Spring Boot LDAP 认证和匹配数据库用户

Question

I have a Spring Boot MVC application which uses LDAP for authentication. This works fine, but now I have to match authenticated user (from LDAP repository) with users from my database. I created LDAPUser:

import java.util.jar.Attributes.Name;

import org.springframework.ldap.odm.annotations.Attribute;
import org.springframework.ldap.odm.annotations.Entry;
import org.springframework.ldap.odm.annotations.Id;

@Entry(
    base="ou=users",
    objectClasses = { "person", "inetOrgPerson", "top" })
public class LDAPUser {

    @Id
    private Name id;

    private @Attribute(name = "cn") String username;
    private @Attribute(name = "sn") String password;
    private boolean rememberme;
}

And LDAPUserRepository:

import org.springframework.data.ldap.repository.LdapRepository;
import org.springframework.stereotype.Repository;

import com.licensewatcher.model.LDAPUser;

@Repository("ldapUserRespository")
public interface LDAPUserRepository extends LdapRepository<LDAPUser>{

    LDAPUser findByUsername(String username);
    LDAPUser findByUsernameAndPassword(String username, String password);
    /*List<LDAPUser> findByUsernameLikeIgnoreCase(String username);*/
}

and AuthUserService:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import com.licensewatcher.repository.LDAPUserRepository;

@Service("authUserService")
public class AuthUserService {

    @Autowired LDAPUserRepository ldapUserRespository;

    public boolean authenticate(LDAPUser ldapUser) {
        //TODO: implement this!!!

        return false;
    }

    public boolean authorize(LDAPUser ldapUser) {
        //TODO: implement this!!!

        return false;
    }
}

Class WebSecurityConfig (extends WebSecurityConfigurerAdapte) configures application to submit login controller action:

@PostMapping("/login/check")
public String login(Model model, LDAPUser ldapUser, RedirectAttributes redirectAttr) {

    //TODO: call authUserService.authenticate(LDAPUser ldapUser);
    return "redirect:/login";
}

I want to implement authUserService.authenticate(LDAPUser ldapUser) to check LDAPUserRepository first and if user exists, check up the User from my database. If they match, add user to a session and redirect to the requested page. Is this a good approach? Do you have any suggestions how this could be implemented in a more elegant way? Thanks in advance!

Answer 1

Here is my answer based on the link I provided in the comment. This work using the latest Spring boot version 2.7.1 and Spring security 5.7.2

I'm using Custom Spring Authentication Provider.

class CustomAuthProvider

 @Component
 public class CustomAuthProvider implements AuthenticationProvider {

    @Autowired
    RfaUserService rfaUserService;

    @Autowired
    AuthenticationManager ldapAuthenticationManager;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        Optional<RfaUser> rfaUser = rfaUserService.findByUsername((String) authentication.getPrincipal());
        if (rfaUser.isPresent()) {
            return ldapAuthenticationManager.authenticate(authentication);
        }

        return null;
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

class WebSecurityConfig

@Configuration
public class WebSecurityConfig {

@Autowired
private CustomAuthProvider customAuthProvider;

@Bean
public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
            .httpBasic()
            .and()
            .authorizeRequests()
            .anyRequest()
            .authenticated()
            .and()
            .cors()
            .and()
            .csrf()
            .disable().logout();

    // here is the important part
    httpSecurity.authenticationProvider(customAuthProvider);

    return httpSecurity.build();
}

LDAP configuration class

@Configuration
public class LdapSecurityConfig {

    @Value("${ldap.urls}")
    private String ldapUrls;

    @Value("${ldap.base.dn}")
    private String ldapBaseDn;

    @Value("${ldap.username}")
    private String ldapSecurityPrincipal;

    @Value("${ldap.password}")
    private String ldapPrincipalPassword;

    @Value("${ldap.user.dn.pattern}")
    private String ldapUserDnPattern;

    @Autowired
    private CustomAuthoritiesPopulator customAuthoritiesPopulator;
    @Autowired
    private CustomUserDetailsMapper customUserDetailsMapper;


    @Bean
    public AuthenticationManager ldapAuthenticationManager(BaseLdapPathContextSource contextSource) {
        LdapBindAuthenticationManagerFactory managerFactory = new LdapBindAuthenticationManagerFactory(contextSource);
        managerFactory.setUserDnPatterns(ldapUserDnPattern);
        managerFactory.setUserDetailsContextMapper(customUserDetailsMapper);
        managerFactory.setLdapAuthoritiesPopulator(customAuthoritiesPopulator);
        managerFactory.setUserSearchFilter("sAMAccountName={0}");

        return managerFactory.createAuthenticationManager();
    }

    @Bean
    public LdapContextSource contextSource() {
        LdapContextSource ldapContextSource = new LdapContextSource();
        ldapContextSource.setUrl(ldapUrls);
        ldapContextSource.setBase(ldapBaseDn);
        ldapContextSource.setUserDn(ldapSecurityPrincipal);
        ldapContextSource.setPassword(ldapPrincipalPassword);
        return ldapContextSource;
    }
}