How to Use LDAP with CQ / AEM

Use case: Configure LDAP with CQ / AEM

Why There are some changes in LDAP configuration in CQ5.5 and documetation is still in progress. Before actual documentation comes, Here is few things you should know

Pre requisite Keep http://dev.day.com/docs/en/cq/current/core/administering/ldap_authentication.html on side. I will mention things changed.

No sample_ldap_login.conf under crx-quickstart\server\etc : In fact there is no crx-quickstart\server\etc. You can put your sample_ldap_login.conf any where you want. You can get sample ldap.conf from http://dev.day.com/content/kb/home/cq5/CQ5SystemAdministration/LdapConfig.html or here

2) Once downloaded you can put this file to any location (I prefer /crx-quickstart/conf) and then change your start script to point to this location.

3) I have seen, LDAP not starting because of some wrong configuration in repository.xml. Also attaching sample repository.xml that you can use directly in CQ5.5 / CRX2.3

How to enable logging for LDAP in CQ5.5 / CQ5.6
1) Note that LDAP module is now deployed as OSGI module. You have to follow following step to enable logging for LDAP

[1] Log into Felix Console: http://<host>:<port>/system/console/configMgr
[2] From "Factory Configurations", create "Apache Sling Logging Writer Configuration"
[2.1] Set value of "Log File" to "../logs/ldap.log"
[2.2] Click on "Save"
[3] From "Factory Configurations", create "Apache Sling Logging Logger Configuration"
[3.1] Set value of "Log Level" to "Debug"
[3.2] Set value of "Log File" to "../logs/ldap.log"
[3.3] Add "Logger" => com.day.crx.security.ldap
[3.4] Click on "Save"

Step [2] is require for log rotation, If you don't want to rotate log then skip that step.

user purge and sync option In CQ5.5 GA release, there is no user purge and sync option. This is moved to JMX. This option is now available as CQ5.5 Update Package 1, That you can download it from package share. To use this option, Please install CQ5.5 Update 1, Start CQ with LDAP enable and then go to Felix JMX console. You would see something like this

Full path in JVM Param I have seen issues with some customer where using relative path for ldap.conf file does not work. Please use complete path of file system instead.

Change in start script: CQ5.5 OOTB has options enabled for jass config. You can use following environment variable to enable LDAP through start script

CQ_USE_JAAS='true'
CQ_JAAS_CONFIG='< Complete Path to LDAP conf file>'

See how it is used in start script

if [ $CQ_USE_JAAS ]; then
START_OPTS="${START_OPTS} -Djava.security.auth.login.config=${CQ_JAAS_CONFIG}"

Secure LDAP Password:

http://helpx.adobe.com/experience-manager/kb/encrypted-password-jaas-config.html

One more interesting Blog http://www.citytechinc.com/us/en/blog/2012/03/adobe_cq5_5_and_ldap.html

Hope fully all changes are covered. Shoot me any question if it is not clear for LDAP with CQ5.5.


Configure LDAP in CQ / AEM6

In CQ6 All login module can be configured as Pluggable Login Module. What that mean is there is no need to create JAAS config through start up param. You can configure your LDAP using OSGI config. Steps of how to do that can be found from

http://docs.adobe.com/docs/en/aem/6-0/administer/security/ldap-config.html

How to create OSGI config can be found from here http://www.wemblog.com/2012/10/how-to-work-with-configurations-in-cq.html

this is how sample LDAP config will look like in AEM6 (Here custom can be any thing)

/apps
 /yourcompany
   /configurations
       /config.author
         /org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider-custom.xml
         /org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncHandler-custom.xml
         /org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModuleFactory-custom.xml


Here is how content of these file look like,

1) org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider-custom.xml

There are more attribute as well please read above documentation for that.

<?xml version="1.0" encoding="UTF-8"?>

<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"

    jcr:primaryType="sling:OsgiConfig"

    provider.name="custom_ldap"

    host.name="server-name"

    host.port="server-port"

    bind.dn="same as authDn"

    bind.password="same as password"

    user.baseDN="same as userRoot"

    user.idAttribute="same as userIdAttribute"

    user.extraFilter="same as userFilter"

    group.baseDN="same as groupRoot"

    group.extraFilter="same as groupFilter"/>

2) org.apache.jackrabbit.oak.spi.security.authentication.external.impl.DefaultSyncHandler-custom.xml

following property could defer based on your LDAP.

<?xml version="1.0" encoding="UTF-8"?>

<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"

    jcr:primaryType="sling:OsgiConfig"

    handler.name="custom_ldap_handler"

    user.expirationTime="1d"

    user.autoMembership="[any CQ group]"

    user.propertyMapping="[rep:email=mail,rep:fullName=cn,profile/email=mail,profile/familyName=sn,profile/givenName=gn]"

    user.membershipExpTime="1d"

    group.propertyMapping="[description=description,rep:email=mail,rep:fullname=cn]"

    />

3) org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModuleFactory-custom.xml

<?xml version="1.0" encoding="UTF-8"?>

<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0"

  xmlns:jcr="http://www.jcp.org/jcr/1.0" 

  jcr:primaryType="sling:OsgiConfig"

  jaas.controlFlag="REQUIRED"

  idp.name="custom_ldap" 

  sync.handlerName="custom_ldap_handler" />