Tomcat 6 - authentication through active directory with encrypted password - authentication

Question

I am trying to connect to tomcat with an active directory user.
When the password is in plain text like the following:
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionURL="ldap://localhost:389"
connectionName="user_name"
connectionPassword="password"
userBase="OU=blabla,DC=aaa,DC=com"
userSubtree="true"
userSearch="(sAMAccountName={0})"
userRoleName="memberOf"
roleBase="OU=blabla,DC=aaa,DC=com"
roleName="cn"
roleSubtree="true"
roleSearch="(member={0})" />
the authentication is ok. BUT, I don't want a password in my configuration file.
I tried the following:
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionURL="ldap://localhost:389"
digest="MD5"
connectionName="user_name"
connectionPassword="encrypted_password"
userBase="OU=blabla,DC=aaa,DC=com"
userSubtree="true"
userSearch="(sAMAccountName={0})"
userRoleName="memberOf"
roleBase="OU=blabla,DC=aaa,DC=com"
roleName="cn"
roleSubtree="true"
roleSearch="(member={0})" />
but the authentication fails.
I didn't find any solution.
I will really appreciate any help
thank you

Answer 1

I think your only alternative is to subclass JNDIRealm and make a new attribute that will have some sort of encrypted connection password. The password can't be hashed (with, e.g. MD5 as you specify) because hashes are one-way--there's no undoing a hash--and Tomcat needs the password in its original unhashed form to authenticate against the AD installation.
If you use a reversible encryption in your JNDIRealm subclass, then when Tomcat needs the password you can decrypt the password and pass it along.