Spring boot ldap security

Question

Hello I have a problem creating simple login with Ldap. I have downloaded getting started project from spring.io website: Getting started LDAP.

It is working perfectly with ldif file but I want to replace it with running ldap server. I have tried it for days with no progress. I get best results with this piece of code (replaced in WebSecurityConfig of getting started project)

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated().and().httpBasic();
    }
 
    @Override
    protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
        authManagerBuilder.authenticationProvider(activeDirectoryLdapAuthenticationProvider()).userDetailsService(userDetailsService());
    }
 
    @Bean
    public AuthenticationManager authenticationManager() {
        return new ProviderManager(Arrays.asList(activeDirectoryLdapAuthenticationProvider()));
    }
    @Bean
    public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
        ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider(null, "ldap://ip:port/", "ou=GROUP,dc=domain,dc=com");
        provider.setConvertSubErrorCodesToExceptions(true);
        provider.setUseAuthenticationRequestCredentials(true);
 
        return provider;
    }
}

If i try to login with good username and password in format "username" "password" console output: ActiveDirectoryLdapAuthenticationProvider : Active Directory authentication failed: Supplied password was invalid

If I use "username@domain.com" and good password, page just reloads with no output to console.

If I use random username and password console: Active Directory authentication failed: Supplied password was invalid

Can someone help?

As you used 'null' for the Domain in the constructor of ActiveDirectoryLdapAuthenticationProvider , you must use the 'userPrincipalName' (username@domain.com) to authenticate You may turn on logging to find out why this does not work or if you don't use LDAPS or StartTLS extended operation a network trace will tell for sure if the LDAP BIND request succeeded — Bernhard Thalmayr, Feb 14 '17 at 22:14

score 2 · Accepted Answer · edited Sep 28 '20 at 15:57

As suggested in comment I have turned on logging and found out that the problem is same with "username@domain.com" too.

Problem was in aciveDirectoryLdapAuthenticationProvider() there were 3 problems in it.

I have removed OU group from rootDn and added domain so we can use only username to log in.

ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider("domain.com", "ldap://ip:port/", "dc=domain,dc=com");

changed searchfilter of provider

provider.setSearchFilter("(&(objectClass=user)(sAMAccountName={0}))");

and finally I had to change ActiveDirectoryLdapAuthProvider searchForUser method because it was matching "username@domain.com" with sAMAccountName istead of "username". This:

return SpringSecurityLdapTemplate.searchForSingleEntryInternal(context,
                    searchControls, searchRoot, searchFilter,
                    new Object[] { bindPrincipal });

replaced with this:

return SpringSecurityLdapTemplate.searchForSingleEntryInternal(context,
                searchControls, searchRoot, searchFilter,
                new Object[] { username });

Complete aciveDirectoryLdapAuthenticationProvider:

    @Bean
    public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
        ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider("domain.com", "ldap://ip:port/", "dc=domain,dc=com");  
        provider.setSearchFilter("(&(objectClass=user)(sAMAccountName={0}))");
        provider.setConvertSubErrorCodesToExceptions(true);
        provider.setUseAuthenticationRequestCredentials(true);
        return provider;
    }

Can someone provide better solution for the second/third problem? maybe better searchfilter? I dont have any field in ldap that matches "username@domain.com" format of bindPrincipal that is using ActiveDirectoryLdapAuthProvider.

Hi @user3551808, can you please tell me how and where did you turn on the logging? I have similar errors and I wish to see more logging, but it does not seem to happen, I use logback.xml, and I just did this entry in the beginning of the logback.xml:'debug="true", but it did not seem to help. — soMuchToLearnAndShare, May 19 '17 at 13:51
To enable logging logging.level.org.springframework.security: DEBUG — cmptrwizard, Jul 12 '18 at 17:39
I used https://www.broadleafcommerce.com/docs/core/5.2/tutorials/admin-customization-tutorials/using-ldap-admin-security for a custom ldapAuthenticatorProvider and it worked. — Sylhare, Sep 30 '20 at 14:01

Spring boot ldap security

1 Answers1