Puppet Defined Type: jndi

Defined in:
manifests/realm/jndi.pp

Overview

The relevant documentation:

http://tomcat.apache.org/tomcat-7.0-doc/config/realm.html
http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html

The following URL's also contain useful information.

http://stackoverflow.com/questions/267869/configuring-tomcat-to-authenticate-using-windows-active-directory
http://www.coderanch.com/t/421370/Tomcat/Tomcat-Active-Directory-Windows-Server
 http://stackoverflow.com/questions/1443189/how-to-set-up-tomcat-ldap-authentication-without-member-of-check

The directory realm supports two approaches to the representation of roles in the directory:

1) Roles as explicit directory entries

Roles may be represented by explicit directory entries. A role entry is usually an LDAP group
entry with one attribute containing the name of the role and another whose values are the
distinguished names or usernames of the users in that role. The following attributes configure
a directory search to find the names of roles associated with the authenticated user:

roleBase -  the base entry for the role search. If not specified, the search base is the
    top-level directory context.
roleSubtree -  the search scope. Set to true if you wish to search the entire subtree rooted
    at the roleBase entry. The default value of false requests a single-level
    search including the top level only.
roleSearch -  the LDAP search filter for selecting role entries. It optionally includes
    pattern replacements "{0}" for the distinguished name and/or "{1}" for the
    username of the authenticated user.
roleName -  the attribute in a role entry containing the name of that role

2) Roles as an attribute of the user entry

Role names may also be held as the values of an attribute in the user's directory entry.
Use userRoleName to specify the name of this attribute.

A combination of both approaches to role representation may be used.

Debug logging

http://dev-answers.blogspot.com/2010/03/enable-debugtrace-level-logging-for.html

Include files from server.xml

http://blogs.mulesoft.org/including-files-into-tomcats-server-xml-using-xml-entity-includes/

** There is no way built in to tomcat to obfuscate the password on a JNDI resource **

puppet2sitepp @tomcatrealmjndi

Parameter Summary

  • connection_url (Any)
  • connection_name (Any)
  • connection_password (Any)
  • user_base (Any)
  • role_base (Any)
  • catalina_base (Any) => "/opt/${name}"
  • servicename (Any) => $name
  • order (Any) => '1'
  • role_search (Any) => '(member={0})'
  • role_name (Any) => 'cn'
  • user_search (Any) => '(sAMAccountName={0})'
  • alternate_url (Any) => undef
  • referrals (Any) => 'follow'
  • user_subtree (Any) => true
  • role_subtree (Any) => true
  • role_nested (Any) => true
  • user_role_name (Any) => 'memberOf'