Custom Authentication Services Jim McCusker (Yale University) Arch/VCDE F2F October 29, 2008

Agenda Context (Single Sign On at Yale) JAAS and CSM A new LDAPLoginModule HOWTO Future Directions

Context (Single Sign On at Yale) Yale uses CAS (Central Authentication Service). CAS uses Kerberos. Kerberos doesn’t have names or addresses (which AuthenticationService needs). Yale has an LDAP phone book with usernames, names, and addresses. We have the technology. We have the information.

JAAS and CSM CSM (Common Security Module) uses JAAS (Java Authentication and Authorization Service) JAAS supports both LDAP and Kerberos for authentication. Shouldn’t this just work?

JAAS and CSM (cont.) No, there are some serious obstacles: CSM uses it’s own Login Module implementation for LDAP. The Login Module will fail if it can’t get username and password information from the LDAP server. The Kerberos Login Module only provides username information and authenticity, and doesn’t know about the custom CSM attributes of LN, FN, .

A New LDAPLoginModule Code Change! Modified LDAPLoginModule (actually LDAPHelper) to allow configuration to just provide user information. This leaves the authentication task to Kerberos or PAM or something else. Deployed successfully and was able to authenticate using the service. Download the software at

HOWTO (On Linux, at least) Set up a vanilla AuthenticationService using LDAP Download distribution ziphttp://krauthammerlab.med.yale.edu/wp-content/files/csmjaas- 1.0.zip Add csmjaas-1.0.jar to [tomcat-dir]/webapps/wsrf/WEB- INF/lib (cont.)

HOWTO (On Linux, at least) (cont.) Install the kerberos libraries and (on Linux) make /etc/krb5.conf look like: [libdefaults] default_realm = NET.YALE.EDU NET.YALE.EDU = { kdc = kserv2.net.yale.edu admin_server = kserv1.net.yale.edu } (cont.)

HOWTO (On Linux, at least) (cont.) Make ~/.java.login.config look like csmjaas- 1.0/java.login.config: AUTHNSVC{ com.sun.security.auth.module.Krb5LoginModule required; edu.yale.med.krauthammerlab.csm.LDAPLoginModule required ldapHost="ldap://directory.yale.edu:389" ldapInfoOnly="true" ldapSearchableBase="o=yale.edu" ldapUserIdLabel="uid" USER_FIRST_NAME="givenName" USER_LAST_NAME="sn" USER_ _ID="mail"; }; (cont.)

HOWTO (On Linux, at least) (cont.) Ask Steve Langella really nicely to add you to the training grid.

Future Directions Integrate the patch back into CSM. Enable Kerberos extension in installer. Use patch as an example on how to create a custom AuthenticationService LoginModule.