title: Java EE : authentification through tomcat+ldap
body: <p>I would like to make an authentication by tomcat using the groups in my ldap to handle the access to my webapp (ex : admins, simple users, developers etc).
  I can at the moment login on my webapp using ldap if I don't use any kind of group.</p>
  
  <p>Here is my relevant sample of code : </p>
  
  <p>web.xml :</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;display-name&gt;Test&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Administrative Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/admin.html&lt;/url-pattern&gt;
          &lt;url-pattern&gt;/blabla.jsp&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;TOTOAdmins&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;security-constraint&gt;
      &lt;display-name&gt;Tomcat Server Configuration Security Constraint&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Protected Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/users/*&lt;/url-pattern&gt;
          &lt;url-pattern&gt;/login&lt;/url-pattern&gt;
          &lt;url-pattern&gt;/error&lt;/url-pattern&gt;
          &lt;url-pattern&gt;/welcome&lt;/url-pattern&gt;
          &lt;url-pattern&gt;/home.do&lt;/url-pattern&gt;
          &lt;url-pattern&gt;/out.do&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;*&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;realm-name&gt;Form-Based Authentication &lt;/realm-name&gt;
      &lt;form-login-config&gt;
          &lt;form-login-page&gt;/login&lt;/form-login-page&gt;
          &lt;form-error-page&gt;/error&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;TOTOAdmins&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;*&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;welcome&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;
  </code></pre>
  
  <p>We can see in this sample taht I would like to give access to some page to all users, but that only users who belongs to TOTOAdmins have access to blabla.jsp &amp; admin.html.</p>
  
  <p>At the moment all people (regardless their groups) have access to the page define in the , but no one can access to blabla.jsp &amp; admin.html.</p>
  
  <p>server.xml : </p>
  
  <pre><code>  &lt;Host name="localhost"  appBase="webapps"
              unpackWARs="true" autoDeploy="true"&gt;
              &lt;Context path="/portal_re" debug="0" reloadable="true" docBase="portal_re"&gt;
        &lt;Realm className="org.apache.catalina.realm.JNDIRealm"
                 debug="99"
                 connectionURL="ldap://XX.X.XX.XXX:XXX"
                 connectionName="cn=XXXXXX,ou=abc,dc=abcdef,dc=xyz"
                 connectionPassword="XXXXXXX"
                 userBase="ou=abc,dc=abcdef,dc=xyz"
                 userSearch="(name={0})"
                 userSubtree="true"
                 userRoleName="memberOf"
                 roleBase="ou=abc,dc=abcdef,dc=xyz"
                 roleSearch="(uniqueMember={0})"
                 roleSubtree="true"
                 roleName="cn"
  /&gt;
  &lt;/Context&gt;
  </code></pre>
  
  <p>When i browse my ldap, every users has a groupe in the member "memberOf", and i defined rolebase/search/subtree/name in terms of how are defined groups into ldap.
  I log into my webapp who has the following attribute in ldap : </p>
  
  <pre><code>memberOf            CN=TOTOAdmins,OU=ABC,DC=ABCDEF,DC=xyz
  </code></pre>
  
  <p>(He is even member of four differents groups, but i dont know if it's relevant)</p>
  
  <p>I dont know if it will help, but on the homepage i have </p>
  
  <pre><code>&lt;h1&gt;&lt;% =request.getUserPrincipal()%&gt;&lt;/h1&gt;
  </code></pre>
  
  <p>and when I log with the users : toto, it prints : </p>
  
  <blockquote>
    <p>GenericPrincipal[toto(CN=Administrators,OU=ABC,DC=ABCDEF,DC=xyz,<strong>CN=TOTOAdmins</strong>,OU=ABC,DC=ABCDEF,DC=xyz,CN=Readers,CN=ABC,DC=ABCDEF,DC=xyz,CN=Users,CN=Roles,DC=ABCDEF,DC=xyz,)</p>
  </blockquote>
  
  <p>Well, you're kind of my last chance.</p>