Authentication against LDAP (a.k.a “Basic” or “Internal”)#
Overview#
The 'Basic' or 'Internal' method is used to implement username / password authentication.
Basic authentication relies on a successful LDAP BIND operation against an LDAP directory--either the local LDAP included in the Gluu Server, or a backend LDAP server like Active Directory that has been configured for use with the Gluu Server via Cache Refresh.
Prerequisites#
- Installed Gluu Server
- Basic authentication script
- If remote LDAP / AD server then
- Network connectivity between Gluu Server and backend AD/LDAP
- Remote Active Directory / LDAP bind information.
- Successful completion of Cache Refresh
Properties#
The script has the following properties:
Property | Description | Example |
---|---|---|
Name | Name of the authentication module | basic |
Description | Description of the purpose of this script | Basic AuthN Script |
Programming Language | Script Developed with Python | Python |
Location type | Where this script is located inside Gluu Server | Ldap |
Usage type | Purpose of usage | Native |
Custom property | Customization properties | Not required by default |
Script | The main python script | No change required by default |
Enable 'Basic' Authentication#
Basic authentication should be enabled out-of-the-box. In case it needs to be re-enabled, follow these steps:
- Navitage to
Configuration
>Manage Custom Scripts
- Expand
basic
- Check the box to
Enabled
the script - You can tail
oxauth_script.log
to check successful initialization of this scriptGLUU.[root@gluu logs]# tail -f oxauth_script.log 2018-01-10 10:39:16,847 INFO [oxAuthScheduler_Worker-5] [org.xdi.service.PythonService$PythonLoggerOutputStream] (PythonService.java:209) - Basic. Initialization 2018-01-10 10:39:16,853 INFO [oxAuthScheduler_Worker-5] [org.xdi.service.PythonService$PythonLoggerOutputStream] (PythonService.java:209) - Basic. Initialized successfully
Backend AD/LDAP#
If a backend AD or LDAP is being used to store passwords and authenticate users, navigate to: Configuration
> Manage authentication
> Manage LDAP Authentication
and provide information on the backend directory, incuding bindDN, bindDN user password, Primary Key ( don't change local primary_key ), Server Name / IP along with port and BaseDN/s.
A more detailed description of each field can be found in the Manage Authentication section of the Gluu docs.
Make 'Basic' the Default#
By default, basic authentication is the default authentication method for the Gluu Server. In case it needs to be reset, follow these steps:
- Navigate to
Configuration
>Manage Authentication
>Default Authentication Method
- Select 'basic' for 'Default acr' and / or 'oxTrust acr'
Using Basic Authentication#
Open up a new browser or incognito window, try to login into your Gluu Server or perform SSOn with an SP or RP.
Password reset in local Gluu LDAP#
If passwords are stored locally, Gluu admins can reset a user's password in two ways:
- Using oxTrust:
- Navigate to
Users
>Manage People
- Find the target user
- Click the
Update Password
button at the bottom of the user record -
Set the new password
-
Using LDAP:
- Access the local LDAP following these instructions
- Search for user with 'uid' or 'mail' attribute
- Password attribute ( userPassword ) can be changed using ldapmodify commands
Password reset in Remote Backend Server#
It's possible to reset a user's password in a Remote Backend Server, but requires configuration of a different Authentication module.