current Cache 配置
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

5.4.2. 示例

5.4.2.1. 阅读 Current Cache 配置复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

5.4.2.1. 阅读 Current Cache 配置
复制链接