Chariot and LDAP

Chariot UI - LDAP Users and Groups/Roles

The Chariot Security Service can be configured to add an LDAP Realm to use when authenticating and authorizing access via the Chariot UI. Each LDAP Realm uses a simple bind authentication to connect to the LDAP server to search for users and groups. A user that is logging in to the Chariot UI will have their username mapped to the distinguished name (DN) of an LDAP entry using a configure template (see below).  Chariot will use simple bind authentication to authenticate the user and will search for group membership to determine the corresponding Chariot Role membership using the configured mapping.

The following file must be manually edited to add and LDAP Realm configuration:

conf/com.cirruslink.chariot.security.config

Example configuration:

tokenTimeout="5400000"
ticketTimeout="3000"
defaultRealmEnabled=B"false"
ldap.1.enabled=B"true"
ldap.1.url="ldap://localhost:389"
ldap.1.sysUserDn="cn=chariot"
ldap.1.sysPassword="123456"
ldap.1.userDnTemplate="uid={0},ou=users,dc=cirruslink,dc=com"
ldap.1.groupBaseDn="ou=groups,dc=cirruslink,dc=com"
ldap.1.groupNameAttribute="cn"
ldap.1.groupToRoleMapping="group1=admin,group2=guest"

LDAP Realm configuration properties:

Chariot MQTT - LDAP Authentication and ACLs

Chariot can be configured to use an LDAP server for MQTT client authentication and authorization instead of Chariot's MQTT Credentials.

LDAP Server

• LDAP Server schema and sample data can be found in the following directory:
  

  • samples/ldap/ldif/

• Entries in the LDAP Server used for authentication must support simple bind requests
• Entries in the LDAP Server used for authorization must extend the cls-mqttCredential Object Class and use the cls-subTopicFilter and cls-pubTopicFilter attributes to declare their ACLs (see description below)

LDAP Schema Object Classes

LDAP Schema Attributes

Chariot Configuration

The following configuration file must be manually added to configure LDAP authentication and authorization in the MQTT server:

conf/com.cirruslink.chariot.server.auth.ldap.config

Example ldap configuration:

idAttribute="uid"
baseDn="dc=cirruslink,dc=com"
url="ldap://localhost:389"
sysUserDn="cn=chariot"
sysPassword="123456"

LDAP auth configuration properties:

Additionally the Chariot MQTT server must be configured to use the LDAP authentication instead of the internal MQTT Credentials.  This can be done by manually editing the following configuration file:

conf/com.cirruslink.chariot.server.auth.ldap.config

Example configuration:

messageThreads=I"2"
port=I"1883"
securePort=I"8883"
webSocketPort=I"8090"
webSocketSecurePort=I"8091"
bindAddress="0.0.0.0"
enableNonSecure=B"true"
enableSecure=B"false"
webSocketEnable=B"false"
webSocketEnableSecure=B"false"
allowAnonymous=B"false"
subscriptionManager.target="(type=default)"
authenticationService.target="(type=ldap)"
authorizationService.target="(type=ldap)"
maxMessageSize=I"268435455"
maxConnectSize=I"268435455"
maxClientIdLength=I"100"
maxTopicLength=I"1024"
maxTopicLevels=I"10"
connectTimout=I"10000"
clientAuthPolicy="none"

LDAP Realm configuration properties: