If you plan to use an LDAP registry with your Jazz™ Team Server, you must configure your Apache Tomcat or WebSphere® Application Server to use an LDAP registry to authenticate users.
Parameter | Value description |
---|---|
LDAP Registry Location | The URL that references your LDAP server. ldap://ldap.example.com:389 |
User Name | The user name to log in to this LDAP server. Some LDAP servers allow anonymous login and password. In this case, this parameter is blank. |
Password | The password associated with the user name. |
Base User DN | The search base indicates where in the hierarchy to begin the search for the users. For example, "o=company,l=your city,c=your country" |
User Property Names Mapping | The mapping of Jazz user
property names to LDAP registry entry attribute names. You must define
the following mappings:
The userid property identifies the user ID that is used when a user logs into the system. The name property is used to render the name in the user interface. For example, userId=mail,name=cn,emailAddress=mail |
Base Group DN | This search base indicates where in the hierarchy to begin the search of group names, for example, ou=memberlist,ou=yourgroups,o=example.com |
Jazz to LDAP Group Mapping | The mapping between Jazz groups
and LDAP groups. One Jazz group can be mapped to multiple
LDAP groups. The LDAP groups must be separated by a semicolon. For
example, JazzAdmins=LDAPAdmins1;LDAPAdmins2 maps JazzAdmins group
to LDAPAdmins1 and LDAPAdmins2. The Jazz Team
Server defines five groups to map with:
|
Group Name Property | The LDAP Property that represents the name of the Jazz groups in the LDAP registry. For example, cn. This is used in the query to retrieve an LDAP group. To retrieve an LDAP group, a query uses a combination of the Base group DN and the Group Name Property. |
Group Member Property | The LDAP Property that represent the members of a group in the LDAP registry. For example, uniquemember. |
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" digest="SHA-1" digestEncoding="UTF-8"/>
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" digest="SHA-1" digestEncoding="UTF-8"/>
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99" connectionURL="ldap://ldap.company.com:389" roleBase="cn=Groups,dc=company,dc=com" roleSearch="(uniquemember={0})" roleName="cn" userBase="cn=Users,dc=company,dc=com" userSearch="(uid={0})"/>Add the following tag for Microsoft Active Directory:
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99" connectionURL="ldap://ldap.company.com:3268" authentication="simple" referrals="follow" connectionName="cn=LDAPUser,ou=Service Accounts,dc=company,dc=com" connectionPassword="VerySecretPassword" userSearch="(sAMAccountName={0})" userBase="dc=company,dc=com" userSubtree="true" roleSearch="(member={0})" roleName="cn" roleSubtree="true" roleBase="dc=company,dc=com"/>
<web-app id="WebApp"> <servlet id="bridge"> <servlet-name>equinoxbridgeservlet</servlet-name> <display-name>Equinox Bridge Servlet</display-name> <description>Equinox Bridge Servlet</description> <servlet-class>org.eclipse.equinox.servletbridge.BridgeServlet</servlet-class> <init-param><!-- ... --></init-param> <!-- ... --> <load-on-startup>1</load-on-startup> <!-- Addendum If the names of your LDAP Groups are the same as the default Jazz roles you don't need to add the following tags --> <security-role-ref> <role-name>JazzAdmins</role-name> <role-link>[LDAP Group for Jazz admins]</role-link> </security-role-ref> <security-role-ref> <role-name>JazzDWAdmins</role-name> <role-link>[LDAP Group for Jazz admins]</role-link> </security-role-ref> <security-role-ref> <role-name>JazzGuests</role-name> <role-link>[LDAP Group for Jazz admins]</role-link> </security-role-ref> <security-role-ref> <role-name>JazzUsers</role-name> <role-link>[LDAP Group for Jazz admins]</role-link> </security-role-ref> <security-role-ref> <role-name>JazzProjectAdmins</role-name> <role-link>[LDAP Group for Jazz admins]</role-link> </security-role-ref> </servlet> <!-- ... --> </web-app>Use the following tags to declare the LDAP groups as security roles:
<web-app id="WebApp"> <servlet id="bridge"> <!-- ... --> <security-role> <role-name>JazzAdmins</role-name> <role-name>JazzDWAdmins</role-name> <role-name>JazzGuests</role-name> <role-name>JazzUsers</role-name> <role-name>JazzProjectAdmins</role-name> <!-- Addendum If the names of your LDAP Groups are the same as the default Jazz roles you don't need to add the following tags --> <role-name>[LDAP Group for Jazz Admins]</role-name> <role-name>[LDAP Group for Jazz Data Warehouse Admins]</role-name> <role-name>[LDAP Group for Jazz Guests]</role-name> <role-name>[LDAP Group for Jazz Users]</role-name> <role-name>[LDAP Group for Jazz Project Admins]</role-name> <!-- End Addendum --> </security-role> <!-- ... --> </web-app>Use the following tags to update the security-constraint section:
<web-app id="WebApp"> <!-- ... --> <security-constraint> <web-resource-collection> <web-resource-name>secure</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>JazzUsers</role-name> <role-name>JazzAdmins</role-name> <role-name>JazzGuests</role-name> <role-name>JazzDWAdmins</role-name> <role-name>JazzProjectAdmins</role-name> <!-- Addendum If the names of your LDAP Groups are the same as the default Jazz roles you don't need to add the following tags --> <role-name>[LDAP Group for Jazz Admins]</role-name> <role-name>[LDAP Group for Jazz Data Warehouse Admins]</role-name> <role-name>[LDAP Group for Jazz Guests]</role-name> <role-name>[LDAP Group for Jazz Users]</role-name> <role-name>[LDAP Group for Jazz Project Admins]</role-name> <!-- End Addendum --> </auth-constraint> <user-data-constarint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> <!-- ... --> </web-app>Repeat the same addendum on each security-constraint referencing a Jazz group:
<web-app id="WebApp"> <!-- ... --> <security-constraint> <web-resource-collection> <web-resource-name>adminsecure</web-resource-name> <url-pattern>/admin/cmd/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>JazzAdmins</role-name> <!-- Addendum --> <role-name>[LDAP Group for Jazz Admins]</role-name> <!-- End addendum --> </auth-constraint> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint> <!-- ... --> </web-app>