users@glassfish.java.net

Re: securing glassfish admin console using ldap

From: <glassfish_at_javadesktop.org>
Date: Wed, 28 Jan 2009 22:02:19 PST

Hi Kumarjayanti

It would really help if I can get the checklist ( or things to do) for what I am trying to achieve.
I wanted to secure the admin console using ldap so that we can grant admin access to different people based on ldap groups.
Here are the steps I did:
1. modify admin-realm in server-config with ldap settings
2. modify sun-web.xml for both adminapp & admingui application under $GF_HOME/lib/install/applications
3. Modify granted.policy for both these apps under $GF_HOME/domains/domain1/generated/policy

With these settings I can login to console etc. However node agents don't start. I have a feeling that either DAS or node agents is still looking at some keyfile or password file.

I upgraded to 2.1 today. Here instead of modifying the admin-realm, I created a new ldap realm & pointed adminapp/admingui app to this realm

Now, apparently, nodeagents are getting a 403 error from http://$hostname:4848/web1/remotejmx . I tried the JMX URL & it's prompting for LDAP realm.
When I start nodeagent, which credentials it pics up & sends to DAS ( or is it the other way around)?
[Message sent by forum member 'jaymalya' (jaymalya)]

http://forums.java.net/jive/thread.jspa?messageID=328856