Configuring LDAP with AEM 6

Last update: April 9, 2024

CREATED FOR:

  • Admin

LDAP (the L ightweight D irectory A ccess P rotocol) is used for accessing centralized directory services. It helps reduce the effort required to manage user accounts as they can be accessed by multiple applications. One such LDAP server is Active Directory. LDAP is often used to achieve Single Sign On which allows a user to access multiple applications after logging in once.

User accounts can be synchronized between the LDAP server and the repository, with LDAP account details being saved in the repository. This functionality allows the accounts to be assigned to repository groups for allocating the required permissions and privileges.

The repository uses LDAP authentication to authenticate such users, with credentials being passed to the LDAP server for validation, which is required before allowing access to the repository. To improve performance, successfully validated credentials can be cached by the repository, with an expiry timeout to ensure that revalidation does occur after an appropriate period.

When an account is removed from the LDAP server, validation is no longer granted and access to the repository is denied. Details of LDAP accounts that are saved in the repository can also be purged.

Use of such accounts is transparent to your users. That is, they see no difference between user and group accounts created from LDAP, and accounts created solely in the repository.

In AEM 6, LDAP support comes with a new implementation that requires a different type of configuration than with previous versions.

All LDAP configurations are now available as OSGi configurations. They can be configured via the Web Management console at:
https://serveraddress:4502/system/console/configMgr

To have LDAP working with AEM, you must create three OSGi configurations:

  1. An LDAP Identity Provider (IDP).
  2. A Sync Handler.
  3. An External Login Module.
NOTE
To read an example of configuring Experience Manager with Apache DS, see Configuring Adobe Experience Manager 6.5 to use Apache Directory Service.

Configuring The LDAP Identity Provider

The LDAP Identity Provider is used to define how users are retrieved from the LDAP server.

It can be found in the management console under the Apache Jackrabbit Oak LDAP Identity Provider name.

The following configuration options are available for the LDAP Identity Provider:

LDAP Provider NameName of this LDAP provider configuration.
LDAP Server HostnameHostname of the LDAP server
LDAP Server PortPort of the LDAP server
Use SSLIndicates if an SSL (LDAPs) connection should be used.
Use TLSIndicates if TLS should be started on connections.
Disable certificate checkingIndicates if server certificate validation should be disabled.
Bind DNDN of the user for authentication. If this field is left empty, an anonymous bind is performed.
Bind PasswordPassword of the user for authentication
Search timeoutTime until a search times out
Admin pool max activeThe maximum active size of the admin connection pool.
User pool max activeThe maximum active size of the user connection pool.
User base DNThe DN for user searches
User object classesThe list of object classes that a user entry must contain.
User id attributeName of the attribute that contains the user id.
User extra filterExtra LDAP filter to use when searching for users. The final filter is formatted like: '(&(<idAttr>=<userId>)(objectclass=<objectclass>)<extraFilter>)' (user.extraFilter)
User DN pathsControls if the DN should be used for calculating a portion of the intermediate path.
Group base DNThe base DN for group searches.
Group object classesThe list of object classes a group entry must contain.
Group name attributeName of the attribute that contains the group name.
Group extra filterExtra LDAP filter to use when searching for groups. The final filter isformatted like: '(&(<nameAttr>=<groupName>)(objectclass=<objectclass>)<extraFilter>)'
Group DN pathsControls if the DN should be used for calculating a portion of the intermediate path.
Group member attributeGroup attribute that contains one or more members of a group.

Configuring The Synchronization Handler

The synchronization handler defines how the Identity Provider users and groups are synchronized with the repository.

It is located under the Apache Jackrabbit Oak Default Sync Handler name in the management console.

The following configurations options are available for the Synchronization Handler:

Sync Handler NameName of the sync configuration.
User Expiration TimeDuration until a synced user gets expired.
User auto membershipList of groups that a synced user is automatically added to.
User property mappingList-mapping definition of local properties from external ones.
User Path PrefixThe path prefix used when creating users.
User Membership ExpirationTime after which membership expires.
User membership nesting depthReturns the maximum depth of group nesting when membership relations are synced. A value of 0 effectively disables group membership lookup. A value of 1 only adds the direct groups of a user. This value has no effect when syncing individual groups only when syncing a users membership ancestry.
Group Expiration TimeDuration until a synced group expires.
Group auto membershipList of groups that a synced group is automatically added to.
Group property mappingList-mapping definition of local properties from external ones.
Group path prefixThe path prefix used when creating groups.

The external login module

The external login module is located under the Apache Jackrabbit Oak External Login Module under the management console.

NOTE
The Apache Jackrabbit Oak External Login Module implements the Java™ Authentication and Authorization Servi (JAAS) specifications. See the official Oracle Java™ Security Reference Guide for more information.

Its job is to define which Identity Provider and Sync Handler to use, effectively binding the two modules.

The following configuration options are available:

JAAS RankingSpecifying the ranking (that is, sort order) of this login module entry. The entries are sorted in a descending order (that is, higher value ranked configurations come first).
JAAS Control FlagProperty specifying whether a LoginModule is REQUIRED, REQUISITE, SUFFICIENT, or OPTIONAL. See the JAAS configuration documentation for more details around the meaning of these flags.
JAAS RealmThe realm name (or application name) against which the LoginModule is registered. If no realm name is provided, then LoginModule is registered with a default realm as configured in the Felix JAAS configuration.
Identity Provider NameName of the identity provider.
Sync Handler NameName of the sync handler.
NOTE
If you plan on having more than one LDAP configuration with your AEM instance, separate Identity Providers and Synchronization Handlers must be created for each configuration.