& Continuous Learning

The folks at Spring have made it extremely easy to allow your application authenticate and authorize users with Spring LDAP. This blog entry explains how to check your directory structure and use some sparsely documented Spring LDAP parameters ({0} and {1}) to get everything working.

In your Spring Security configuration, pointing to your directory is straight forward:

<ldap-server id="ldapServer" url="ldap://dir.yourdomain.com:389/" />

But in configuring the ldap-authentication-provider, you need to know a few things about your directory of course! We recommend using Apache Directory Studio to browse your directory - it's a fantastic application.

If you're more of a command-line person, just use ldapsearch (example below):

ldapsearch -H ldap://dir.yourdomain.com:389 -ZZ -x
-D "cn=AdminUser,dc=yourdomain,dc=com" -W -b "cn=users,ou=groups,dc=yourdomain,dc=com"
-s base -a always "(objectClass=*)" "*"

Once connected to your directory, you'll need to figure out how your groups are configured. Specifically, you'll want to know if your configuration looks like

Example A:

• dc=yourdomain,dc=com
• ou=groups
• cn=users
• memberUid=USERNAME

• dc=yourdomain,dc=com
• ou=groups
• cn=users
• memberUid=uid= USERNAME,ou=people,dc= yourdomain,dc=com

If it's like Example A, you'll want your config like this:

<ldap-authentication-provider server-ref="ldapServer"
	user-search-base="ou=people,dc=yourdomain,dc=com"
	user-search-filter="(uid={0})"
	group-role-attribute="cn"
	group-search-base="ou=groups,dc=yourdomain,dc=com"
	group-search-filter="(memberUid={1})"
	role-prefix="ROLE_" />

otherwise, you'll want this config:

<ldap-authentication-provider server-ref="ldapServer"
	user-search-base="ou=people,dc=yourdomain,dc=com"
	user-search-filter="(uid={0})"
	group-role-attribute="cn"
	group-search-base="ou=groups,dc=yourdomain,dc=com"
	group-search-filter="(memberUid={0})"
	role-prefix="ROLE_" />

Note the difference in the group-search-filter:

• {0} contains the username with the entire ldap base.
• {1} only contains username.