question Re: Connecting knox and ldap in production evironment in Archives of Support Questions (Read Only)

Connecting knox and ldap in production evironment

reyaan26 — Wed, 05 Oct 2016 17:46:05 GMT

Need some guindance using knox and authenticate users using LDAP in actual environment, but before moving there i want to have same setup on my PC.Installed sandbox 2.3.2 , and knox is running using using demo ldap and ran couple of curl commands as well .Installed openldap , phpldapadmin on another VM (supposing it will be the case in prod environment). Both VMs are having brdiged connection and is able to ping each other.Now as per the documention , i need to create a topology file . Based on my understanding it will be like below:-
Now after starting knox gateway again, how it will communicate with ldap??
ldap.jar is for demo ldap , which jar will be used in this case.??
does i need to install openldap clients ??

Any pointers or tutorial will be great help!!

	<provider>
    <role>authentication</role>
    <name>ShiroProvider</name>
    <enabled>true</enabled>
    <param>
        <name>main.ldapRealm</name>
        <value>org.apache.shiro.realm.ldap.JndiLdapRealm</value>
    <param>
    <param>
        <name>main.ldapRealm.userDnTemplate</name>
        <value>uid={0},ou=hadoopdev,dc=my-ldap,dc=com</value>
    </param>
    <param>
        <name>main.ldapRealm.contextFactory.url</name>
        <value>ldap://192.XX.XX.XX:389</value>
    </param>
    <param>
        <name>main.ldapRealm.contextFactory.authenticationMechanism</name>
        <value>simple</value>
    </param>
    <param>
        <name>urls./**</name>
        <value>$auth_type</value>
    </param>
    <param>
        <name>sessionTimeout</name>
        <value>$minutes</value>
    </param>
</provider>

Re: Connecting knox and ldap in production evironment

WhiteHa — Wed, 05 Oct 2016 18:21:15 GMT

Apache Knox uses Shiro for LDAP authentication. You can put the details of your LDAP server and port in topology file. Knox will use the LDAP Server IP Address and Port to communicate. If you are using OpenLDAP to authenticate, you can safely stop Demo LDAP service in Knox. Yes you need to install openldap, openldap-clients, and openldap-servers package.

Re: Connecting knox and ldap in production evironment

sshimpi — Wed, 05 Oct 2016 18:24:32 GMT

@Anwaar Siddiqui

1. Knox gateway will check for the respective topology file which has the ldap settings configured[if you have integrated knox with ldap]

2. For demo ldap - you can use "ps -aef |grep ldap" command to check which is the jar being picked up.

3. You will need to have openldap clients on all nodes to make sure the user exist on all nodes.

Below link will have more details - http://knox.apache.org/books/knox-0-8-0/user-guide.html#Introduction

Re: Connecting knox and ldap in production evironment

reyaan26 — Thu, 06 Oct 2016 22:26:52 GMT

@Krishna Pandey

@Sagar Shimpi

Its working now as my 389 port was blocked on my VM having LDAP running..Thanks.!!