LDAP Configuration stored in plain text

[vsubramanian]

Hi,
We would like to authenticate OpenKM using 'Active Directory' LDAP.
Went through the document in the link http://wiki.openkm.com/index.php/Active ... OpenKM_6.2.

Had a question on how the 'LDAP passwd' is stored in the configuration file.
Is the 'LDAP passwd' stored as a 'plain text' in the OpenKM.cfg and OpenKM.xml files?
If they are stored in 'plain text', is there a way to make sure the password is NOT viewable by any user - since having the 'LDAP passwd' in 'plain text' will be a security risk.

Thanks in advance,
Vasu

[jllort]

The credentials of the LDAP user are in plain text ( is not necessary you set an administrator user, simply user with read grants to navigate and do queries is enough ). About security, well, only administrator should take access to the OpenKM.cfg or OpenKM.xml files and the same with Administration tab. These are not any users, are the administrator of the server and the application.

[pavila]

If any user can log into the server where you have installed OpenKM and access these files, it's a security risk.

[vsubramanian]

Hi pavila/jllort,

During OpenKM runtime, when OpenKM needs the 'password' to access' LDAP', does OpenKM get it from the "OpenKM.cfg and OpenKM.xm" files Or from the "database".

LDAPPrincipalAdapter.java :
Is this the class that reads the password to connect to LDAP?
This seems to read the 'LDAP password' from the 'database'.
Does this mean that the 'LDAP password' stored in "OpenKM.cfg and OpenKM.xm" is ignored?


Thanks,
Vasu

[jllort]

Password stored in OpenKM.xml is used by spring directly. Password stored at database ( Administration -> Configuration parameters ) is used by LdapPrincipalAdapter class. Any configuration in OpenKM.cfg about ldap is totally ignored.

[vsubramanian]

Hi jllort,
If I need to decrypt an encrypted password stored in "OpenKM.xml", can you please point me the files that would need to be modified?
Thanks,
Vasu

[jllort]

The default classes that take control of LDAP authentication comes from spring-security project. You should create your own LDAP Java classes:
https://github.com/spring-projects/spri ... ource.java