LDAP V2 for WLS 7.0

Question

Has anybody tried to configure LDAP V2 on WLS7.0? According to their edocs, for
LDAP V2, there will templates for different LDAP servers, but all I see is the
tab for V1. V2 tab is no where to be seen. I am using WLS 7.0 GA SP1.
Any info will be appreciated.
John Lee

Answer 1

Hi John
If you can, I recommend moving away from LDAPRealm V2 for WebLogic 7.0
If you use LDAPRealmV2 you are going to be using the older security model
(called "compatibility mode" ) instead of the new 7.0 security structure.
Here are instructions for setting up the new security classes with an
external LDAP server that I've whipped up
Instructions for a scratch domain to set up WLS 7.0 with an external LDAP
server (I am using iPlanet in this example) follow.
I. create a new domain /mydomain
II. start server
III. open WebLogic console in a browser
IV. in left frame, go to
security->realms->myrealm->providers->AuthenticationProviders and click
V. in right frame, click on “Configure a new iPlanet Authenticator”
VI. In the new screen, under General, make sure the Control Flag is set
to Required, select a name for this authenticator, and click Create.
VII. Select iPlanet LDAP tab and fill in values for Host, Port, Principal
where these values reflect the settings for your LDAP server. (Note: the
default principal for an iPlanet LDAP server is uid=admin,
ou=Administrators, ou=TopologyManagement, o=NetscapeRoot). Click Apply.
VIII. Click on Credential: Change. At the new screen, enter the
credential associated with the Principal that you entered in step VII in
both boxes. This will be the password that is used to do a bind to your
LDAP server with the principal. Click Apply.
IX. Select Users tab and make sure these properties accurately reflect
the structure of your LDAP server. Most of the time the only property that
needs to be changed is the User Base DN property, from
ou=people,o=example.com to ou=people,o=myCompany.com. Click Apply.
X. Select Groups tab and make sure these properties accurately reflect
the structure of your LDAP server. Most of the time the only property that
needs to be changed is the Groups Base DN property, from
ou=people,o=example.com to ou=groups,o=myCompany.com. Click Apply.
XI. Now, the boot identity of your server absolutely must be a user that
exists on your LDAP server. You must also have an “Administrators” group on
your LDAP server, and the boot identity must be a user that exists in this
“Administrators” group, or the server will not start. So open your LDAP
console (this will be a console that is specific to the LDAP server you are
using) and use the management tools to create the “Administrators” group and
a user that you place in the “Administrators” group that is the boot
identity that you use to start WebLogic.
XII. Make these changes and restart the server.
XIII. You can verify that the LDAP setup is correct by doing a thread
dump. You should see a thread like:
“LDAPConnThread localhost:389" daemon prio=5 tid=0x8d9b308 nid=0x8f8
runnable [0x9e2f000..0x9e2fdbc]
at java.net.SocketInputStream.socketRead(Native Method)
at java.net.SocketInputStream.read(SocketInputStream.java:86)
at java.io.BufferedInputStream.fill(BufferedInputStream.java:186)
at java.io.BufferedInputStream.read(BufferedInputStream.java:204)
- locked <3281d98> (a java.io.BufferedInputStream)
at
netscape.ldap.ber.stream.BERElement.getElement(BERElement.java:101)
at netscape.ldap.LDAPConnThread.run(LDAPConnThread.java:420)
where “localhost:389” is the server name and port of your
LDAP server. This means that your Authenticator has been set up correctly.
XIV. Now you can delete your default authenticator. Open the WebLogic
console and go to
security->realms->myrealm->providers->AuthenticationProviders in the left
frame, and click
XV. In the right frame, look for DefaultAuthenticator and click on the
trash can to the far right. Say “Yes” when it asks if you are sure, then
click Continue.
XVI. Restart the WebLogic server. If the server boots correctly, you’re
done. Everything is working correctly.
Hope this helps
Joe Jerry
John Lee wrote:
BTW, it is what they have in the edocs.
http://edocs.bea.com/wls/docs70/secmanage/security6.html#1071872
"John Lee" <[email protected]> wrote:
Has anybody tried to configure LDAP V2 on WLS7.0? According to their
edocs, for
LDAP V2, there will templates for different LDAP servers, but all I see
is the
tab for V1. V2 tab is no where to be seen. I am using WLS 7.0 GA SP1.
Any info will be appreciated.
John Lee