Spring security and ldap

1
votes

this is my first time trying spring security and ldap. I have couple of novice questions. My main confusions are:

  1. How do we assign roles to users? Is it done on ldap server? or done via a configuration file in my webapp? By roles I mean, Couple of users would have all the access to webapp features(Admins), Regular users (Read only access to webapp data), Analytic group (Users which can run a report in webapp)
  2. Currently application uses j_security_check for normal user authentication with ldap server. (Where is Websphere do we hook up ldap connection settings for this authentication?)
1
authenticationldapspring-security

1 Answers

0
votes

I found it confusing too, and developed my own module which ties in with Java EE Security.

Basically the webapp is set up with standard Java EE Security, and methods on spring beans can be given the @RolesAllowed annotation, in which case the logged in user's roles are checked against the required roles just before calling the method. See here for details.

You can use LDAP or a database or a file - where the roles and users are stored is up to you. Normally for production, you will use LDAP or a connector to some kind of directory server. Sorry I can't help with WebSphere - been a while since I set it up for security.