The credential store and identity manager properties that are required to create an authentication profile in the Auth Manager are described here.
| Type | Value |
|---|---|
| Field | Description |
| allowEmptyPasswords | A flag indicating if empty (length 0) passwords should be passed to the LDAP server. An empty password is treated as an anonymous login by some LDAP servers and this may not be a desirable feature. Set this to false to reject empty passwords or true to have the LDAP server validate the empty password. The default is true. |
| baseCtxDN | It defines the fixed DN of the context to search for user roles. Consider that this is not the Distinguished Name of where the actual roles are located but the DN of where the objects containing the user roles are located (that is, for active directory, this is the DN with the user account). |
| baseFilter | It defines the search filter used to locate the context of the user to authenticate. The input username/userDN as obtained from the login module callback substitutes the {0} expression. This substitution behavior comes from the standard DirContext?.search(Name, String, Object[], SearchControls? cons) method. An common example search filter is "(uid={0}). |
| bindCredential | It defines the bindDN password. The password can be encrypted if the jaasSecurityDomain is specified. |
| bindDN | It defines the DN used to bind to the LDAP server. This is a DN with read/search permissions to the defined baseCtxDN and rolesCtxDN. |
| java.naming.factory.initial | The classname of the InitialContextFactory implementation. This defaults to the Sun LDAP provider implementation com.sun.jndi.ldap.LdapCtxFactory. |
| java.naming.provider.url | This property specifies the host name and port of the DNS server used by the initial DNS context, as well the initial context's domain name. |
| java.naming.referral | It indicates the service providers how to handle referrals. |
| java.naming.security.authentication | Specifies the authentication mechanism and the security level to use. This defaults to simple |
| java.security.krb5.kdc | It defines the host name on which the Active Directory server runs. |
| java.security.krb5.realm | It defines the Microsoft domain in which the Active Directory server runs. |
| principalDNPrefix | A prefix to add to the username to form the user distinguished name. |
| principalDNSuffix | A suffix to add to the username when forming the user distinguished name. This is useful if you prompt a user for a username and you don't want the user to have to enter the fully distinguished name. |
| roleAttributeID | It defines the role attribute of the context that corresponds to the name of the role. If the roleAttributeIsDN property is set to true, this property is the DN of the context to query for the roleNameAttributeID attribute. If the roleAttributeIsDN property is set to false, this property is the attribute name of the role name. |
| roleAttributeIsDN | It defines if the role attribute contains the fully distinguished name of a role object or the role name. If false, the role name is taken from the value of the user's role attribute. If true, the role attribute represents the distinguished name of a role object. The role name is taken from the value of the roleNameAttributeId attribute of the corresponding object. In certain directory schemas (for example, Microsoft Active Directory), role (group)attributes in the user object are stored as DNs to role objects and not as simple names. In such case, set this property to true. The default value of this property is false. |
| roleFilter | It defines a search filter used to locate the roles associated with the authenticated user. The input username/userDN as obtained from the login module callback substitutes the {0} expression in the filter definition. The authenticated userDN substitutes the {1} in the filter definition. An example search filter that matches the input username is (member={0}). An alternative that matches the authenticated userDN is (member={1}). If you omit the roleFilter attribute, the role search will use the UserDN as the DN to obtain the roleAttributeID value. |
| roleNameAttributeID | It defines the role attribute of the context which corresponds to the name of the role. If the roleAttributeIsDN property is set to true, this property is used to find the name attribute of the role object. If the roleAttributeIsDN property is set to false, this property is ignored. |
| rolesCtxDN | The fixed DN of the context to search for user roles. Consider that this is not the Distinguished Name of where the actual roles are; rather, this is the DN of where the objects containing the user roles are (e.g. for active directory, this is the DN where the user account is) |
| searchScope | sets the search scope to one of the following (the default value is SUBTREE_SCOPE): OBJECT_SCOPE - searches the named roles context only. ONELEVEL_SCOPE - searches directly in the named roles context. SUBTREE_SCOPE - searches only the object if the role context is not a DirContext?. If the roles context is a DirContext?, the subtree rooted at the named object and the named object itself are searched. |
| searchTimeLimit | It defines the timeout for the user and role searches in milliseconds (defaults to 10000, that is 10 seconds). |