| This
LoginModule performs LDAP-based authentication.
A username and password is verified against the corresponding user
credentials stored in an LDAP directory.
This module requires the supplied
CallbackHandler to support a
NameCallback and a
PasswordCallback .
If authentication is successful then a new
LdapPrincipal is created
using the user's distinguished name and a new
UserPrincipal is
created using the user's username and both are associated
with the current
Subject .
This module operates in one of three modes: search-first,
authentication-first or authentication-only.
A mode is selected by specifying a particular set of options.
In search-first mode, the LDAP directory is searched to determine the
user's distinguished name and then authentication is attempted.
An (anonymous) search is performed using the supplied username in
conjunction with a specified search filter.
If successful then authentication is attempted using the user's
distinguished name and the supplied password.
To enable this mode, set the userFilter option and omit the
authIdentity option.
Use search-first mode when the user's distinguished name is not
known in advance.
In authentication-first mode, authentication is attempted using the
supplied username and password and then the LDAP directory is searched.
If authentication is successful then a search is performed using the
supplied username in conjunction with a specified search filter.
To enable this mode, set the authIdentity and the
userFilter options.
Use authentication-first mode when accessing an LDAP directory
that has been configured to disallow anonymous searches.
In authentication-only mode, authentication is attempted using the
supplied username and password. |