How to map Ldap groups to Tomcat Roles (Java)
<p>I am writing a web project using Servlets/JSP etc.. At the moment the program uses basic authentication for security.. but my work want the security roles picked up from our active directory.</p>

<p>I have modified apache's server.xml with the following:</p>

<pre><code>&lt;Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
       connectionURL="ldap://adclds001.mycompgroup.local:389"
       connectionName="************.local:389"
       connectionPassword="********"
       userPattern="CN={0},OU=Trainers, OU=Academy, OU=Staff, OU=Users, OU=UK, OU=Countries, DC=mycompgroup, DC=local"
       roleBase="OU=Trainers, OU=Academy, OU=Staff, OU=Users, OU=UK, OU=Countries, DC=mycompgroup, DC=local"
       roleName="cn"
       roleSearch="member={0}"
     /&gt;
</code></pre>

<p>The authentication works fine, but I do not know how to map ldap groups
to Tomcat roles.</p>

<p>I have tried adding things like group-name to the
 entries to the deployment descriptor but to no avail.</p>

<p>I have also heard that extending the JNDIRealm class and overriding
the getRoles method might give me what I want..But I cant find full
details on what might be required.</p>

<p>So what is the best way to map ldap groups to tomcat roles?</p>

<p>The application is still not picking up the roles.</p>

<p>My realm details are currently:</p>

<pre><code>&lt;Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
       connectionURL="ldap://adclds001.mycomp.local:389"
       connectionName="trainee1@mycomp.local:389"
       connectionPassword="****"
       userPattern="CN={0},OU=Trainers, OU=Academy, OU=Staff, OU=Users, OU=UK, OU=Countries, DC=mycompgroup, DC=local"
       userRoleName="Domain Users"
       roleBase="OU=Trainers, OU=Academy, OU=Staff, OU=Users, OU=UK, OU=Countries, DC=mycompgroup, DC=local"
       roleName="cn"
       roleSearch="member={0}"
     /&gt;
</code></pre>

<p>I have a security constaint in my deployment descriptor:</p>

<pre><code>    &lt;security-constraint&gt;
        &lt;web-resource-collection&gt;
            &lt;web-resource-name&gt;Wildcard means whole app requires authentication&lt;/web-resource-name&gt;
            &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
            &lt;http-method&gt;GET&lt;/http-method&gt;
            &lt;http-method&gt;POST&lt;/http-method&gt;
        &lt;/web-resource-collection&gt;
        &lt;auth-constraint&gt;
            &lt;role-name&gt;Domain Users&lt;/role-name&gt;
            &lt;role-name&gt;admin_user&lt;/role-name&gt;
        &lt;/auth-constraint&gt;
        &lt;user-data-constraint&gt;
            &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt;
        &lt;/user-data-constraint&gt;
    &lt;/security-constraint&gt;   
</code></pre>

<p>security roles in web.xml:</p>

<pre><code>    &lt;security-role&gt;
        &lt;role-name&gt;basic_user&lt;/role-name&gt;
    &lt;/security-role&gt;
    &lt;security-role&gt;
        &lt;role-name&gt;admin_user&lt;/role-name&gt;
    &lt;/security-role&gt;

    &lt;security-role&gt;
        &lt;role-name&gt;Domain Users&lt;/role-name&gt;
    &lt;/security-role&gt;
</code></pre>

<p>I also have:</p>

<pre><code>&lt;login-config&gt;
    &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
&lt;/login-config&gt;
</code></pre>

<p>Also</p>

<p>My IT dept are telling me that everybody is in the following group:
CN=Domain Users,CN=Users,DC=mycompgroup,DC=local</p>

<p>Can anybody suggest why I am not able to use the Domain Users role?</p>