JBoss SSO学习笔记4 openldap

昨天测试openldap和jboss sso一直不成功，今天终于搞定，主要就是openldap的schemas。

jboss sso文档中如下写：

 * This implementation supports the following standard LDAP schemas:
 * User Identity Information stored in InetOrgPerson schema
 * Role Information stored in GroupOfUniqueNames schema
但是如何建立针对jboss sso这样的schemas那？

1、一个基本的ldap schema

#base
dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: example
o: Example Company

#opeldap manager user
dn: cn=Manager,dc=example,dc=com
objectClass: organizationalRole
objectClass: top
cn: Manager

#我们用户的ou
dn: ou=testPeople,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: testPeople

#一个基本的inetOrgPerson
dn: cn=Test User,ou=testPeople,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: Test User
displayName: Test User
ou: testPeople
sn: Test
uid: test
userPassword:: e01ENX1hWTFSb1oyS0VoemxnVW1kZTNBV2FBPT0=

#我们用户组的ou
dn: ou=roles,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: roles
 
#用户组为ou=roles的成员
dn: cn=TestGroup,ou=roles,dc=example,dc=com
objectClass: groupOfUniqueNames
objectClass: top
cn: TestGroup
uniqueMember: cn=Test User,ou=testPeople

2、对应上面的schema， jboss-sso.sar/conf/sso.cfg.xml 的配置如下：

<?xml version='1.0' encoding='ISO-8859-1'?>
<jboss-sso>
<identity-management>
    <login>
        <provider id="si:jboss-sso:ldap:login" class="org.jboss.security.idm.ldap.LDAPIdentityProvider">
                <property name="connectionURL">
                jdbc:ldap://localhost:389/dc=example,dc=com?SEARCH_SCOPE:=subTreeScope&secure:=false&concat_atts:=true&size_limit:=10000000</property>
                <property name="username">cn=manager,dc=example,dc=com</property>
                <property name="password">secret</property>
                <!-- ou that contains all your inetOrgPersons -->
                <property name="identityOu">testPeople</property>
                <!-- ou that contains your groups -->
                <property name="roleOu">roles</property>
        </provider>
    </login>
    <!--login>
         <provider id="si:jboss-sso:demo:login" class="org.jboss.security.idm.demo.DemoLoginProvider"/>                         
    </login-->
</identity-management>
    <sso-processor>      
     <processor class="org.jboss.security.saml.JBossSingleSignOn">         
      <property name="trustServer">http://zjftest1.jboss.com:8080/federate/trust</property>      
     </processor>  
    </sso-processor>
</jboss-sso>
启动jboss，测试成功ok！
如果启动jboss的时候报错"No such object"jdbc，说明ldap schema错误，不能找到对应的ou。
jboss启动的时候就会调用setProperties进行属性配置，在LDAPIdentityProvider.java类中，
setProperties方法中调用了方法：this.restoreIdentities(); this.restoreRoles();如果没有正确的ou，启动就会报错！