While integrating the login in AEM with LDAP, we may have to write our own custom external login module and this document explains how to do the same with an example. Refer this blog if you want to integrate with LDAP without customization.
As we all know, there are 3 configuration we need to do while configuring LDAP with AEM in order to login with LDAP user and also to sync users from LDAP
- Configure LDAP Identity Provider – Here we configure LDAP server and the property mappings
- Configure Default Sync Handler – Here we configure the properties that needs to be synced from the LDAP user properties with the AEM User properties while creating Users in the AEM
- Configure External Login Module – Here we select the external login module factory which is used to login by authenticating Users from the external source (LDAP) and create the User when they login for the first time using the Sync Handler. So for the external Login Module, we need to provide the LDAP IDP and Sync Handler.
In this example, let us see how to write our own custom external login module and use the LDAP Identity provider and sync handler.
Step 1: Create a maven bundle project
Step 2: Add the below dependency in pom.xml
Step 3: Create a Service which extends ‘LoginModuleFactory’ and override createLoginModule()
Step 4: Create an ExternalLoginModule class which extends ‘AbstractLoginModule’. With the login() method, you can write your custom logic to handle once your authenticate from LDAP.
Step 5: Build and deploy the bundle. You can download the project from github
Step 6: Check if the bundle is deployed and is ‘Active’
Once the bundle is deployed successfully, go to /system/console/configMgr and search for ‘Apache Jackrabbit Oak Custom External Login Module’ (or the label you have given for the Component in your Factory class). Make sure Factory PID represents your custom Factory class.
Configure the Identity Provider name and Sync handler.
Now, once you login with the LDAP User, you see your custom Login Module being used to authenticate and sync the user. (Check your log files)
Refer Adobe community article on the same in detail here