title: Apache Shiro LDAP Configuration (2 Step Authentication)
body: <p>I'm working on a webapplication using the following:</p>
  
  <ul>
  <li>Apache Shiro 1.2.4</li>
  <li>Tomcat 8</li>
  <li>Java 8</li>
  </ul>
  
  <p>I'm trying to authenticate users via an LDAP realm.</p>
  
  <p>I tested the login with JXplorer using the following values:</p>
  
  <ul>
  <li>BaseND: ou=students,ou=users,o=data</li>
  <li>UserDN/BindDN: cn={my distinguished name},ou=students,ou=users,o=data</li>
  <li>JXplorer also has a certificate that I imported</li>
  </ul>
  
  <p>Now to my problem:</p>
  
  <p>I have to authenticate the users not based on <code>cn</code> but rather on <code>uid</code>.
  This wont work however.</p>
  
  <p><strong>Workflow suggested by LDAP-Admin at my company:</strong></p>
  
  <p>I have a system user which (as far as I understood) should connect to the LDAP-Server, searches the user based on the given <code>uid</code> and returns the <code>cn</code> for that user.</p>
  
  <p>In a second step it should then be possible to authenticate the user with his <code>cn</code> just like its done (successfully) in JXplorer.</p>
  
  <hr>
  
  <p>My shiro.ini configuration looks like this for my test LDAP (not the one I'm trying to authenticate against now)</p>
  
  <pre><code>ldapRealm = org.apache.shiro.realm.ldap.JndiLdapRealm
  ldapRealm.userDnTemplate = cn={0},ou=People,dc=maxcrc,dc=com
  ldapRealm.contextFactory.url = ldap://localhost:389
  </code></pre>
  
  <p>The problem I'm facing right now is that I cannot find information about how to configure my shiro.ini file in a way to math the suggested workflow from above.</p>
  
  <p><strong>Question #1</strong></p>
  
  <p>Can I use the standard <code>org.apache.shiro.realm.ldap.JndiLdapRealm</code> (how do I configure it)? Especially for the integration of the certificate I could not find anything appropriate.</p>
  
  <p><strong>Question #2</strong></p>
  
  <p>Do I need to create a custom JndiLdapRealm for this "2 step authentication" and how could such a Realm look like?</p>