LDAP + Spring：如何正确认证？

Question

I realize LDAP authentication by Spring. In my case, I use ActiveDirectoryLdapAuthenticationProvider .

It looks like here:

    private Authentication authenticate(String username, String password, HelpDescUser userDetails) {
    String url = "ldap://" + ldapHost + ":" + port + "/";
    ActiveDirectoryLdapAuthenticationProvider ldapProvider =
            new ActiveDirectoryLdapAuthenticationProvider(domain, url, rootDn);
    String filterWithName = String.format(filter, username);
    ldapProvider.setSearchFilter(filterWithName);
    ldapProvider.setContextEnvironmentProperties(createProperties(username, password));
    ldapProvider.setConvertSubErrorCodesToExceptions(true);
    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(username, password);

    Authentication authenticate;
    try {
        authenticate = ldapProvider.authenticate(authentication);
    } catch (Exception e) {
        throw new BadCredentialsException("Пользователь не авторизован (сервер LDAP не подтвердил авторизацию).");
    }
    if (Objects.nonNull(authenticate) && authenticate.isAuthenticated()) {
        return new UsernamePasswordAuthenticationToken(userDetails, password, userDetails.getAuthorities());
    } else {
        throw new BadCredentialsException("Пользователь не авторизован (сервер LDAP не подтвердил авторизацию).");
    }
}


private Map<String, Object> createProperties(String username, String password) {
        Map<String, Object> properties = new HashMap<>();
        properties.put(Context.SECURITY_PRINCIPAL, username);
        properties.put(Context.SECURITY_CREDENTIALS, password);
        return properties;
}

I have a problem.

As I understand authentication schema, when we authenticate by user, we also need to have a technical account. We bind by technical account & than sending user login & password, & after that, we receive answer. But in this schema, we bind with the same user to authenticate, & it's wrong - this user may have no rights to bind.

Please, show me working solution to authenticate with Spring ActiveDirectoryLdapAuthenticationProvider ?

Answer 1

When you declare ActiveDirectoryLdapAuthenticationProvider bean, you can use setContextEnvironmentProperties() method.

In example:

@Bean
public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
    ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider(null, ldapUrls, ldapBase);
    setContextEnvironmentProperties(provider);
    return provider;
}

private void setContextEnvironmentProperties(ActiveDirectoryLdapAuthenticationProvider provider) {
    Map<String, Object> contextEnvironmentProperties = new HashMap<>();
    if (StringUtils.isNotEmpty(ldapUsername)) {
        contextEnvironmentProperties.put(Context.SECURITY_PRINCIPAL, ldapUsername);
    }
    if (StringUtils.isNotEmpty(ldapPassword)) {
        contextEnvironmentProperties.put(Context.SECURITY_CREDENTIALS, ldapPassword);
    }
    if (!contextEnvironmentProperties.isEmpty()) {
        provider.setContextEnvironmentProperties(contextEnvironmentProperties);
    }
}