Worklight Application Center - Active Directory integration

Question

I'm trying to integrate IBM Worklight Application Center with AD. It's deployed on Websphere Liberty Profile on Windows Server 2008 R2 Enterprise VM. I'm using documentation from this link: IBM Knowledgebase

I managed to connect with AD for authentication purposes with this config in server.xml:

<ldapRegistry id="ldap" realm="SampleLdapADRealm" 
                host="ad.btb.hr" port="389" ignoreCase="true" 
                baseDN="ou=BTB,dc=btb,dc=hr" 
                bindDN="<myBindDN>" 
                bindPassword="<myBindPW>"
                ldapType="Microsoft Active Directory" 
                sslEnabled="false"> 
    <activedFilters userFilter="(&amp;(sAMAccountName=%v)(objectClass=user))"
                    groupFilter="(&amp;(cn=%v)(objectcategory=group))" 
                    userIdMap="user:sAMAccountName" 
                    groupIdMap="*:cn" 
                    groupMemberIdMap="memberOf:member">
    </activedFilters>
    <contextPool enabled="true" initialSize="1" maxSize="0" timeout="0s" waitTime="3000ms" preferredSize="3"/>
    <ldapCache>
        <attributesCache size="4000" timeout="1200s" enabled="true" sizeLimit="2000"/>
        <searchResultsCache size="2000" timeout="600s" enabled="true" resultsSizeLimit="1000"/>
    </ldapCache>
</ldapRegistry>

<!-- Begin of configuration added by IBM Worklight installer. -->

<!-- Declare the IBM Application Center Console application. -->
<application id="appcenterconsole" name="appcenterconsole" location="appcenterconsole.war" type="war">
    <application-bnd>
        <security-role name="appcenteradmin">
            <group name="worklight-administrators"/>
        </security-role>
        <security-role name="appcenteruser">
            <group name="worklight-users"/>
        </security-role>
    </application-bnd>
</application>

<!-- Declare the IBM Application Center Services application. -->
<application id="applicationcenter" name="applicationcenter" location="applicationcenter.war" type="war">
    <application-bnd>
        <security-role name="appcenteradmin">
            <!-- <group name="appcentergroup"/> -->
            <group name="worklight-administrators"/>
        </security-role>
        <security-role name="appcenteruser">
            <group name="worklight-users"/>
        </security-role>
    </application-bnd>
    <classloader delegation="parentLast">
        <commonLibrary>
            <fileset dir="${wlp.install.dir}/lib" includes="com.ibm.ws.crypto.passwordutil_1.0.1.jar"/>
        </commonLibrary>
    </classloader>
</application>

Then I tried configuring ACL so I can pull in users and groups into "User and Group Management" part of App Center using this configuration:

<jndiEntry jndiName="ibm.appcenter.ldap.active" value="true"/>
<jndiEntry jndiName="ibm.appcenter.ldap.connectionURL" value="ldap://ad.btb.hr"/>
<jndiEntry jndiName="ibm.appcenter.ldap.user.loginName" value="sAMAccountName"/>
<jndiEntry jndiName="ibm.appcenter.ldap.security.binddn" value="<myBindDN>"/>
<jndiEntry jndiName="ibm.appcenter.ldap.security.bindpwd" value="<myBindPW>"/>
<jndiEntry jndiName="ibm.appcenter.ldap.user.base" value="ou=BTB,dc=btb,dc=hr"/>
<jndiEntry jndiName="ibm.appcenter.ldap.group.base" value="ou=BTB,dc=btb,dc=hr"/>
<jndiEntry jndiName="ibm.appcenter.ldap.user.displayName" value="displayName"/>
<jndiEntry jndiName="ibm.appcenter.ldap.group.name" value="cn"/>
<jndiEntry jndiName="ibm.appcenter.ldap.group.uniquemember" value="member"/>
<jndiEntry jndiName="ibm.appcenter.ldap.user.groupmembership" value="memberOf"/>
<jndiEntry jndiName="ibm.appcenter.ldap.cache.expiration.seconds" value="43200"/>
<jndiEntry jndiName="ibm.appcenter.ldap.user.filter" value='"(&amp;(sAMAccountName=%v)(objectClass=user))"'/>
<jndiEntry jndiName="ibm.appcenter.ldap.group.filter" value='"(&amp;(cn=%v)(objectcategory=group))"'/>

Now, I'm getting this error when accessing Users/Groups link in App Center:

[24.10.14. 09:14:24:379 CEST] 0000001b com.ibm.puremeap.services.MobileServices E { "id": "5b5c3b4c-cb1d-4094-8e84-b1fee1b31b35", "message": "FWLAC0004E: The LDAP server cannot be accessed.", "productVersion": "6.2.0.00-20140613-0730" }

What have I missed?

Answer 1

You are using a very old version of Worklight 6.2; update your setup to use the latest.
You can get the latest Worklight Studio from Eclipse > Help > Eclipse Marketplace. For server artifacts, visit the IBM Fix Central website.

Additionally, the above contains a fix for a bug that may be yours. PI24446 CONNECTING TO APPCENTER WITH A LOG-IN NAME DIFFERENT BY CASE SENSETIVE FROM THE LOG IN NAME DEFINED IN LDAP RESULT IN ERROR

Answer 2

The JNDI entry ibm.appcenter.ldap.user.displayName.filter is missing. Try by setting it.

Answer 3

I had a similar issue fixed by adding/modifying these two lines.

In my case it's uid not sAMAccountName

jndiEntry jndiName="ibm.appcenter.ldap.user.loginName" value="uid"

jndiEntry jndiName="ibm.appcenter.ldap.user.filter" value='"(&(sAMAccountName=%v)(objectClass=person))"'

I used "person" as object class since the same mentioned in my LDAP registry configuration.

jndiEntry jndiName="ibm.appcenter.ldap.user.displayName.filter" value='"(&(cn=%v)(objectclass=person))"'

Group filter should be correct as I am using Objectcategory=group

jndiEntry jndiName="ibm.appcenter.ldap.group.filter" value='"(&(cn=%v)(objectcategory=group))"'/>

All LDAP related info can be verified from AD server.