LDAP in AEM 6.x

Starting in Adobe Experience Manager 6.0, there has been a significant change in the way LDAP Authentication is managed. Rather than using the jaas.conf file of earlier releases, AEM 6.0 comes with Jackrabbit Oak, which has its own LDAP integration. Although the Apache Jackrabbit developershave provided documentation for configuring the system, we felt that it would be helpful if we could provide an example of this configuration.

There are three things we need to configure in Adobe Experience Manager: the LdapIdentityProvider, a DefaultSyncHandler, and an ExternalLoginModule. While in these examples we will be using the Felix Console, we at Axis41 always recommend that all Production OSGi configurations be saved in your source code repository, and become a regular part of your deployment process.
You should take the time to understand all the options in each configuration; however, we will be focusing on the options that you most likely will need to configure.

Apache Jackrabbit Oak LDAP Identity Provider (LdapIdentityProvider)

provider.name The “idp.name” we will provide to the ExternalLoginModule
host.name The host where your LDAP server is running
bind.dn The Distinguished Name (DN) to bind to LDAP with
bind.password The username to bind to LDAP with
user.baseDN The LDAP DN that is the base for user accounts that will be allowed to authenticate with AEM
user.objectclass The LDAP objectclass for user objects that will be allowed to authenticate with AEM
user.idAttribute The LDAP attribute that will determine the AEM username
group.baseDN The LDAP DN that is the base for group objects that will be searched by AEM

Apache Jackrabbit Oak Default Sync Handler (DefaultSyncHandler)
handler.name The “sync.handlerName” we will provide to the ExternalLoginModule
user.expirationTime How long after synchronization a user object should be considered valid
user.autoMembership Synchronized users will automatically be added to this group.
user.propertyMapping A String[] of “key=value” pairs; keys will be the AEM property name, values the LDAP property which will be copied.
user.pathPrefix Location where synced users will be stored; the value will be appended to /home/users.
group.pathPrefix Location where synced groups will be stored; the value will be appended to /home/groups.

Apache Jackrabbit Oak External Login Module (ExternalLoginModule)

idp.name provider.name from the LdapIdentityProvider
sync.handlerName handler.name from the DefaultSyncHandler

What it looks like after it syncs
One of the things we found to be a surprise was the name Adobe Experience Manager chooses for the node as it syncs the user from LDAP. Here’s a CRXDE Lite view of a set of objects created using the OSGi configs I shared above. You can see the machine-generated name of both the user and group nodes after the sync took place.