Tomcat 上的 Spring Boot LDAP 身份验证（预身份验证）

Question

I'm creating a Spring Boot application, which should be accessible only to users in LDAP. This application should be deployed to a Tomcat server (not an embedded server). The configuration for the LDAP is done in Tomcat itself:

<Realm className="org.apache.catalina.realm.LockOutRealm">
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
        resourceName="UserDatabase"/>
    <Realm className="org.apache.catalina.realm.JNDIRealm"
        connectionURL="ldap://someldapserver:389"
        userPattern="uid={0},dc=example,dc=com"
        roleBase="dc=example,dc=com"
        roleName="cn"
        roleSearch="(uniqueMember={0})"/>
</Realm>

If I try to access the Tomcat Manager, I can authenticate with LDAP credentials, so the connection basically works.

This is my configuration:

@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/test").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin().permitAll()
                .and()
            .logout().permitAll()
                .and()
            .csrf().disable();
    }
}

I know I could configure the LDAP connection directly in the application ( authenticationManagerBuilder.ldapAuthentication()... ), but this is not what I want.

How can I tell Spring Boot to use the LDAP authentication from Tomcat for the application?

UPDATE

It looks like I have to enable Pre-Authentication . This can be done with .and().jee().mappableRoles("ROLE_ADMIN") . This seems to work, but I still can't authenticate: No pre-authenticated principal found in request .

Do I have to add something to Tomcats configuration?

Answer 1

I couldn't find any suitable solution for this, so I removed Spring Security entirely and added the constraints to a web.xml . With the context.xml it is possible to set the authentication method (eg if you wish to switch to tomcat-users.xml authentication, see example below). Then the authentication over Tomcat works.

web.xml:

<?xml version="1.0" encoding="UTF-8"?>
<web-app>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Authentication</web-resource-name>
            <url-pattern>/test/test</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>users</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>BASIC</auth-method>
    </login-config>
    <security-role>
        <role-name>users</role-name>
    </security-role>
</web-app>

context.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Context>
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
</Context>