To deploy an Authn LDAP Plugin you need:

  1. a suitable container to support EJBs,
  2. to install a copy of in the correct place,
  3. to deploy the .ear file,
  4. and see if it works.

EJB Container

In principle you can use any EJB container. Testing has been performed with glassfish 3.1.2 and these notes refer to that version.

You must already have a Java SE installed (i.e. the command "java" is known), then you can get Java EE 6 SDK Update 4 with JDK 6 Update 31 or later from and execute the script.

Request custom installation, install and configure, and enter proxy details if necessary on your site. Request a server domain, set the domain name and set the admin password. For a secure deployment of glassfish you should obtain a trusted certificate rather than using the self-signed one in the distribution.

In the unpacked file you will find a property file,, which should both be copied to the config directory for your chosen glassfish domain. You will find your domain directory at $GLASSFISH_HOME/glassfish/domains. The file may need changing:

If access to the LDAP authentication should only be allowed from certain IP addresses then provide a space separated list of allowed values. These take the form of an IPV4 or IPV6 address followed by the number of bits (starting from the most significant) to consider.
if specified is a label to appear before the user name as it is made available to ICAT for authorization. For example if this is set to 'ldap' then the user 'xyz123' will be provided to ICAT as 'ldap/xyz123', but of no mechanism is specified it will be provided simply as 'xyz123'.

Installing the .ear file

If you already have an authn_ldap installed then you should first remove it with asadmin --port 4848 undeploy <ear> where the value of "ear" can be found by: asadmin --port 4848 list-applications Obtain authn_ldap.ear-1.0.0.ear and install it with the command: asadmin --port 4848 deploy authn_ldap.ear-1.0.0.ear . If you have only one domain you may not need to specify the port and if the admin port is not 4848 then specify the correct value.

Check that authn_ldap works

There is currently no stand alone mechanism to check that authn_db is working properly. Please use the script that comes with the ICAT installation if one of your root users can be authorized with this plugin.

In case of problems look at the log files: server.log and authn_ldap.log which can both be found in the logs directory below your domain.