Release Automation

To start with, I would like to mention that this post is related to the following post:

https://communities.ca.com/message/241805210

For LDAP authentication to be working, I gave the following entries in distributed.properties file:

use.general.ldap.authentication=true

use.general.ldap.url=ldap://ipaddress:389

use.general.ldap.user.fqdn=uid=admin,o=techmahindra

use.general.ldap.user.password=xxxxx

Also, I gave the following in the applicationContext-acegi-security.xml file:

   <b:bean id="ldapAuthProvider"

          class="com.nolio.platform.server.dataservices.services.auth.providers.NolioLdapAuthenticationProvider">

        <b:constructor-arg>

            <b:bean class="org.springframework.security.ldap.authentication.BindAuthenticator">

                <b:constructor-arg ref="ldapSecurityContextSource"/>

                <b:property name="userDnPatterns">

                    <b:list>

                        <b:value>uid={0},ou=devops,o=techmahindra</b:value>

                        <b:value>memberOf=cn=cara-users,ou=groups,ou=devops,o=techmahindra</b:value>

                    </b:list>

                </b:property>

            </b:bean>

        </b:constructor-arg>

The above piece of code is not working as expected - that is, all the users registered in the LDAP are able to login into the CA Release Automation web application irrespective of whether the user is part of the aforementioned "cara-users" group or not. (It means that the above mentioned entry memberOf=cn=cara-users,ou=groups,ou=devops,o=techmahindra is not taking effect). I would like to change the settings such that only members of the "cara-users" group are able to login into the CA Release Automation web application.

Not sure how to do that even after trying out various options. Your inputs are really appreciated.

Hi Mahesh,

I'll look into this further, but in the meantime, just to verify, I assume you're using something other than Active Directory for LDAP, hence usage of the use.general.ldap settings.  Is that correct?

Yes, correct.

In addition, I would like to mention the following:

• There are 2 portions of the CA Release Automation application - one is the Automation Studio and the other is the web application.
• Import of user(s) / group(s) is done in the Automation Studio.
• The web application directly authenticates with LDAP after LDAP integration (by means of the update of distributed.properties file etcetera).

Your reply is really helpful. However, my question still remains unanswered. Appreciate if you could elaborate (regarding your point number 3) on the scenario where update of the applicationContext-acegi-security.xml file was done. That is where I am facing some issues now.

Best Regards.

Honesty, the details behind when changing that .xml file were necessary is unclear to me. The only solid detail I know for sure is that it was when they were using a non Active Directory LDAP. Can you confirm the type of LDAP Server you are using?

One note regarding your bullet point:

• The web application directly authenticates with LDAP after LDAP integration (by means of the update of distributed.properties file etcetera).

Note: After the ldap integration, the web and asap can use ldap authentication. But it is purely based on the "Groups" (not users) imported via Automation Studio.

Kind regards,

Gregg

The LDAP server that I am using is OpenLDAP.

Best Regards.