Home/ Questions/Q 8720989
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-13T07:08:55+00:00

I have a simple webpage deployed to tomcat which runs certain shell scripts based

  • 0

I have a simple webpage deployed to tomcat which runs certain shell scripts based on user selection. The pages are written in html and cgi/perl.

We already have a working ldap server and directory. I need to be able to add security to the web page I created so a user is asked to login using their ldap account when trying to access the home page or any off the sub pages.

How do I add ldap authentication to my web page?

Please be very specific as I am new to all of this. Step by step instructions including code would be greatly appreciated. Thank You

I did a lot of research on google, but all of the solutions are generic, and I don’t know where to start.

This is a good article, but I’m not sure where do I put my connection to ldap and the binding (which of my pages)? How do I make sure the authentication will apply to the sub pages as well, or any other one created in the future?

http://www.perlmonks.org/?node_id=32196

Cheers

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is a good article, but I’m not sure where do I put my connection
    to ldap and the binding (which of my pages)? How do I make sure the
    authentication will apply to the sub pages as well, or any other one
    created in the future?

    You’re now adding state to your app. You might initially think about implementing your authentication (authn) and authorization (authz) in tomcat, and not in your app.

    If you decide not to implement in tomcat, and choose to implement in perl, then you’ve just decided to add state to your application, which means you need to add some kind of session handling. Look at CGI::Session, there are many other session handling modules on CPAN. Avoid Apache::Session. Its lock handling can cause lots of pain if transactions run long. Use a session key in a cookie. Send everything over SSL. if you don’t use SSL, then crackers can intercept your session keys, and then hijack the sessions.

    Once you have your session infrastructure set up, you need to create a login mechanism, usually a form with username and password. when that form is submitted, the CGI behind it does its magic crypto on the password and then does the LDAP dance:

    1. connect to the directory server is no connection already exists.

    2a. bind to the server anonymously or as an application user, search for the user by CN, bind as the user using DN and password

    OR

    2b. compute the DN form the username, bind with the DN and the crypto’s password.

    Often, step 3 is to check the user’s record for some authorization indicator, it could be a yes/no access indicator, or it could be a list of roles or privileges.

    If the user is successfully authenticated, and authorized, then write some authorization info into the user’s session.

    Each subsequent page of your app will then check to see if the user is logged in and/or has the proper authz to use that page. If unauthorized, you can either send them back to the post-login landing page, or to the login page if they aren’t logged in.

    Basically, you just replacing the usual “query the user table of the database” with a query to an LDAP to a directory server.

    • 0