JAAS, LDAP and RDBMS

Question

Hi,
I need some help developing a SSO (Single Sign-On) service used by the system I'm currently developing. I've read several posts on this forum, but none of them addresses this scenario.
Yeah, I'm a true newbie to this technologies and have only read the tutorials about them, but now I need some help with "best practices", sample code, design. I would be most grateful!
Here's the scenario:
1. A user starts the system.
2. User have the choices of going remote or running locally.
3. If remote is choosen the current user should be validated against a LDAP service, reading some attributes telling us if she have access to remote database and what her read/write permissions are.
4. Database user name and database password is extracted from LDAP service and used in system to create a remote connection to the database.
Hope you guys understand! Password and usernames sent across the network have to be encrypted.
PS. I'm not using J2EE, but it would be nice to have a compliant solution :-)
So, what do you guys think?
Kind regards, Andreas

Answer 1

Hi Andreas,
to do a basic LDAP authentication you can try something like this:
    public java.lang.String ldapAuthentication() {
        Hashtable env = new Hashtable(11);
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://" + THE_LDAP_HOST + ":389/" + THE_LDAP_DOMAIN);
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        String principal = (COMMON_NAME.equals("") ? USER_NAME : COMMON_NAME);
        env.put(Context.SECURITY_PRINCIPAL, principal);
        env.put(Context.SECURITY_CREDENTIALS, THE_PASSWORD);
        try {
            DirContext ctx = new InitialDirContext(env);
            return LDAP_AUTH_OK;
        } catch (AuthenticationException e){
            return LDAP_AUTH_INVALIDCREDENTIALS;
        catch (NamingException e){
            return LDAP_AUTH_NAMINGEXCEPTION;
    }The capitalized words - except the constants in Conext - are the parameters you may change for your specific use.
To connect and Query the LDAP database you should "bind" to the LDAP server with a known username and password and query the Context you have created (ctx in the code above).
For your point #4 i think that you can't extract a password of any user from the LDAP database. It is encrypted.
Try to use kerberos authentication instead and use the ticket you obtain from the kerberos server to authenticate with the RDBMS.
Something about kerberos authentication may be found here
http://forum.java.sun.com/thread.jsp?forum=51&thread=380562&tstart=0&trange=15
Regards,
Andrea Colleoni