在 LDAP 子树中验证用户 (FilterBasedLdapUserSearch)

Question

. Answers to this question are eligible for a +250 reputation bounty. SJuan76 wants to to this question.

I am successfully authenticating and authoritating my user through LDAP:

    @Bean
    BaseLdapPathContextSource contextSource() {
        final var url = environment.getRequiredProperty("spring.ldap.url");
        final var baseDn = environment.getRequiredProperty("spring.ldap.base");
        final var connectionString = url + "/" + baseDn;
        var contextSource = new DefaultSpringSecurityContextSource(connectionString);
        contextSource.afterPropertiesSet();
        contextSource.setUserDn(environment.getRequiredProperty("spring.ldap.userdn"));
        contextSource.setPassword(environment.getRequiredProperty("spring.ldap.password"));
        return contextSource;
    }

    @Bean
    BindAuthenticator bindAuthenticator(
        final BaseLdapPathContextSource contextSource) {
        var bindAuthenticator = new BindAuthenticator(contextSource);
        bindAuthenticator.setUserDnPatterns(new String[]{environment.getRequiredProperty("spring.ldap.userdnpattern")});
/*
        var userSearch =
            new FilterBasedLdapUserSearch(
                environment.getRequiredProperty("spring.ldap.base"),
                environment.getRequiredProperty("spring.ldap.searchfilter"),
                contextSource);
        userSearch.setSearchSubtree(true);
        bindAuthenticator.setUserSearch(userSearch);
*/
        bindAuthenticator.afterPropertiesSet();
        return bindAuthenticator;
    }

with application.properties :

spring.ldap.url=ldap://pre-adcorp.myorg.example
spring.ldap.base=OU=IVR,OU=apps,DC=pre,DC=myorg
spring.ldap.userdnpattern=cn={0}
spring.ldap.searchfilter=(&(cn={0})(objectclass=user))
spring.ldap.roleattributes=memberOf

Now, the issue is that I am not comfortable with connecting to ldap://pre-adcord.myorg.example/OU=IVR,OU=apps,DC=pre,DC=myorg because I think in the future I will need to authenticate other user that belong to to OU=apps but who are part of other OUs (for example, OU=ABC,OU=apps...). So I wanto to be able to search in a subtree.

I have tried with the commented source code (using FilterBasedLdapUserSearch) but then I always get a 401 Unauthorized failure, with both ldap dase "OU=IVR,OU=apps,DC=pre,DC=myorg" and "OU=apps,DC=pre,DC=myorg". What am I doing wrong?

UPDATE: I did create a wrapper for FilterBasedLdapUserSearch ; it turns out that when invoking searchForUser(String) it throws a binding error:

org.springframework.ldap.UncategorizedLdapException: Uncategorized exception occured during LDAP processing; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C09075A, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1]; remaining name 'ou=Aplicaciones,dc=pre,dc=aplssib'
at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:228) ~[spring-ldap-core-2.4.0.jar:2.4.0] at org.springframework.ldap.core.LdapTemplate.executeWithContext(LdapTemplate.java:824) ~[spring-ldap-core-2.4.0.jar:2.4.0]
[...]
Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C09075A, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1] at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3300) ~[na:na] at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3206) ~[na:na] at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2997) ~[na:na]

Yet it is the same contextsource that I am using if I just search by setUserDnPatterns .

Answer 1

Answering only to avoid people wasting their time; in the end it was an issue of the bind credentials.

I still do not know how the initial solution did work.