topic Re: Programmatically LDAP configuration in Alfresco Archive

Programmatically LDAP configuration

matutano6 — Fri, 22 May 2015 15:43:28 GMT

Hi,I'm trying to configure LDAP on a ProcessEngine by doing it programmatically on Activiti 5.14. First, I want to use the default configuration resource (i.e. activiti.cf.xml) and then configure the LDAP properties. Everythings seems to work until the engine tries to do queries to the LDAP server;

Re: Programmatically LDAP configuration

matutano6 — Wed, 27 May 2015 13:51:09 GMT

Hi everyone,
I found the problem and I want to share the experience.

Effectively, the problem was that the InitialDirContext could not be created, but the exception was not logged due to the configuration of the logger. The exception thrown was:

<code>
Caused by: javax.naming.NamingException: Cannot parse url: 1xx.2xx.3xx.4xx:10389 [Root exception is java.net.MalformedURLException: Not an LDAP URL: 1xx.2xx.3xx.4xx:10389]
at com.sun.jndi.ldap.LdapURL.<init>(LdapURL.java:95)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:164)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
at javax.naming.InitialContext.init(InitialContext.java:240)
at javax.naming.InitialContext.<init>(InitialContext.java:214)
at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:99)
at org.activiti.ldap.LDAPConnectionUtil.createDirectoryContext(LDAPConnectionUtil.java:54)
… 204 more
Caused by: java.net.MalformedURLException: Not an LDAP URL: 1xx.2xx.3xx.4xx:10389
at com.sun.jndi.ldap.LdapURL.<init>(LdapURL.java:89)
… 214 more
</code>

After looking at the code, the LDAPConnectionUtil does the following:
<code>
properties.put(Context.PROVIDER_URL, ldapConfigurator.getServer() + ":" + ldapConfigurator.getPort());
</code>

It means that the resulting string after the concatenation of <em>ldapConfigurator.getServer() + ":" + ldapConfigurator.getPort()</em> should contain the URL's scheme (i.e. ldap:// or ldaps://). Immediatelly, a looked into the activiti.cfg.cml and remember that the scheme must be part of the server element:
<code>
<property name="server" value="ldap://1xx.2xx.3xx.4xx" />
</code>

So, the short story: remember to add the scheme!

And finally, I would like to suggest a tweak here. The LDAP could be cofigured using an URL instead of an IP (with scheme) and a TCP port. If I'm not wrong, software that use LDAP are tending to configure the connection through an URL.

Regards,
M.

Re: Programmatically LDAP configuration

jbarrez — Tue, 02 Jun 2015 19:07:51 GMT

Thanks for sharing the solution to your problem!

I'ù not following the remark about the URL. Do you mean that we should not use 'ldapConfigurator.getServer() + ":" + ldapConfigurator.getPort()', but pass a URl directly?

Re: Programmatically LDAP configuration

matutano6 — Tue, 02 Jun 2015 19:30:54 GMT

Hi Joram,
IMHO, I think there should be two possible ways of configuring the LDAP server:

1. Scheme, server and port as three separate properties
<code>
properties.put(Context.PROVIDER_URL, ldapConfigurator.getScheme() + "://" + ldapConfigurator.getServer() + ":" + ldapConfigurator.getPort());
</code>

2. A complete URL including scheme, server and port, and possibly some other connection options (sometimes, LDAP server specific ones)
<code>
properties.put(Context.PROVIDER_URL, ldapConfigurator.getConnectionURL());
</code>

Without the addition of other parameters, the first options will not have the possibility of specifying other options, like root o partition in URLs like this:
ldap://localhost:389/ou=employees,dc=company,dc=org

That kind of connection options are not currently supported with the LDAPConfigurator, are they?

I'm really not an expert with LDAP, but an experienced user. May be the best answers could be found at the source: http://www.ietf.org/rfc/rfc2255.txt

Thanks for considering my suggestions!

Regards,
M.