title: Mapping LDAP groups to roles in JBoss 5
body: <p>I'm trying to authenticate users of the administrative consoles (Admin, JMX, JBoss Web and JBoss WS) using an LDAP provider defined in <code>conf/login-config.xml</code>:</p>
  
  <pre><code>  &lt;application-policy name="LDAP"&gt;
      &lt;authentication&gt;
        &lt;login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required"&gt;
          &lt;module-option name="java.naming.factory.initial"&gt;com.sun.jndi.ldap.LdapCtxFactory&lt;/module-option&gt;
          &lt;module-option name="java.naming.provider.url"&gt;ldaps://ldap.company.com:636&lt;/module-option&gt;
          &lt;module-option name="java.naming.security.protocol"&gt;ssl&lt;/module-option&gt;
          &lt;module-option name="java.naming.security.authentication"&gt;simple&lt;/module-option&gt;
          &lt;module-option name="bindDN"&gt;uid=dummy,cn=users,cn=accounts,dc=company,dc=com&lt;/module-option&gt;
          &lt;module-option name="bindCredential"&gt;secret&lt;/module-option&gt;
          &lt;module-option name="baseCtxDN"&gt;cn=accounts,dc=company,dc=com&lt;/module-option&gt;
          &lt;module-option name="baseFilter"&gt;(&amp;#038;(objectClass=inetOrgPerson)(uid={0}))&lt;/module-option&gt;
          &lt;module-option name="rolesCtxDN"&gt;cn=groups,cn=accounts,dc=company,dc=com&lt;/module-option&gt;
          &lt;module-option name="roleAttributeID"&gt;dn&lt;/module-option&gt;
          &lt;module-option name="roleFilter"&gt;(&amp;#038;(objectClass=posixgroup)(member={1}))&lt;/module-option&gt;
          &lt;module-option name="roleRecursion"&gt;-1&lt;/module-option&gt;
          &lt;module-option name="searchScope"&gt;SUBTREE_SCOPE&lt;/module-option&gt;
          &lt;module-option name="allowEmptyPasswords"&gt;false&lt;/module-option&gt;
          &lt;module-option name="searchTimeLimit"&gt;-1&lt;/module-option&gt;
        &lt;/login-module&gt;
        &lt;!-- This login-module is used only in one use case, see below for details
        &lt;login-module code="org.jboss.security.auth.spi.RoleMappingLoginModule" flag="optional"&gt;
          &lt;module-option name="rolesProperties"&gt;props/admin-console-roles.properties&lt;/module-option&gt;
        &lt;/login-module&gt;
        --&gt;
      &lt;/authentication&gt;
    &lt;/application-policy&gt;
  </code></pre>
  
  <p>The appropriate JAAS config has been set in the following files:</p>
  
  <pre><code>$ grep LDAP /usr/share/jbossas/server/node1/deploy/admin-console.war/WEB-INF/*xml
  /usr/share/jbossas/server/node1/deploy/admin-console.war/WEB-INF/components.xml:    &lt;security:identity authenticate-method="#{authenticator.authenticate}" jaas-config-name="LDAP"/&gt;
  /usr/share/jbossas/server/node1/deploy/admin-console.war/WEB-INF/jboss-web.xml:    &lt;security-domain flushOnSessionInvalidation="true"&gt;java:/jaas/LDAP&lt;/security-domain&gt;
  </code></pre>
  
  <p>Connection with the LDAP server works correctly. I have verified that capturing traffic using <code>wireshark</code> and setting <code>org.jboss.secutiry</code> logging to <code>TRACE</code> in <code>jboss-log4j.xml</code>:</p>
  
  <pre><code>&lt;category name="org.jboss.security.auth.spi"&gt;
    &lt;priority value="TRACE" class="org.jboss.logging.XLevel"&gt;&lt;/priority&gt;
  &lt;/category&gt;
  </code></pre>
  
  <p>I have also set <code>DEBUG</code> level for the <code>org.jboss.seam</code> component:</p>
  
  <pre><code>&lt;category name="org.jboss.seam"&gt;
    &lt;priority value="DEBUG"/&gt;
  &lt;/category&gt;
  </code></pre>
  
  <p>which also verifies that the authentication step is working correctly:</p>
  
  <pre><code>2014-06-09 16:42:41,189 DEBUG [org.jboss.seam.security.Identity] (http-192.0.2.1-8080-6) Login successful for: someuser
  </code></pre>
  
  <p>There seems to be a problem with authorization, I can't access the <code>admin-console</code> even though the user is correctly authenticated. I've tried two different approaches:</p>
  
  <ol>
  <li><p>As I don't have a group in my LDAP named <code>JBossAdmin</code> (which is the role used by default):</p>
  
  <pre><code>$ grep JBossAdmin -R *
  facelets/resourceNavigation.xhtml:        &lt;h:form id="navTreeForm" rendered="#{s:hasRole('JBossAdmin')}"&gt;
  pages.xml:            &lt;rule if="#{s:hasRole('JBossAdmin')}"&gt;
  pages.xml:        &lt;restrict&gt;#{s:hasRole('JBossAdmin')}&lt;/restrict&gt;
  web.xml:        &lt;role-name&gt;JBossAdmin&lt;/role-name&gt;
  </code></pre>
  
  <p>I'm trying to map my LDAP groups and JBoss roles using the <code>RoleMappingLoginModule</code>:</p>
  
  <pre><code>  &lt;login-module code="org.jboss.security.auth.spi.RoleMappingLoginModule" flag="optional"&gt;
      &lt;module-option name="rolesProperties"&gt;props/admin-console-roles.properties&lt;/module-option&gt;
    &lt;/login-module&gt;
  </code></pre>
  
  <p>The contents of the <code>props/admin-console-roles.properties</code> is:</p>
  
  <pre><code>someuser=JBossAdmin
  </code></pre>
  
  <p>as documented, the syntax is <code>username=role1,role2</code>.</p></li>
  <li><p>Replace the occurrences of <code>JBossAdmin</code> with one of the groups present in the LDAP structure, say <code>developers</code>:</p>
  
  <pre><code>$ grep developers -R *
  facelets/resourceNavigation.xhtml:        &lt;h:form id="navTreeForm" rendered="#{s:hasRole('developers')}"&gt;
  pages.xml:            &lt;rule if="#{s:hasRole('developers')}"&gt;
  pages.xml:        &lt;restrict&gt;#{s:hasRole('developers')}&lt;/restrict&gt;
  web.xml:        &lt;role-name&gt;developers&lt;/role-name&gt;
  </code></pre></li>
  </ol>
  
  <p>Neither of the two work. I'm stuck at the login page.Moreover, if I insist and press the login button again, I'm greeted with this:</p>
  
  <p><img src="https://i.stack.imgur.com/EUgOP.png" alt="admin-console"></p>
  
  <p>How can I debug it further? Is it possible to map LDAP groups to roles in JBoss 5? Can group names (instead of user names) be used in a <code>role.properties</code> file when using <code>RoleMappingLoginModule</code>?</p>