LDAP Integration & Customization Points

Introduction
When the authentication mode is set to LDAP, LogonCmdImpl invokes the LDAPIntegrationCmdImpl which contains the main customization points when dealing with the user and organization data flow to and from the WCS and LDAP.


LDAPIntegrationCmdImpl provides methods that can be overridden to customize the LDAP synchronization. Since LDAP integration requires a site-wide implementation, only one implementation of this command can be registered by using store 0.

Organization Structure Mapping between WCS & LDAP
It is recommended that the organization structure and distinguished names on the LDAP server match what is in WCS database. Following LDAPIntegrationCmd command methods are used for mapping between LDAP and WCS DNs:
public String getLDAPDN(String astrCommerceDN) throws ECException;
public String getCommerceDN(String astrLDAPDN, DataObject adoMember) throws ECException;

Callout to do extra processing during Single sign on (SSO) and Logon
In LogonCmdImpl.java, when the authentication mode is set to LDAP, and the authentication is successful,
if (MemberHelper.isLDAPUsedForAuthentication())
{
        postLDAPAuthenticationProcessing();
}

protected void postLDAPAuthenticationProcessing() throws ECException
   {
    LDAPIntegrationCmd cmdLDAPIntegration =
       (LDAPIntegrationCmd)CommandFactory.createCommand(
      LDAPIntegrationCmd.NAME,
      new Integer(0));    
    cmdLDAPIntegration.postLogonProcessing(getUserObject());
}


The following method of LDAPIntegrationCmdImpl.java is called to allow further processing to be done:
- public void postLogonProcessing(UserAccessBean aUserAccessBean) throws ECException;

- UserSyncBean.findByMemberId(aUserAccessBean.getMemberId())
   Can be called to get the UserSyncBean.
- UserSyncBean.getLDAPMember()
   Returns a DataObject representing the object in LDAP, which can be used for any further processing.

After single sign on takes place, the following method is called to handle any additional processing:
public void postSingleSignOnProcessing(UserSyncBean aUserSyncBean) throws ECException;

Callout to do extra processing in SyncBean
The following method can be overridden to do extra processing whenever LDAP is being updated using a sync bean:
public void LDAPIntegrationCmd.postUpdateToLDAP (UserSyncBean userSyncBean) throws ECException;

The following method can be overridden to do extra processing whenever the WebSphere Commerce database is being updated by data from LDAP:
public void LDAPIntegrationCmd.postRefreshFromLDAP (UserSyncBean userSyncBean) throws ECException;


Synchronizing User/Organization Data between WCS & LDAP
The ldapentry.xml file is used to configure which attributes are synchronized between the LDAP server and the WebSphere Commerce database. Some commonly used attributes are specified by default. The actual synchronization is done whenever the synchronization beans are used: UserSyncBean for user profile data, and OrganizationSyncBean for organization data.

UserSyncBean and OrganizationSyncBean read and write data to the database as well as to LDAP. Each class reads and writes to a default set of WCS database tables. Each of these tables has a corresponding sync helper data object (DO) class that is used by the sync bean to read and write to the table:

UserSyncBean-
UserDO                         <->      USERS
UserRegistryDO            <->     USERREG
UserDemographicsDO  <->      USERDEMO
SelfAddressDO              <->     ADDRESS (SELF ADDRESS)
BusinessProfileDO         <->     BUSPROF
UserProfileDO               <->     USERPROF
MemberAttributesDO    <->     MBRATTRVAL

OrganizationSyncBean-
OrgEntityDO                <->     ORGENTITY
SelfAddressDO             <->    ADDRESS (SELF ADDRESS)
MemberAttributesDO  <->     MBRATTRVAL

The DO classes to include for each sync bean can be specified and changed from the default implementation to match custom needs. The task command can be extended, and more DO classes can be added if you want to synchronize with new custom user/organization tables.

Limiting Synchronization of Data
In some cases, you might not want the OrganizationSyncBean to update the LDAP server whenever an organization is created or update WebSphere Commerce. This exclusion can be specified in the ldapentry.xml file by using the "ldapToWcs" or "ldapOnly" flow options. In other case "bothDirections" can be used.

wimconfig.xml(VMM- Virtual Member Manager)
Add a property mapping to the wimconfig.xml to correctly use a LDAP repository with VMM. Member manager is a service which runs on the WAS.



To use WCS with LDAP, WAS Administrative Security must be enabled and configured to use Federated Repositories. The Federated Repositories feature is implemented using another WAS component called Virtual Member Manager (VMM). com.ibm.commerce.member.syncbeans.VMMProxy is used by WebSphere Commerce to call VMM APIs to interact with the LDAP server.