Credential retrieval: CredentialProvider
The plugin provides a new extension point of type org.ametys.runtime.authentication.CredentialsProvider in charge of retrieving user logins via the NTLM protocol.
Modify the file WEB-INF/param/runtime.xml to use this extension point:
<org.ametys.runtime.authentication.CredentialsProvider>org.ametys.plugins.ntlm.authentication.NTLM</org.ametys.runtime.authentication.CredentialsProvider>
The user manager is necessarily the LDAP manager (file WEB-INF/param/runtime.xml):
<org.ametys.runtime.user.UsersManager>org.ametys.runtime.plugins.core.Ldap</org.ametys.runtime.user.UsersManager>
Authentication manager
The extension point org.ametys.runtime.authentication.AuthenticationManager determines whether the login is authorized to connect to the application.
In the WEB-INF/param/authentication.xml you must use the org.ametys.runtime.plugins.core.authentication.HasRightAuthentication
<authentications>
<authentication>org.ametys.runtime.plugins.core.authentication.HasRightAuthentication</authentication>
</authentications>
To find out more about user authentication on Ametys and the choice of managers, visit the User authentication page.
Configuration Apache
Your Apache server configuration ( httpd.conf file) must include the following rules:
httpd.conf
# Rules for NTLM authentication by Jespa
RewriteRule .* - [E=INFO_REMOTE_ADDR:%{REMOTE_ADDR},NE]
RewriteRule .* - [E=INFO_REMOTE_PORT:%{REMOTE_PORT},NE]
RequestHeader set Jespa-Connection-Id "%{INFO_REMOTE_ADDR}e:%{INFO_REMOTE_PORT}e"
Please note that mod_headers must be enabled in the Apache configuration.
Test or development environment
For your test or development environment, you can download the Jespa demo library, valid for 60 days: http: //www.ioplex.com/downloads.php
Copy and paste jar jespa-1.1.x.jar into the directory WEB-INF/lib of your application.
Production deployment
For production deployment, you must purchase the paid version of Jespa by purchasing the license from IOPLEX: http://www.ioplex.com/purchase.php
Then follow the instructions at mail to update the Jespa library with the license.
Copy and paste jar jespa-1.1.x.jar into the directory WEB-INF/lib of your application.
Creating a Computer Account
After downloading Jespa, use the SetupWizard.vbs procedure to create a Computer Account in Active Directory with a name ending in $ of up to 15 characters (including $).
This account will allow access to the NETLOGON service to verify user authentication.
Set the Computer Account password using the following procedure SetComputerPasssword.vbs:
SetComputerPassword [computer_account_name]$@[domain] [password]
Back to top