Setting up LDAP authentication in Spring Security

2019-09-09 21:11发布

问题:

I want to use LDAP authentication in my application. The examples I have come across use a simple AD structure. The company AD I want to authenticate against uses the structure below:

The "OU=Users" is where the users exist and I want to search against. This as seen is present at multiple places in nested OUs. I did try setting up authentication, but it keeps failing saying Bad credentials even though they are right. Is this due to the structure we have ?

The configuration looks like this:

    @Configuration
    protected static class AuthenticationConfiguration extends
        GlobalAuthenticationConfigurerAdapter {

    @Override
    public void init(AuthenticationManagerBuilder auth) throws Exception {
        auth.ldapAuthentication()
                .contextSource().url("ldap://url/DC=example,DC=com")
                .managerDn("sampleaccount,OU=ServiceAccounts,DC=example,DC=com").managerPassword("password")
                .and().userSearchBase("DC=example,DC=com").userSearchFilter("(sAMAccountName={0})");
    }
}

Any suggestions on how to go about this ?

EDIT: The logs show this:

2016-06-14 15:00:26.948 DEBUG 13792 --- [nio-8080-exec-7] o.s.s.authentication.ProviderManager     : Authentication attempt using org.springframework.security.ldap.authentication.LdapAuthenticationProvider
2016-06-14 15:00:26.948 DEBUG 13792 --- [nio-8080-exec-7] o.s.s.l.a.LdapAuthenticationProvider     : Processing authentication request for user: testUser
2016-06-14 15:00:26.948 DEBUG 13792 --- [nio-8080-exec-7] o.s.s.l.s.FilterBasedLdapUserSearch      : Searching for user 'testUser', with user search [ searchFilter: '(sAMAccountName={0})', searchBase: 'OU=OU1,OU=OU2,OU=OU3,OU=OU4,DC=example,DC=com', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
2016-06-14 15:00:27.742 DEBUG 13792 --- [nio-8080-exec-7] .s.a.DefaultAuthenticationEventPublisher : No event was found for the exception org.springframework.security.authentication.InternalAuthenticationServiceException
2016-06-14 15:00:27.742 DEBUG 13792 --- [nio-8080-exec-7] o.s.s.w.a.www.BasicAuthenticationFilter  : Authentication request for failed: org.springframework.security.authentication.InternalAuthenticationServiceException: [LDAP: error code 32 - 0000208D: NameErr: DSID-03100238, problem 2001 (NO_OBJECT), data 0, best match of:
    'DC=example,DC=com'
 ]; nested exception is javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-03100238, problem 2001 (NO_OBJECT), data 0, best match of:
    'DC=example,DC=com'
 ]; remaining name 'ou=Users,ou=OU2,ou=OU3,ou=OU4,dc=example,dc=com'
2016-06-14 15:00:27.742 DEBUG 13792 --- [nio-8080-exec-7] s.w.a.DelegatingAuthenticationEntryPoint : Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]
2016-06-14 15:00:27.742 DEBUG 13792 --- [nio-8080-exec-7] s.w.a.DelegatingAuthenticationEntryPoint : Match found! Executing org.springframework.security.web.authentication.HttpStatusEntryPoint@2bb83072
2016-06-14 15:00:27.742 DEBUG 13792 --- [nio-8080-exec-7] o.s.s.w.header.writers.HstsHeaderWriter  : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@7a9711fa
2016-06-14 15:00:27.742 DEBUG 13792 --- [nio-8080-exec-7] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2016-06-14 15:00:27.742 DEBUG 13792 --- [nio-8080-exec-7] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed