JForum & Active Directory - Problems with configuration

[Migrated From Jforum.net]

Hello,

we are planning to use JForum as an internal discussion platform.
As we already have several java-based j2ee programs running on our JBoss servers, we plan to use our JBoss Servers (JBoss version 4.0.2) for JForum, too.

We tried to configure Single Sign On, using our Active Directory, but failed miserably ;) - we sort of had a single sign on (no register/login buttons anymore), but we had only "Anonymous" Access.

Here is what we've configured in SystemGlobals.properties:

#############################
# SSO / User authentication
#############################
# Auhentication type: use one of the following options
#
# sso: SSO based authentication. The called class will be the one
#	specified by the key "", whic must be an implementation
# 	of net.jforum.sso.SSO
#
# default: Non-SSO authentication, which relies on the key 
#	"login.authenticator" to validate users. For more information, please see
#	net.jforum.sso.LoginAuthenticator and the default implementation.
authentication.type = sso

# The above key will be used when "authentication.type" is set to "default"
# Can be any implementation of net.jforum.sso.LoginAuthenticator
#
# For LDAP authentication, set the value to net.jforum.sso.LDAPAuthenticator. Also,
# see the LDAP section below
login.authenticator = net.jforum.sso.LDAPAuthenticator

# When using authentication.type = default, you may choose to disable
# the automatic login feature, which will prevents users to get 
# automatic logged in when they come back to the forum
auto.login.enabled = true

# The above key will be be used then "authentication.type" is set to "sso"
# The default implementation (used here) only checks if request.getRemoteUser()
# is not null. This may be enough for many situations.
sso.implementation = net.jforum.sso.RemoteUserSSO

# Special attributes used when creating a new user
# Only if auhentication.type = sso
# The attribute name to search in the session for the password.
sso.password.attribute = password

# Same as above
sso.email.attribute = email

# The default email to use if sso.email.attribute is empty
sso.default.email = [e-mail]

# The default password to use if sso.password.attribute is empty
sso.default.password = sso 

# Optional redirect for SSO
# If any value is set, the user will be redirected to the defined
# redict, using the following logic:
# request.getContextPath() + <sso.redirect> + returnPath);
sso.redirect = 

# #######
# LDAP 
# #######
# Security protocol to use, e.g: "ssl"
# Leave it empty (default) to let the provider figure it out
ldap.security.protocol =

# Security authentication to use. Possible values: "none", "simple", "strong", 
# "EXTERNAL" (SASL). Leave empty (default) to let the provider figure it out
ldap.authentication = 

# Class that provides a LDAP factory
ldap.factory = com.sun.jndi.ldap.LdapCtxFactory

# The prefix your LDAP server requires. e.g 'uid='
# The username supplied gets inserted just after the prefix,
#  e.g: 'uid=username' so adjust the prefix properly
ldap.login.prefix = uid=

# The suffix your LDAP server requires.
# e.g 'ou=Users,dc=department,dc=company,dc=com'
ldap.login.suffix =OU=user,OU=accounts,DC=ad,DC=int,DC=kkh,DC=de

# The url of your LDAP server.
# Notice that if your LDAP server uses SSL you will need to configure your
# server certificate so that Java Secure Sockets Extension (JSSE) will accept it.
# Read http://java.sun.com/products/jndi/tutorial/ldap/security/ssl.html
ldap.server.url = ldap://ad.int.x.de:389

# Field that holds the user's email
ldap.field.email = mail

# ActiveDirectory
# To configure LDAPAuthenticator integrating with Microsoft Active Directory. The following two keys should be necessary.
# They are similar to ldap.login.prefix and ldap.login.suffix , but it's used when looking up user infomation 
# rather than authentication. It's used when the login Distinguished Name (DN) is formatted differently from the lookup 
# DN on some LDAP servers, for example, Microsoft Active Directory. If it's the case, you should add these keys in additional 
# to ldap.login.prefix and ldap.login.suffix .
#
# The following example is for configuring on Microsoft Active Directory:
# ===========================
# ldap.login.prefix=CN=
# ldap.login.suffix=CN=Users,DC=jform,DC=net
# ldap.lookup.suffix=CN=Users
# =========================== 
ldap.lookup.prefix =cn=
ldap.lookup.suffix =CN=Users,OU=user,OU=accounts,DC=ad,DC=int,DC=kkh,DC=de

This is about all we've configured.
Are there any major flaws in our configuration?
Are further configurations (other config files of jforum, jboss, ...) necessary?
Other suggestions?


Thanks in advance for your help!
Christoph
[originally posted on jforum.net by ChristophL]

[Migrated From Jforum.net]

When you use SSO, JForum indeed disable the "Register" link, as users should come from somewhere else (your SSO).

As of anonymous only access and users, check if you have any records inside jforum_users and jforum_user_groups.

Take a look at the SSO implementation you're using (RemoteUserSSO), to understand how it works.

Rafael
[originally posted on jforum.net by Rafael Steil]