Spring Security LDAP获取用户给定名称

Question

I am using Spring security 3.2.4 with Windows AD LDAP. I am able to successfully authenticate and LdapUserDetailsImpl is populated. From LdapUserDetailsImpl I can get the username, authorities, but how to get the employee name (not the login user name) LdapUserDetailsImpl contains following properties and values

Username = 40000 , 
Enabled = true,
AccountNonExpired = true,
Dn: cn=employee name,ou=IT_FM,ou=XXX_USERS,dc=XXXX,dc=CO,dc=IN;

How do it get the employee name, Do I need to extend some class and write my own mapping or may be simply get Dn from the principal and split the string to get the employee name.

Answer 1

You can just get the Dn from Principal and extract the username (cn)

LdapUserDetailsImpl ldapDetails = (LdapUserDetailsImpl) SecurityContextHolder
            .getContext().getAuthentication().getPrincipal();
String dn = ldapDetails.getDn();
int beginIndex = dn.indexOf("cn=") + 3;
int endIndex = dn.indexOf(",");
String username = dn.substring(beginIndex, endIndex);

Answer 2

@Mukun almost has this. The only thing is, instead of:

String dn = ldapUserDetailsImpl.getDn();
int beginIndex = dn.indexOf("cn=") + 3;
int endIndex = dn.indexOf(",");
myUserDetails.setEmployeeName(dn.substring(beginIndex, endIndex));

I would have:

String name = ctx.getObjectAttribute("cn").toString()
myUserDetails.setEmployeeName(name)

This lets LDAP integration handle all the horrible stuff for you and loses the danger of chopping up strings yourself.

You might also consider

myUserDetails.setFirstName(ctx.getObjectAttribute("givenName").toString())
myUserDetails.setLastName(ctx.getObjectAttribute("sn").toString())

These things should work for both MS AD, "normal" LDAP and possible Novell too.

So the full answer would be:

@Service
public class MyUserDetailsContextMapper extends LdapUserDetailsMapper implements UserDetailsContextMapper {
    @Override
    public UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection<? extends GrantedAuthority> authorities) {
        LdapUserDetailsImpl ldapUserDetailsImpl = (LdapUserDetailsImpl) super.mapUserFromContext(ctx, username, authorities);
        MyUserDetails myUserDetails = new MyUserDetails();
        myUserDetails.setAccountNonExpired(ldapUserDetailsImpl.isAccountNonExpired());
        myUserDetails.setAccountNonLocked(ldapUserDetailsImpl.isAccountNonLocked());
        myUserDetails.setCredentialsNonExpired(ldapUserDetailsImpl.isCredentialsNonExpired());
        myUserDetails.setEnabled(ldapUserDetailsImpl.isEnabled());
        myUserDetails.setUsername(ldapUserDetailsImpl.getUsername());
        myUserDetails.setAuthorities(ldapUserDetailsImpl.getAuthorities());
        myUserDetails.setEmployeeName(ctx.getObjectAttribute("cn").toString());
        return myUserDetails;
    }
}

Answer 3

My Custom Mapper. Is this correct way of doing ?

 @Service
    public class MyUserDetailsContextMapper extends LdapUserDetailsMapper implements UserDetailsContextMapper {
        @Override
        public UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection<? extends GrantedAuthority> authorities) {
            LdapUserDetailsImpl ldapUserDetailsImpl = (LdapUserDetailsImpl) super.mapUserFromContext(ctx, username, authorities);
            MyUserDetails myUserDetails = new MyUserDetails();
            myUserDetails.setAccountNonExpired(ldapUserDetailsImpl.isAccountNonExpired());
            myUserDetails.setAccountNonLocked(ldapUserDetailsImpl.isAccountNonLocked());
            myUserDetails.setCredentialsNonExpired(ldapUserDetailsImpl.isCredentialsNonExpired());
            myUserDetails.setEnabled(ldapUserDetailsImpl.isEnabled());
            myUserDetails.setUsername(ldapUserDetailsImpl.getUsername());
            myUserDetails.setAuthorities(ldapUserDetailsImpl.getAuthorities());
            String dn = ldapUserDetailsImpl.getDn();
            int beginIndex = dn.indexOf("cn=") + 3;
            int endIndex = dn.indexOf(",");
            myUserDetails.setEmployeeName(dn.substring(beginIndex, endIndex));
            return myUserDetails;
        }

    }