I am trying to authenticate and then query AD tree using Spring Ldap Security and Spring Ldap.
Following is my configuration file -
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:ldap="http://www.springframework.org/schema/ldap"
xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/ldap
http://www.springframework.org/schema/ldap/spring-ldap.xsd
http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd">
<http use-expressions="true">
<form-login login-page="/myApp/ldap" default-target-url="/myApp/ldap/config"
authentication-failure-url="/myApp/ldap?error=true" />
<logout />
</http>
<beans:bean
class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<beans:property name="location">
<beans:value>classpath:/ldap.properties</beans:value>
</beans:property>
<beans:property name="SystemPropertiesMode">
<beans:value>2</beans:value>
</beans:property>
</beans:bean>
<beans:bean id="adAuthenticationProvider" scope="prototype"
class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">
<!-- the domain name (may be null or empty). If no domain name is configured, it is assumed that the username will always contain the domain name. -->
<beans:constructor-arg index="0" value="${sample.ldap.domain}" />
<!-- an LDAP url (or multiple URLs) -->
<beans:constructor-arg index="1" value="${sample.ldap.url}" />
<!-- Determines whether the supplied password will be used as the credentials in the successful authentication token. -->
<beans:property name="useAuthenticationRequestCredentials"
value="true" />
<!-- by setting this property to true, when the authentication fails the error codes will also be used to control the exception raised. -->
<beans:property name="convertSubErrorCodesToExceptions"
value="true" />
</beans:bean>
<authentication-manager erase-credentials="false">
<authentication-provider ref="adAuthenticationProvider" />
</authentication-manager>
<beans:bean
class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<beans:property name="location">
<beans:value>classpath:/ldap.properties</beans:value>
</beans:property>
<beans:property name="SystemPropertiesMode">
<beans:value>2</beans:value> <!-- OVERRIDE is 2 -->
</beans:property>
</beans:bean>
<ldap:context-source id="contextSource"
url="${sample.ldap.url}"
base="${sample.ldap.base}"
referral="follow"
authentication-source-ref="authenticationSource"
base-env-props-ref="baseEnvironmentProperties"/>
<util:map id="baseEnvironmentProperties">
<beans:entry key="com.sun.jndi.ldap.connect.timeout" value="60000" />
<beans:entry key="java.naming.ldap.attributes.binary" value="objectGUID objectSid"/>
</util:map>
<beans:bean id="authenticationSource"
class="org.springframework.security.ldap.authentication.SpringSecurityAuthenticationSource" />
<ldap:ldap-template id="ldapTemplate"
context-source-ref="contextSource" />
</beans:beans>
And property file is -
sample.ldap.url=ldap://xxx.xxx.xxx.xxx:3268
sample.ldap.base=dc=example,dc=com
sample.ldap.clean=true
sample.ldap.directory.type=AD
sample.ldap.domain=example.com
These setting works fine for following login -
username - example@example.com or example Password - blah
but fails when i try - username - example2@example.net or example Password - blah2
These both are valid logins, and have been validated by login using AD Explorer.
Seems like i need to update my configuration to support UPN suffix/domains as default works fine and other do not.
Is there a way i can append to this config file to support this logic, supporting authenticating/querying multiple domains?