LDAP Plugin

Compatibility matrix

- means that it was tested

Description

This is documentation for plugin version 1.1 and greater. Documentation for version prior to 1.1 located on separate page. Instructions for migration can be found here.

The Sonar LDAP Plugin enables the delegation of Sonar authentication and authorization to an external system. The plugin currently supports LDAP and Microsoft Active Directory.

The main features of the plugin are :

• Password checking against the external authentication engine
• Automatic synchronization of usernames and emails
• Automatic synchronization of the relationships between users and groups (authorization)
• Ability to authenticate the user both against the external or internal authentication systems (technical Sonar user accounts have no need for instance to be defined in the LDAP server)

By default there is no need to firstly create a user account in the Sonar DB to allow a user to log into Sonar. During the first authentication trial, if the password is correct, the Sonar DB is automatically populated with the new Sonar user. Moreover, each time a user logs into Sonar, the username, the email and the groups this user belongs to are automatically refreshed in the Sonar DB.

About the delegation of authorization, there are only one pre-requisite : the relationships between users and groups are only synchronized with groups which are already defined in the Sonar. So groups and related permissions must be first defined in Sonar.

Usage & Installation

1. Download the plugin from Update Center and restart server. If you don't have access to Internet, then manually download JAR file into $SONAR_HOME/extensions/plugins and restart server.
2. Make sure that at least one user with global administration role exists in Sonar as well as in the external system

3. Configure the LDAP plugin by editing the conf/sonar.properties file (see below)

4. Restart the Sonar server and check the log file for:

   INFO org.sonar.INFO Security realm: LDAP
   ...

   INFO o.s.p.l.LdapContextFactory Test LDAP connection: OK

5. Log in to Sonar

(&(objectClass=inetOrgPerson)(uid={login}))

(&(objectClass=user)(sAMAccountName={login}))

(&(objectClass=groupOfUniqueNames)(uniqueMember={dn}))

(&(objectClass=group)(member={dn}))

Here is description of how auto-discovery works:

1. Determine DNS Domain Name:
   • from "ldap.realm" property if set
   • from FQDN of machine, where Sonar is installed (eg. if FQDN is "sonar.example.org", then DNS Domain Name will be "example.org")
2. Determine URL of LDAP server:
   • from "ldap.url" property if set

   • from DNS server ( see known limitations ), here is example of SRV Record for domain "example.org":

     _ldap._tcp.example.org. 72784   IN      SRV     0 5 389 ldap.example.org.

     for this domain URL of LDAP server will be "ldap://ldap.example.org:389"

3. Determining BaseDN:
   • from "ldap.baseDn" property if set
   • from DNS Domain Name (eg. if DNS Domain Name is "example.org", then BaseDN will be "dc=example,dc=org")

Authentication Methods

• Simple
  Simple authentication is not recommended for production deployments not using the secure ldaps protocol as it sends a cleartext password over the network.
• Anonymous
  Used when only needs read-only access to non-protected entries and attributes when binding to the LDAP server.
• CRAM-MD5
  The Challenge-Response Authentication Method (CRAM) based on the HMAC-MD5 MAC algorithm (RFC 2195).
• DIGEST-MD5
  This is an improvement on the CRAM-MD5 authentication method (RFC 2831).
• GSSAPI
  GSS-API is Generic Security Service API (RFC 2744). One of the most popular security services available for GSS-API is the Kerberos v5, used in Microsoft's Windows 2000 platform.

For a full discussion of LDAP authentication approaches, see RFC 2829 and RFC 2251.

Known limitations

Auto-discovery takes into account only one SRV record.

Troubleshooting

You can enable debug logging by adding the following to conf/logback.xml:

Migration from plugin version 1.0 to version 1.1.1

Perform following replacements :

Configure Group Mapping : at least by specifing new mandatory property - "ldap.group.baseDn".

Changelog

Release 1.2 (4 issues)
Type	Key	Summary	Priority	Status	Resolution
	SONARPLUGINS-1845	Make it possible to deactivate the group synchronization mechanism		Closed	Fixed
	SONARPLUGINS-1962	Allow to customize query for users		Closed	Fixed
	SONARPLUGINS-1895	Algorithm of autodiscovery should use priority and weight of srv-records		Closed	Fixed
	SONARPLUGINS-1759	Group mapping with uid in memberAttribute		Closed	Fixed

Release 1.1.1 (1 issues)
Type	Key	Summary	Priority	Status	Resolution
	SONARPLUGINS-1731	Downgrade the requirement from JDK 1.6 to 1.5		Closed	Fixed

Release 1.1 (2 issues)
Type	Key	Summary	Priority	Status	Resolution
	SONARPLUGINS-895	Group mapping for roles		Closed	Fixed
	SONARPLUGINS-1311	Mapping User name and email from LDAP to populate Sonar USERS table		Closed	Fixed

Release 1.0 (1 issues)
Type	Key	Summary	Priority	Status	Resolution
	SONARPLUGINS-764	Use sonar-plugin packaging		Closed	Fixed

Release 0.1 (8 issues)
Type	Key	Summary	Priority	Status	Resolution
	SONARPLUGINS-302	Support Microsoft Active Directory		Closed	Fixed
	SONARPLUGINS-298	Support LDAPS		Closed	Fixed
	SONARPLUGINS-301	Authenticate users against an LDAP server		Closed	Fixed
	SONARPLUGINS-300	Support SASL GSSAPI authentication		Closed	Fixed
	SONARPLUGINS-297	Publish source code		Closed	Fixed
	SONARPLUGINS-299	Support SASL Digest-MD5 authentication		Closed	Fixed
	SONARPLUGINS-306	Autodiscovery		Closed	Fixed
	SONARPLUGINS-304	Support SASL CRAM-MD5 authentication		Closed	Fixed

(&(objectClass=user)(sAMAccountName={login}))