Connecting to existing AD via Spring LDAP and Spring security

Question

I am trying to login myself into an existing AD via Spring LDAP (2.3.1.RELEASE) using Spring Security. So far I have got following code which is responsible for the configuration (almostly taken from Spring getting started guide ):

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/", "/home").permitAll()
        .anyRequest().fullyAuthenticated()
        .and()
        .formLogin()
        .loginPage("/login")
        .permitAll()
        .and()
        .logout()
        .permitAll();
}

@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
    authauth
        .ldapAuthentication()
        .userDnPatterns("uid={0}")
        .contextSource(contextSource())
        .passwordCompare()
        .passwordEncoder(new LdapShaPasswordEncoder())
        .passwordAttribute("userPassword");
}


@Bean
public BaseLdapPathContextSource contextSource() {
    LdapContextSource contextSource = new LdapContextSource();
    contextSource.setAnonymousReadOnly(false);
    contextSource.setBase("dc=foo,dc=bar");
    contextSource.setUserDn("j.doe@company.com");
    contextSource.setPassword("plainTextPassword");
    contextSource.setUrl("ldap://active.directory.address");
    return ldapContextSource;
 }
}

Here is my pom snippet:

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>1.5.2.RELEASE</version>
</parent>

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.ldap</groupId>
        <artifactId>spring-ldap-core</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-ldap</artifactId>
    </dependency>
    <dependency>
        <groupId>com.unboundid</groupId>
        <artifactId>unboundid-ldapsdk</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.apache.directory.server</groupId>
        <artifactId>apacheds-all</artifactId>
        <version>1.5.5</version>
    </dependency>
</dependencies>

<properties>
    <java.version>1.8</java.version>
</properties>

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

I omit the .html files purposely as I think they do not play any role in this question. Atm I get

javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error, data 52e, v2580 ]

as a result. After googling the exception I found that data 52e means AD_INVALID CREDENTIALS . I checked my credentials many times and they are really really right. I even downloaded Microsofts AD explorer and used these credentials to successfully connect to the AD. Why isn't it working via code and does work via AD explorer?

Answer 1

When does this error occure? On Application start or when you try to log in? I get this error if i enter invalid credentials in the context source. If you are sure your password is correct, you should check your base and userDN.

Can you post your LDAP Tree or the part of the LDIF where the user is listed you are using in the context source?