| <div class="wiki-content maincontent"><p>Configuring network topologies can be quite tedious when the number of brokers in the system is large. To help ease the configuration overhead for these types of situations, a broker can be configured to look up its broker connections using a LDAP v3 directory server.</p> |
| <div class="confluence-information-macro confluence-information-macro-warning"><p class="title">Note</p><span class="aui-icon aui-icon-small aui-iconfont-error confluence-information-macro-icon"></span><div class="confluence-information-macro-body"> |
| <p>The basic feature was added to satisfy <span style="text-decoration: line-through;"><a shape="rect" class="external-link" href="https://issues.apache.org/activemq/browse/AMQ-358">AMQ-358</a></span>. There are known problems and limitations with this implementation. These deficiencies have been addressed in <a shape="rect" class="external-link" href="https://issues.apache.org/activemq/browse/AMQ-1587">AMQ-1587</a>. The features discussed on this page require the patch attached to JIRA issue <a shape="rect" class="external-link" href="https://issues.apache.org/activemq/browse/AMQ-1587">AMQ-1587</a>. This patch should apply cleanly to the ActiveMQ 5.0.0 release or the current development trunk.</p></div></div> |
| |
| <h2 id="LDAPBrokerDiscoveryMechanism-LDAPv3DirectoryServerCompliance">LDAP v3 Directory Server Compliance</h2> |
| |
| <p>The following table lists a known subset of directory servers and their compliance to work with the LDAP discovery feature. Most LDAP v3 directory servers will support this feature if they properly implement the <a shape="rect" class="external-link" href="http://www.ietf.org/rfc/rfc2307.txt" rel="nofollow">RFC2307</a> schemas. In order to support the persistent search capabilities the server must implement the extension defined in <a shape="rect" class="external-link" href="http://www.ietf.org/proceedings/01aug/I-D/draft-ietf-ldapext-psearch-03.txt" rel="nofollow">draft-ietf-ldapext-psearch-03.txt</a>.</p> |
| <div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p> Vendor </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Product </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Version </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> <a shape="rect" class="external-link" href="http://www.ietf.org/rfc/rfc2307.txt" rel="nofollow">RFC2307</a> </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> <a shape="rect" class="external-link" href="http://www.ietf.org/proceedings/01aug/I-D/draft-ietf-ldapext-psearch-03.txt" rel="nofollow">draft-ietf-ldapext-psearch-03.txt</a> </p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> Apache </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> ApacheDS </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> 1.0.x </p></td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-tick" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/check.png" data-emoticon-name="tick" alt="(tick)"></div> |
| </td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-tick" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/check.png" data-emoticon-name="tick" alt="(tick)"></div> |
| </td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> Microsoft </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Active Directory </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Windows 2000 <br clear="none" class="atl-forced-newline"> |
| Windows 2003 </p></td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-warning" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/warning.png" data-emoticon-name="warning" alt="(warning)"></div> |
| </td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-cross" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/error.png" data-emoticon-name="cross" alt="(error)"></div> |
| </td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> Microsoft </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Active Directory </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Windows 2003 R2 </p></td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-tick" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/check.png" data-emoticon-name="tick" alt="(tick)"></div> |
| </td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-cross" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/error.png" data-emoticon-name="cross" alt="(error)"></div> |
| </td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> Sun </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> OpenDS </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> 0.9.x </p></td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-tick" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/check.png" data-emoticon-name="tick" alt="(tick)"></div> |
| </td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-tick" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/check.png" data-emoticon-name="tick" alt="(tick)"></div> |
| </td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> OpenLDAP </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> OpenLDAP </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> 2.3.x <br clear="none" class="atl-forced-newline"> |
| 2.4.x </p></td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-tick" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/check.png" data-emoticon-name="tick" alt="(tick)"></div> |
| </td><td colspan="1" rowspan="1" class="confluenceTd"> |
| <div class="cfm-align-center" style="text-align: center;"><img class="emoticon emoticon-cross" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/error.png" data-emoticon-name="cross" alt="(error)"></div> |
| </td></tr></tbody></table></div> |
| |
| <p><img class="emoticon emoticon-warning" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/warning.png" data-emoticon-name="warning" alt="(warning)"> LDAP v3 directory server which do not support <a shape="rect" class="external-link" href="http://www.ietf.org/rfc/rfc2307.txt" rel="nofollow">RFC2307</a> by default. Support can be added by manually importing them. See vendor specific setup requirements on how to do this.<br clear="none"> |
| <img class="emoticon emoticon-cross" src="https://cwiki.apache.org/confluence/s/en_GB/5997/6f42626d00e36f53fe51440403446ca61552e2a2.1/_/images/icons/emoticons/error.png" data-emoticon-name="cross" alt="(error)"> LDAP v3 directory servers which do not support the <a shape="rect" class="external-link" href="http://www.ietf.org/proceedings/01aug/I-D/draft-ietf-ldapext-psearch-03.txt" rel="nofollow">draft-ietf-ldapext-psearch-03.txt</a>.</p> |
| |
| <h2 id="LDAPBrokerDiscoveryMechanism-LDAPNetworkConnectorProperties">LDAP Network Connector Properties</h2> |
| |
| <div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p> Property </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Default </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Required </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p> Description </p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> uri </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> null </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <strong>Yes</strong> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> The URI of the LDAP v3 Server to connect to (i.e. ldap://host:port, failover://(ldap://host1:port,ldap://host2:port). </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> base </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> null </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <strong>Yes</strong> </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> The RDN base used as the root for the search criteria. </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> user </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> null </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <strong>Yes</strong>, if not using anonymousAuthentication </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> The username needed to bind to the server. </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> password </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> null </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <strong>Yes</strong>, if not using anonymousAuthentication </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> The password needed to bind to the server. </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> anonymousAuthentication </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> false </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> <strong>Yes</strong>, if not using user/password </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Enable if you want to bind to the server anonymously. This is recommended over using user/password properties since your login credentials will not be stored in an unencrypted XML file. </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> searchEventListener </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> false </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> No </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Enable if you want the broker to stay in sync with changes made to entries matching the search criteria. </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> searchScope </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> ONELEVEL_SCOPE </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> No </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Can be any of search scopes defined by javax.naming.directory.SearchControls class. <br clear="none" class="atl-forced-newline"> |
| OBJECT_SCOPE - search the named object defined by base. <br clear="none" class="atl-forced-newline"> |
| ONELEVEL_SCOPE - search one level of the base. <br clear="none" class="atl-forced-newline"> |
| SUBTREE_SCOPE - search entire subtree rooted at the base. </p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p> searchFilter </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> (&(objectClass=ipHost)(objectClass=ipService)) </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> No </p></td><td colspan="1" rowspan="1" class="confluenceTd"><p> Can be any filter that conforms to <a shape="rect" class="external-link" href="http://www.ietf.org/rfc/rfc2254.txt" rel="nofollow">RFC2254</a>. If a custom one is specified the actual search filter used will be (&(&(objectClass=ipHost)(objectClass=ipService))(USER CUSTOM)) </p></td></tr></tbody></table></div> |
| |
| <div class="confluence-information-macro confluence-information-macro-information"><p class="title">Other Properties</p><span class="aui-icon aui-icon-small aui-iconfont-info confluence-information-macro-icon"></span><div class="confluence-information-macro-body"> |
| <p>All of the properties defined in <a shape="rect" class="external-link" href="http://activemq.apache.org/networks-of-brokers.html">Networks of Brokers</a> are also available to the ldapNetworkConnector. Any of the properties defined for a normal networkConnector will be used as connection parameters to any discovered brokers matching the search criteria.</p></div></div> |
| |
| <h2 id="LDAPBrokerDiscoveryMechanism-Example1:SimpleNetworkofBrokers">Example 1: Simple Network of Brokers</h2> |
| |
| <div class="cfm-align-center" style="text-align: center;"> |
| <h3 id="LDAPBrokerDiscoveryMechanism-NetworkConfiguration">Network Configuration</h3> |
| <div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Topology </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>LDAP v3 Directory Structure</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Entry</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><span class="confluence-embedded-file-wrapper"><img class="confluence-embedded-image" src="ldap-broker-discovery-mechanism.data/Example1-Topology.jpg" data-image-src="/confluence/download/attachments/77126/Example1-Topology.jpg?version=4&modificationDate=1203881427000&api=v2" data-unresolved-comment-count="0" data-linked-resource-id="59671452" data-linked-resource-version="4" data-linked-resource-type="attachment" data-linked-resource-default-alias="Example1-Topology.jpg" data-base-url="https://cwiki.apache.org/confluence" data-linked-resource-content-type="image/jpeg" data-linked-resource-container-id="77126" data-linked-resource-container-version="21"></span></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><span class="confluence-embedded-file-wrapper"><img class="confluence-embedded-image" src="ldap-broker-discovery-mechanism.data/Example1-DirectoryStructure.jpg" data-image-src="/confluence/download/attachments/77126/Example1-DirectoryStructure.jpg?version=1&modificationDate=1203881557000&api=v2" data-unresolved-comment-count="0" data-linked-resource-id="59671497" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Example1-DirectoryStructure.jpg" data-base-url="https://cwiki.apache.org/confluence" data-linked-resource-content-type="image/jpeg" data-linked-resource-container-id="77126" data-linked-resource-container-version="21"></span></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><span class="confluence-embedded-file-wrapper"><img class="confluence-embedded-image" src="ldap-broker-discovery-mechanism.data/Example1-Entry.jpg" data-image-src="/confluence/download/attachments/77126/Example1-Entry.jpg?version=1&modificationDate=1203881408000&api=v2" data-unresolved-comment-count="0" data-linked-resource-id="59671496" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Example1-Entry.jpg" data-base-url="https://cwiki.apache.org/confluence" data-linked-resource-content-type="image/jpeg" data-linked-resource-container-id="77126" data-linked-resource-container-version="21"></span></p></td></tr></tbody></table></div> |
| |
| <h3 id="LDAPBrokerDiscoveryMechanism-ActiveMQConfiguration(activemq.xml)">ActiveMQ Configuration (activemq.xml)</h3></div> |
| |
| <div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>srv-a.mydomain.com</b></div><div class="codeContent panelContent pdl"> |
| <script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ |
| <broker brokerName="srv-a.mydomain.com" ...> |
| ... |
| |
| <networkConnectors> |
| <ldapNetworkConnector uri="ldap://myldap.mydomain.com:389" |
| base="dc=brokers,dc=mydomain,dc=com" |
| anonymousAuthentication="true" |
| searchFilter="(cn=*)" |
| searchScope="SUBTREE_SCOPE" |
| /> |
| </networkConnectors> |
| |
| ... |
| </broker> |
| ]]></script> |
| </div></div> |
| <div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>srv-b.mydomain.com</b></div><div class="codeContent panelContent pdl"> |
| <script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ |
| <broker brokerName="srv-b.mydomain.com" ...> |
| ... |
| |
| <networkConnectors/> |
| <!-- NO NETWORK CONNECTORS --> |
| </networkConnectors> |
| |
| ... |
| </broker> |
| ]]></script> |
| </div></div> |
| |
| <h2 id="LDAPBrokerDiscoveryMechanism-Example2:LargerNetworkofBrokers">Example 2: Larger Network of Brokers</h2> |
| |
| <div class="cfm-align-center" style="text-align: center;"> |
| <h3 id="LDAPBrokerDiscoveryMechanism-NetworkConfiguration.1">Network Configuration</h3> |
| <div class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Topology </p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>LDAP v3 Directory Structure</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p><span class="confluence-embedded-file-wrapper"><img class="confluence-embedded-image" src="ldap-broker-discovery-mechanism.data/Example2-Topology.jpg" data-image-src="/confluence/download/attachments/77126/Example2-Topology.jpg?version=2&modificationDate=1203881712000&api=v2" data-unresolved-comment-count="0" data-linked-resource-id="59671455" data-linked-resource-version="2" data-linked-resource-type="attachment" data-linked-resource-default-alias="Example2-Topology.jpg" data-base-url="https://cwiki.apache.org/confluence" data-linked-resource-content-type="image/jpeg" data-linked-resource-container-id="77126" data-linked-resource-container-version="21"></span></p></td><td colspan="1" rowspan="1" class="confluenceTd"><p><span class="confluence-embedded-file-wrapper"><img class="confluence-embedded-image" src="ldap-broker-discovery-mechanism.data/Example2-DirectoryStructure.jpg" data-image-src="/confluence/download/attachments/77126/Example2-DirectoryStructure.jpg?version=1&modificationDate=1203882106000&api=v2" data-unresolved-comment-count="0" data-linked-resource-id="59671498" data-linked-resource-version="1" data-linked-resource-type="attachment" data-linked-resource-default-alias="Example2-DirectoryStructure.jpg" data-base-url="https://cwiki.apache.org/confluence" data-linked-resource-content-type="image/jpeg" data-linked-resource-container-id="77126" data-linked-resource-container-version="21"></span></p></td></tr></tbody></table></div> |
| |
| <h3 id="LDAPBrokerDiscoveryMechanism-ActiveMQConfiguration(activemq.xml).1">ActiveMQ Configuration (activemq.xml)</h3></div> |
| |
| <div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>srv-a.mydomain.com</b></div><div class="codeContent panelContent pdl"> |
| <script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ |
| <broker brokerName="srv-a.mydomain.com" ...> |
| ... |
| |
| <networkConnectors> |
| <ldapNetworkConnector uri="ldap://myldap.mydomain.com:389" |
| base="dc=brokers-for-srv-a,dc=mydomain,dc=com" |
| anonymousAuthentication="true" |
| searchFilter="(cn=*)" |
| searchScope="SUBTREE_SCOPE" |
| networkTTL="2" |
| /> |
| <!-- networkTTL=2 since we want messages to flow from srv-a to srv-c --> |
| </networkConnectors> |
| |
| ... |
| </broker> |
| ]]></script> |
| </div></div> |
| <div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>srv-b.mydomain.com</b></div><div class="codeContent panelContent pdl"> |
| <script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ |
| <broker brokerName="srv-b.mydomain.com" ...> |
| ... |
| |
| <networkConnectors/> |
| <ldapNetworkConnector uri="ldap://myldap.mydomain.com:389" |
| base="dc=brokers-other,dc=mydomain,dc=com" |
| anonymousAuthentication="true" |
| searchFilter="(cn=*)" |
| searchScope="SUBTREE_SCOPE" |
| /> |
| </networkConnectors> |
| |
| ... |
| </broker> |
| ]]></script> |
| </div></div> |
| <div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>srv-c.mydomain.com</b></div><div class="codeContent panelContent pdl"> |
| <script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ |
| <broker brokerName="srv-c.mydomain.com" ...> |
| ... |
| |
| <networkConnectors/> |
| <!-- NO NETWORK CONNECTORS --> |
| </networkConnectors> |
| |
| ... |
| </broker> |
| ]]></script> |
| </div></div> |
| <div class="code panel pdl" style="border-width: 1px;"><div class="codeHeader panelHeader pdl" style="border-bottom-width: 1px;"><b>srv-d.mydomain.com</b></div><div class="codeContent panelContent pdl"> |
| <script class="brush: java; gutter: false; theme: Default" type="syntaxhighlighter"><![CDATA[ |
| <broker brokerName="srv-d.mydomain.com" ...> |
| ... |
| |
| <networkConnectors/> |
| <ldapNetworkConnector uri="ldap://myldap.mydomain.com:389" |
| base="dc=brokers-other,dc=mydomain,dc=com" |
| anonymousAuthentication="true" |
| searchFilter="(cn=*)" |
| searchScope="SUBTREE_SCOPE" |
| /> |
| </networkConnectors> |
| |
| ... |
| </broker> |
| ]]></script> |
| </div></div></div> |
| |
