Vfrdtyky

I have a trouble with configuring LDAP authentication with Spring.

Using LDAP Apache Directory Studio I have following working connection to LDAP Server:

Bind DN or USER: cn=HIDDEN_USERNAME,OU=HIDDEN_OU1,OU=HIDDEN2,OU=Admin,DC=MY_COMPANYNAME,DC=COM

Authorization ID: SASL PLAIN only

Bind Password: ******

Using this connection, I can find my account under root:

Root DSE/DC=MY_COMPANYNAME,DC=COM/OU=User Accounts/OU=Enabled Users/OU=Consultants/CN=MySurname My Name

Right click on my account gives following values:

DN: CN=MySurname MyName,OU=Consultants,OU=Enabled Users,OU=User Accounts,DC=MY_COMPANYNAME,DC=COM

URL: ldap://IP_ADRESS:389/CN=MySurname%20MyName,OU=Consultants,OU=Enabled%20Users,OU=User%20Accounts,DC=MY_COMPANYNAME,DC=COM

I am going to configure WebSecurityConfigurerAdapter in order to get authentication via ldap server in the following way:

@Override

public void configure(AuthenticationManagerBuilder auth) throws Exception {

    auth.ldapAuthentication()

            .userDnPatterns("CN={0},OU=Consultants,OU=Enabled Users,OU=User Accounts,DC=MY_COMPANYNAME,DC=COM")

            .contextSource()

            .url("ldap://IP_ADRESS:389/")

            .managerDn("HIDDEN_USERNAME")

            .managerPassword("*****")

            .and()

            .passwordCompare()

            .passwordEncoder(new LdapShaPasswordEncoder())

            .passwordAttribute("userPassword");

}

I tried to set userDnPattern in many ways without result. What I am doing wrong?

Using the DN pattern you specify, your logon attempt would need to be made with user ID "MySurname MyName" (and the space may be an issue). The user provided logon ID string is inserted into the DN pattern you include above, and you'll be binding with

CN=MySurname MyName,OU=Consultants,OU=Enabled Users,OU=User Accounts,DC=MY_COMPANYNAME,DC=COM

Which matches what your fully qualified DN appears to be. If you want to be able to log on with your ID and not the surname/name string that makes up your CN, or if accounts which need to authenticate exist in multiple OU locations, userSearch may be preferable to DN patterns.

If you are authenticating against an Active Directory domain, you may be able to use {0}@domain.gTLD or DOMAIN{0} as the user pattern -- when a logon ID is supplied, these patterns form the userPrincipalName and sAMAccountName respectively.

In response to your comment above: Active Directory hides the password field and it cannot be read even by domain administrators.

I concur with the other user that for AD you need to use a user search filter and if you want to do it against the username you should use samaccountname={0}