Live Forms v7.4 is no longer supported. Please visit Live Forms Latest for our current Cloud Release. Earlier documentation is available too.

Configuring the LDAP Container Security Manager

Owned by Former user (Deleted)
Last updated: Nov 29, 2018 by Former user (Deleted)

Sometimes, is deployed to an existing servlet container that is already handling user authentications through, for instance, LDAP. Here the authentication is the responsibility of the container, but is still responsible for the runtime authorization and the design time querying of user metadata. The LDAP Container Security Manager reuses the existing LDAP connector but relies on the container for user authentications.

 

frevvo only supports/certifies the LDAP Container Security Manager in the Apache Tomcat container. Refer to our Supported Platforms for the list of Application Servers supported/certified by frevvo.

  

On this page:

Active Directory Requirements

  • There must be a frevvo.User group in Active Directory
  • All the users in your LDAP-CSM tenant must be members of this group
  • The tenant admin must have the roles of frevvo.TenantAdmin, frevvo.Designer and frevvo.User.
  • The group names for these three special roles must be frevvo.User, frevvo.TenantAdmin, and frevvo.Designer. Upper/lower case may be a factor for Open LDAP systems.
  • frevvo Best Practice recommends that you create a user account in your Active Directory or IDP that will house all of your deployed Production forms/flows. This user can be named anything i.e.frevvoProduction but it must be a member of the frevvo.Designer group
  • If you want to preserve Applications/Forms/flows developed in your trial/starter tenant, download them to your desktop as a backup BEFORE changing the Security Manager
  • frevvo only supports the LDAP Container Security Manager when is running in the tomcat container. Refer to our Supported Platforms for the list of Application Servers supported/certified by frevvo.

Configuration Steps

  1. Stop  if it is running.

  2. Modify the <frevvo-home>\tomcat\conf\server.xml file. Here is an example of the changes needed when using tomcat.

    1. Edit this file with a text editor.

    2. Search for 'ldap://localhost:389 - you should find this in the org.apache.catalina.realm.JNDIRealm section of the file. 

    3. Uncomment this section. Replace the existing code with the code shown below: 

    4. Replace the connectionURL, connectionName and the connectionPassword default values with your LDAP server information. 

    5. Refer to this Apache Tomcat website for detailed information about the remaining parameters.

	<Realm className="org.apache.catalina.realm.JNDIRealm"
		connectionURL="ldap://test.windows.frevvo.com:389" connectionName="TEST\Administrator"
		connectionPassword="FrevvoTest00" adCompat="true" referrals="follow"
		
		userBase="CN=Users,DC=test,DC=windows,DC=frevvo,DC=com" userSearch="(&amp;(objectClass=user)(sAMAccountName={0}))"
		userSubtree="true" userRoleName="memberOf"
		
		roleBase="CN=Users,DC=test,DC=windows,DC=frevvo,DC=com" roleSubtree="true"
	    roleName="cn" roleSearch="(&amp;(objectClass=group)(member={0}))" /> 
     
      3. Start .

      5. Create a tenant with the LDAP Container Security Manager .  

Check if the configuration is correct

Here are some quick tests to check if the LDAP Container Security Manager tenant configuration is correct:

  1. Browse 'http://<IP>:<PORT>/frevvo/web/tn/<tenant id>/login'. Substitute the ip address/port of the  server and the name of your LDAPCSM tenant for the tenant id. The browser authentication light-box displays.



  2. Login as the tenant admin for the LDAP-CSM tenant. This admin must have the frevvo.User role in addition to the frevvo.tenantadmin and frevvo.designer roles.

  3. Click Manage Roles. You should see a list of groups.



  4. Click the Back to Manage Tenant link.
  5. Click Manage Users. 
  6. Click All. You should see a list of LDAP users. 



  7. Now, click Back To Manage Tenant. 
  8. Log out from .
  9. Try to login with the user name and password of a user in the LDAP-CSM tenant. You do NOT need to specify the LDAP-CSM tenant when logging in. For instance, if nancy is a valid LDAP user you should log in as nancy. The password would be nancy's password in LDAP. User nancy's home page will display.



Since you are using LDAP to define users and roles (i.e., groups), you do not see an Add User icon or Add Role icon on the Manage Users or Manage Roles pages.

Troubleshooting

If the tenant admin user does not exist or it does not have the required roles, this error will display with the name of the tenant you are trying to add:



This error message can be seen in the <frevvo-home>\tomcat\logs\frevvo.log file if the LDAP-CSM tenant cannot be created.  

Application error processing /frevvo/web/tn?edit=true javax.servlet.ServletException: javax.servlet.ServletException: Tenant admin user 111 does not exist! 
or
Tenant admin user lll must have roles: [frevvo.TenantAdmin,frevvo.Designer] if the tenant admin exists but does not have the correct roles.