plugin for rhcs8.1
UseridPwdDirAuthentication.java

base plugin for rhcs8.1
DirBasedAuthentication.java

build script for rhcs8.1
build.sh

The above plugin code and build script are for rhcs8.1. They are attached here for conversion to Dogtag. The code is rough and needs cleaning and review.

Here is how I build on rhcs8.1:
Say, the attached files are downloaded into a directory called plugins,
1. edit build.sh : JAVA_FILES=DirBasedAuthentication.java
./build.sh
2. edit build.sh : JAVA_FILES=UseridPwdDirAuthentication.java
./build.sh
3. after the above compilation, you will find the class files under:
plugins/com/netscape/cms/authentication/
where you will find:
DirBasedAuthentication.class
UseridPwdDirAuthentication.class

Here is how to make cs run with these plugins:
1. cd /webapps/ca/WEB-INF/classes
2. mkdir -p com/netscape/cms/authentication
3. cp (from the above directory) UseridPwdDirAuthentication.class DirBasedAuthentication.class com/netscape/cms/authentication
4. For the authentication plugin:
edit CS.cfg:
add
auths.impl.UseridPwdDirAuth.class=com.netscape.cms.authentication.UseridPwdDirAuthentication
change
auths.instance.UserDirEnrollment.pluginName=UidPwdDirAuth
to
auths.instance.UserDirEnrollment.pluginName=UseridPwdDirAuth
5. Restart the server and try.

Per 10.2.2 Triage meeting of 02/24/2015: 10.2.2
(need to determine who can work on this)

merged patch
pki-ftweedal-0027-5-Store-groups-on-AuthToken-and-update-group-evaluator.patch

pushed to master (f98e599)

Configuration options:

• groupsEnable: boolean, enable retrieval of groups (default = false)
• groupsBasedn: basedn of groups, if different from default basedn
• groups: DN component for groups (default = ou=groups)
• groupObjectClass: group object class ∈ {groupofuniquenames, groupofnames} (default = groupofuniquenames)
• groupUseridName: name of user id attribute in group object member attribute (default = cn)
• useridName: name of user id DN component (default = uid)
• searchGroupUserByUserdn: boolean, whether to search group object member attribute for userdn or ${groupUserIdName}=${uid} (default: true)

Example configuration.

Add to conf/ca/CS.cfg:

auths.instance.UserDirEnrollment.pluginName=UidPwdDirAuth
auths.instance.UserDirEnrollment.ldap.basedn=cn=users,cn=accounts,dc=ipa,dc=local
auths.instance.UserDirEnrollment.ldap.groupObjectClass=groupofnames
auths.instance.UserDirEnrollment.ldap.groups=cn=groups
auths.instance.UserDirEnrollment.ldap.groupsBasedn=cn=accounts,dc=ipa,dc=local
auths.instance.UserDirEnrollment.ldap.groupsEnable=true
auths.instance.UserDirEnrollment.ldap.ldapconn.host=ipa-2.ipa.local
auths.instance.UserDirEnrollment.ldap.ldapconn.port=636
auths.instance.UserDirEnrollment.ldap.ldapconn.secureConn=true

Finally you must tell a profile to use the UserDirEnrollment auth instance defined in CS.cfg, and (if appropriate in your case) provide an ACL for authorization based on groups, in ca/profiles/ca/<profile_id>.cfg. The following is an example only; see also general ACL documentation:

auth.instance_id=UserDirEnrollment
authz.acl=group="cn=devlab-access,ou=engineering,dc=example,dc=com"

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1737

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.