使用Spring Security 3.2，Spring Ldap 2.0和JavaConfig的Active Directory身份驗證

Question

我正在編寫一個需要用戶登錄的Web應用程序。我的公司有一個Active Directory服務器，我想用於此目的。但是，我無法使用Spring對用戶憑證進行身份驗證。

我使用Spring Security 3.2.2，Spring Ldap 2.0.1和Java 1.7。

Web應用程序啓動良好，對InMemory-Authentication進行身份驗證也很有效，所以我的應用程序的其餘部分似乎配置正確。

這裏是我的配置：

@Configuration 
@EnableWebSecurity 
public class LdapConfig extends WebSecurityConfigurerAdapter { 

    @Bean 
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() { 
     val provider = new ActiveDirectoryLdapAuthenticationProvider("my.domain", "ldap://LDAP_ID:389/OU=A_GROUP,DC=domain,DC=tld"); 
     provider.setConvertSubErrorCodesToExceptions(true); 
     provider.setUseAuthenticationRequestCredentials(true); 
     provider.setUseAuthenticationRequestCredentials(true); 
     return provider; 
    } 

    @Bean 
    public LoggerListener loggerListener() { 
     return new LoggerListener(); 
    } 

    @Override 
    protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
     auth.authenticationProvider(activeDirectoryLdapAuthenticationProvider()); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     // Configuration for Redirects, Login-Page and stuff 
    } 
} 

當我嘗試使用MY_USERNAME和MY_PASSWORD我得到了Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials

完整堆棧跟蹤登錄：

14:59:00,508 DEBUG UsernamePasswordAuthenticationFilter:205 - Request is to process authentication 
14:59:00,509 DEBUG ProviderManager:152 - Authentication attempt using org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider 
14:59:00,509 DEBUG ActiveDirectoryLdapAuthenticationProvider:65 - Processing authentication request for user: USERNAME 
14:59:00,563 ERROR ActiveDirectoryLdapAuthenticationProvider:133 - Failed to locate directory entry for authenticated user: USERNAME 
javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-0310020A, problem 2001 (NO_OBJECT), data 0, best match of: 
    'OU=A_GROUP,DC=domain,DC=tld' 
    at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) 
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source) 
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) 
    at javax.naming.directory.InitialDirContext.search(Unknown Source) 
    at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntryInternal(SpringSecurityLdapTemplate.java:208) 
    at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider.searchForUser(ActiveDirectoryLdapAuthenticationProvider.java:285) 
    at org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider.doAuthentication(ActiveDirectoryLdapAuthenticationProvider.java:130) 
    at org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:80) 
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156) 
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:177) 
    at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:94) 
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) 
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110) 
    ... a few more 

14:59:00,597 WARN LoggerListener:60 - Authentication event AuthenticationFailureBadCredentialsEvent: USERNAME; details: org.springframework.security.web.authentication.WebAuthenticationDetails@0: RemoteIpAddUSERNAME: 0:0:0:0:0:0:0:1; SessionId: 1E9401031886F0155F0ACE881CC50A4B; exception: Bad credentials 
14:59:00,597 DEBUG UsernamePasswordAuthenticationFilter:348 - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials 
14:59:00,597 DEBUG UsernamePasswordAuthenticationFilter:349 - Updated SecurityContextHolder to contain null Authentication 
14:59:00,597 DEBUG UsernamePasswordAuthenticationFilter:350 - Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@3d876453 

當我瀏覽使用該AD Ldap-Explorer並搜索(&(objectClass=user)(userPrincipalName=MY_USERNAME))，Spring在ActiveDirectoryLdapAuthenticationProvider：searchForUser（...）中執行此操作，它將返回正確的用戶。

輸入無效密碼時，Spring返回ActiveDirectoryLdapAuthenticationProvider:200 - Active Directory authentication failed: Supplied password was invalid。這似乎是好的。

是否缺少配置的一部分？

是否有任何工作示例如何爲使用JavaConfig的AD配置Spring Ldap？官方春天指南只是介紹了XML的方式http://docs.spring.io/spring-security/site/docs/3.1.5.RELEASE/reference/ldap.html#ldap-active-directory

更新： 剛剛更新我的AuthenticationProvider以下幾點：

@Bean 
public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() { 
    val provider = new ActiveDirectoryLdapAuthenticationProvider("company.tld", "ldap://LDAP_URL:389"); 
    provider.setConvertSubErrorCodesToExceptions(true); 
    provider.setUseAuthenticationRequestCredentials(true); 

    provider.setAuthoritiesMapper(myAuthoritiesMapper()); // see http://comdynamics.net/blog/544/spring-security-3-integration-with-active-directory-ldap/ 

    provider.setUseAuthenticationRequestCredentials(true); 

    return provider; 
} 

它工作得很好，感謝圭多！

注意：Spring狀態，PartialResultException被忽略。文檔說

某些Active Directory（AD）服務器無法自動跟蹤引薦，這往往會導致在搜索中拋出PartialResultException。通過將ignorePartialResultException屬性設置爲true，可以指定PartialResultException將被忽略。

也許有一種方法可以通過JavaConfig來設置這個屬性。我只是無視它。

Answer 1

1. 對於PartialResultException您應該將參數引用設置爲您的上下文源中的「跟隨」。

如： https://stackoverflow.com/a/26872236/2718510