JBoss.orgCommunity Documentation

Chapter 17. Using LdapExtLoginModule with JaasSecurityDomain

This chapter provides guidance on how the LdapExtLoginModule can be used with an encrypted password to be decrypted by a JaasSecurityDomain. This chapter assumes that the LdapExtLoginModule is already running correctly with a non-encrypted password.

The first step is to define the JaasSecurityDomain MBean that is going to be used to decrypt the encrypted version of the password. This can then be added to the $JBOSS_HOME/server/$PROFILE/conf/jboss-service.xml or can be added to a *-service.xml descriptor in the deploy folder.

  <mbean code="org.jboss.security.plugins.JaasSecurityDomain"
         <arg type="java.lang.String" value="jmx-console"></arg>
      <attribute name="KeyStorePass">some_password</attribute>
      <attribute name="Salt">abcdefgh</attribute>
      <attribute name="IterationCount">66</attribute>

This is a simple configuration where the required password, Salt and Iteration Count used for the encryption or decryption are contained within the MBean definition.

It should be noted that the default cipher algorithm used by the JaasSecurityDomain implementation is "PBEwithMD5andDES". This can be modified using the "CipherAlgorithm" attribute.

Ensure that you change the KeyStorePass, Salt, and IterationCount values for your own deployment.

After this MBean has been defined, start the JBoss Enterprise Application Platform. Navigate to the JMX Console (http://localhost:8080/jmx-console/ by default) and select the org.jboss.security.plugins.JaasSecurityDomain MBean.

On the org.jboss.security.plugins.JaasSecurityDomain page, look for the encode64(String password) method. Pass the plain text version of the password being used by the LdapExtLoginModule to this method, and invoke it. The return value should be the encrypted version of the password encoded as Base64.

Within the login module configuration, the following module-options should be set:

 <module-option name="jaasSecurityDomain">jboss.security:service=JaasSecurityDomain,domain=jmx-console</module-option>
  <module-option name="bindCredential">2gx7gcAxcDuaHaJMgO5AVo</module-option> 

The first option is a new option to specify that the JaasSecurityDomain used previously should be used to decrypt the password.

The bindCredential is then replaced with the encrypted form as Base64.