Example using ldap + local roles

[gschueler]

Note: this depends on this fix rundeck/rundeck#9482

[mcgurksean]

As suggested here: rundeck/rundeck#9482

I am using the following Dockerfile:

FROM rundeck/ci:RUN-3011

ENV RDECK_BASE=/home/rundeck

COPY --chown=rundeck:root --chmod=775 realm.properties /home/rundeck/server/config/realm.properties

ENV RUNDECK_LOGGING_STRATEGY=FILE \
    RUNDECK_JAAS_MODULES_0=JettyCombinedLdapLoginModule \
    RUNDECK_JAAS_LDAP_FLAG=requisite \
    RUNDECK_JAAS_LDAP_debug=true \
    RUNDECK_JAAS_LDAP_contextFactory=com.sun.jndi.ldap.LdapCtxFactory \
    RUNDECK_JAAS_LDAP_providerUrl=ldaps://ldap.address:636 \
    [email protected] \
    RUNDECK_JAAS_LDAP_bindPassword=password \
    RUNDECK_JAAS_LDAP_authenticationMethod=simple \
    RUNDECK_JAAS_LDAP_forceBindingLogin=true \
    RUNDECK_JAAS_LDAP_userBaseDn="OU=Branch Offices,DC=nh,DC=corp" \
    RUNDECK_JAAS_LDAP_userRdnAttribute=cn \
    RUNDECK_JAAS_LDAP_userIdAttribute=sAMAccountName \
    RUNDECK_JAAS_LDAP_userPasswordAttribute=unicodePwd \
    RUNDECK_JAAS_LDAP_userObjectClass=user \
    RUNDECK_JAAS_LDAP_roleBaseDn="OU=Branch Offices,DC=nh,DC=corp" \
    RUNDECK_JAAS_LDAP_roleNameAttribute=cn \
    RUNDECK_JAAS_LDAP_roleMemberAttribute=member \
    RUNDECK_JAAS_LDAP_roleObjectClass=group \
    RUNDECK_JAAS_LDAP_cacheDurationMillis=300000 \
    RUNDECK_JAAS_LDAP_supplementalRoles=user \
    RUNDECK_JAAS_LDAP_reportStatistics=true \
    RUNDECK_JAAS_LDAP_storePass=true \

    RUNDECK_JAAS_MODULES_1=JettyRolePropertyFileLoginModule \
    RUNDECK_JAAS_FILE_FLAG=required \
    RUNDECK_JAAS_USEFIRSTPASS=true \
    RUNDECK_JAAS_DEBUG=true

To run my docker container.

When I try and log in, I am not able to log in via ldap or via the admin account (no error messages in the logs).

When I remove the RUNDECK_JAAS_MODULES_1 configuration, I am able to log in via LDAP but when I try and view the projects in Rundeck I get the following error message:

[2024-12-19T13:54:16,934] WARN authorization.LoggingAuthorization - Evaluating Decision for: res<type:resource, kind:system> subject<Username:smcgurk Group:user Group:NH-GLB-AzurePasswordReset> action<app_admin> env<rundeck:auth:env:application:rundeck>: authorized: false: No context matches subject or environment => REJECTED_NO_SUBJECT_OR_ENV_FOUND (0ms)

[mcgurksean]

Generated jaas-loginmodule.conf file (/home/rundeck/server/config/jaas-loginmodule.conf) when using ldap + local roles:

rundeck {
    com.dtolabs.rundeck.jetty.jaas.JettyCombinedLdapLoginModule requisite
        debug="true"
        contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
        providerUrl="ldaps://ldap.address:636"
bindDn="[email protected]"
bindPassword="password"
        authenticationMethod="simple"
        forceBindingLogin="true"
        forceBindingLoginUseRootContextForRoles="true"
        userBaseDn="OU=Branch Offices,DC=nh,DC=corp"
        userRdnAttribute="cn"
        userIdAttribute="sAMAccountName"
        userPasswordAttribute="unicodePwd"
        userObjectClass="user"
        roleBaseDn="OU=Branch Offices,DC=nh,DC=corp"
        roleNameAttribute="cn"
        roleMemberAttribute="member"
        roleObjectClass="group"
        rolePrefix=""
        rolePagination="true"
        cacheDurationMillis="300000"
        reportStatistics="true"
        storePass="true"
supplementalRoles="user"

    ;

    org.rundeck.jaas.jetty.JettyRolePropertyFileLoginModule
        required
        debug="true"
        useFirstPass="false"
        file="/home/rundeck/server/config/realm.properties";


};

[mcgurksean]

Working version of this file (taken from rpm install):

ldap {
    com.dtolabs.rundeck.jetty.jaas.JettyCombinedLdapLoginModule optional
      debug="true"
      contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
      providerUrl="ldaps://ldap.address:636"
      bindDn="[email protected]"
      bindPassword="password"
      authenticationMethod="simple"
      forceBindingLogin="true"
      userBaseDn="OU=Branch Offices,DC=nh,DC=corp"
      userRdnAttribute="cn"
      userIdAttribute="sAMAccountName"
      userPasswordAttribute="unicodePwd"
      userObjectClass="user"
      roleBaseDn="OU=Branch Offices,DC=nh,DC=corp"
      roleNameAttribute="cn"
      roleMemberAttribute="member"
      roleObjectClass="group"
      cacheDurationMillis="300000"
      supplementalRoles="user"
      reportStatistics="true"
      storePass="true";

    org.rundeck.jaas.jetty.JettyRolePropertyFileLoginModule sufficient
      debug="true"
      useFirstPass="true"
      file="/etc/rundeck/realm.properties";

    org.eclipse.jetty.jaas.spi.PropertyFileLoginModule sufficient
      debug="true"
      file="/etc/rundeck/realm.properties";
};

[mcgurksean]

When using version 5.8.0-20241205 of the image, I am able to log in via LDAP but again, when I try and view the projects in Rundeck I get the following error message:

[2024-12-19T13:54:16,934] WARN authorization.LoggingAuthorization - Evaluating Decision for: res<type:resource, kind:system> subject<Username:smcgurk Group:user Group:NH-GLB-AzurePasswordReset> action<app_admin> env<rundeck:auth:env:application:rundeck>: authorized: false: No context matches subject or environment => REJECTED_NO_SUBJECT_OR_ENV_FOUND (0ms)

The generated file looks like:

rundeck {
    com.dtolabs.rundeck.jetty.jaas.JettyCombinedLdapLoginModule requisite
        debug="true"
        contextFactory="com.sun.jndi.ldap.LdapCtxFactory"
        providerUrl="ldaps://ldapaddress:636"
bindDn="serviceaccount@domain"
bindPassword="password"
        authenticationMethod="simple"
        forceBindingLogin="true"
        forceBindingLoginUseRootContextForRoles="true"
        userBaseDn="OU=Branch Offices,DC=nh,DC=corp"
        userRdnAttribute="cn"
        userIdAttribute="sAMAccountName"
        userPasswordAttribute="unicodePwd"
        userObjectClass="user"
        roleBaseDn="OU=Branch Offices,DC=nh,DC=corp"
        roleNameAttribute="cn"
        roleMemberAttribute="member"
        roleObjectClass="group"
        rolePrefix=""
        rolePagination="true"
        cacheDurationMillis="300000"
        reportStatistics="true"
        storePass="true"
supplementalRoles="user"

    ;


};

[gschueler]

@mcgurksean one env var name was incorrect in my pr: RUNDECK_JAAS_USEFIRSTPASS should be RUNDECK_JAAS_FILE_USEFIRSTPASS.

in addition, i made some additional changes here: rundeck/rundeck#9509

You can try using the rundeck/ci:enh-jetty-combined-ignore-roles docker image from that PR

[mcgurksean]

@gschueler That works perfectly now with the rundeck/ci:enh-jetty-combined-ignore-roles docker image:

Grails application running at http://0.0.0.0:4440/ in environment: production
ReloadablePropertyFileLoginModule: setupPropertyUserStore: Starting new PropertyUserStore. PropertiesFile: /home/rundeck/server/config/realm.properties refreshInterval: 0
AbstractSharedLoginModule: login with sharedLoginState auth, try? false, use? true
ReloadablePropertyFileLoginModule: Checking PropertyUserStore /home/rundeck/server/config/realm.properties for smcgurk
ReloadablePropertyFileLoginModule: Found: smcgurk in PropertyUserStore /home/rundeck/server/config/realm.properties
JettyRolePropertyFileLoginModule: userInfo found for smcgurk? true
AbstractSharedLoginModule: using login result: true
role names: [admin]

Thank you so much for your help (and for the quick turnaround!)