Authenticate Java Apps against LDAP

Use the JXLoginPanel component in the Java Desktop Network Components set to create a feature-rich login mechanism for your Java application that doesn't require you to write any code

Suppose you have developed a Java application that allows users to work on
sensitive and crucial data. A must have is to authenticate the users before they
start using the application. A way of doing this is to authenticate users
against your database. But with most organizations using some kind of directory
service like LDAP  (Lightweight
Directory Access Protocol), it makes more sense to authenticate against the
directory service. If you are looking for a quick drop in, involving only a few
lines of code, then to achieve this kind of authentication, JXLoginPanel comes
handy.

JXLoginPanel is part of the JDNC (Java Desktop Network
Components) project, which is one of the several open source projects hosted at
www.java.net. JDNC is a set of components such as JNTable, JNTree, JNEditor and
JXLoginPanel, which are readily usable in a Java Swing application. To download
the latest JDNC package, check out the steps given in the article 'Intuitive
Database Display with JNTable' later in this issue.

Set up LDAP

Let's first setup  LDAP and
then see how to use JXLoginPanel. We're using OpenLDAP on PCQLinux 2005.
Install this from using the openldap-servers and openldap-client packages. Once
that's setup, open the file named slapd.conf in the directory /etc/openldap in
a text editor. Scroll down to the line that says:

suffix “dc=my-domain,dc=com”

and replace the values for 'dc' with the components of
your domain name.  Similarly also
change the line that says:

rootdn “cn=Manager,dc=my-domain,dc=com”

Next, scroll down to the line which says '# rootpw
secret' and remove the preceding hash mark (#). You can substitute
'secret' with your preferred password. Save the file. Start the LDAP server
with  the following command

/etc/rc.d/init.d/ldap start

Next create a file named initial.ldif with the following
content

dn: dc=mycompany, dc=com

objectclass: dcObject

objectclass: organization

o: MyCompany

dc: mycompany

dn: cn=Manager,mycompany,dc=com

objectclass: organizationalRole

cn: Manager

 ldapadd
-x -D "cn=Manager,dc=mycompany,dc=com" -W

-f initial.ldif

When prompted, enter the password that you had specified in
the file slapd.conf ('secret' in our case). Henceforth, we will use a
graphical tool to add entries (user accounts) to the LDAP directory.

Add user accounts to LDAP

Download LDAP Browser/Editor from http://www-unix. mcs.anl.gov/~gawor/ldap/.
Follow the installation instructions on the site to install and run it. Click on
the 'Quick Connect' tab on the LDAP Browser/Editor. For Host, fill in the IP
address of the Linux machine running the LDAP server (127.0.0.1 if the LDAP
server is running on the same machine). For Base DN, type in the 'dn=mycompany,
dn=com'. Uncheck the option 'Anonymous Bind' and then fill in
'cn=Manager' for the User DN.

Check the option 'append base DN' and fill in the
password that you had specified in the slapd.conf file. Click on Connect. This
will bring up an Explorer-like interface with an item named 'dc=mycompany,
dc=com' on the left. Now we start constructing the directory tree. Select the
item 'dc=company, dc=com'. With the item selected, click on the Edit>Add
Entry>organizational Unit.

Modify the 'dn' to

ou=myemployees, dc=mycompany,dc=com

Click on Apply. Next we start setting up the user accounts,
with their names and passwords. Take 'Shekhar' as one of the usernames.
Select 'ou=myemployees' and click on  Edit>Add
Entry>person. Modify the 'dn:' to look like

cn=shekhar, ou=myemployees,
dc=mycompany,dc=com

Click on Set and enter the password (say 'secret123')
for  the user 'shekhar'. For 'sn:'
type in the surname. Click on Apply. Similarly accounts for other users. Next,
we will use JXLoginPanel to authenticate against this directory structure.

The JAAS config file

JXLoginPanel uses JAAS (Java Authentication and Authorization Service) to
authenticate against a directory service. Below is a sample config JAAS file for
our LDAP setup.

ldap {

         com.sun.security.auth.module.LdapLoginModule
REQUIRED

             userProvider="ldap://localhost/ou=myemployees,dc=

                 mycompany,dc=com"

             userFilter="(&(cn={USERNAME})(objectClass=person))"

             useSSL=false

             debug=false;

  };

Substitute local host with the IP address or hostname of
the machine running LDAP. Save the above content in a file named jaas.config.
Next comes the code that launches the JXLoginPanel. Import
org.jdesktop.swing.auth.*.

JAASLoginService loginService
= new JAASLoginService("ldap");

JXLoginPanel.showLoginDialog(this, null, null, loginService, null,

null, null, JXLoginPanel.SAVE_USERNAME);

Put the above code in the constructor of your main (the
first) JFrame of your application. With the first statement we create a
loginService with the name of the service name specified in the JAAS config file
(ldap in this case). The second statement launches the login pop up. Note that
JXLoginPanel gives you the option to save the username and password that is
typed in. The syntax of JXLoginPanel.showLoginDialog( ) is:

JXLoginPanel.showLoginDialog(Frame
frame, String name, String password, LoginService service, PasswordStore store,
JComponent header, JComponent label, int saveMode)

Coming to the syntax, the first parameter will be the
reference of your main JFrame. With name and password, you can pre-fill the
username and password. For the fourth parameter, LoginService, you pass the
JAASLoginService object. For the fifth parameter, you can specify a
PasswordStore object.

The PasswordStore is an interface that can be used to
create your own class to get and set passwords. This gives you the choice of
storing the passwords in your preferred way-in a database or in an encrypted
file. With the header parameter you can pass an option header (say a JPanel with
the logo of the customer's company). With the label parameter you can specify an
option JLabel (saying 'Please type in your username and password'). The last
parameter can be set to  one of
three values: JXLoginPanel.SAVE_USERNAME,  JXLoginPanel.SAVE_PASSWORD
or  JXLoginPanel.SAVE_NONE.
SAVE_USERNAME will save only the username, SAVE_PASSWORD saves the password. You
can use SAVE_NONE to opt not to save either value.Note that the password can be
saved only if your pass a PasswordStore object.

Finally when you compile and run your application as

javac —classpath
jdnc-0_7-all.jar;.

java —cp jdnc-0_7-all.jar;. -Djava.security.auth.login.config=jaas.config

Note that we have passed the JAAS config file in the
command line argument 'java.security.auth.login. config'. The first
interface you will see now is the login box, ready to authenticate the typed in
credentials against the LDAP directory.  Once
the login is successful, the application code continues to run/display the next
statement and screens. If login fails, you will see a 'Login failed'
messagebox that we didn't need to code for!

Shekhar Govindarajan, IT4Enterprise