Configuring Spring Security Ldap 3.0 to work with Active Directory LDS

Question

I am hoping that someone will help me out with a really frustrating problem I have.

Currently I am trying to get Spring Security 3.0 Web App to authenticate with an AD LDS instance but I keep getting this error 'Bad Credentials'. Unfortunately I dont have anything more to go on at the moment.

Below is a copy of the Security configuration being used:

<authentication-manager alias="ldapAuthenicationManager"> 
    <ldap-authentication-provider user-dn-pattern="CN={0},OU=Users,O=JLP,C=UK" >
</ldap-authentication-provider> </authentication-manager>

<ldap-server url="ldap://servner ip/o=JLP,c=UK" manager-dn="CN=Manager,O=JLP,C=UK" manager-password="manager" />

I suspect the problem is caused by the <Ldap server> tag and that the manager-dn is not configured correctly. The DN of the Manager is copied directly from AD LDS - have I not provided enough information? Or does the password need to encrypted\\hashed?

Has anyone done anything like this with LDS - how did you work around this problem?

Applogies that this is so vague, but this is as much information as I have to go on. Does any one have any suggestions of things to look at or for solutions?

All help is gratefully recieved!

Cheers

Mo

Answer 1

I am not sure if things would be significantly different for LDS but can you try upgrading to spring security 3.1 as it has a specialized Authenticator for AD.

It does not need manager account as it tries to bind using the username/password being authenticated. Also the configuration is minimal (No DN, search pattern, etc to be provided)

<security:authentication-manager>
    <security:authentication-provider ref="activeDirectoryAuthenticationProvider"/>
</security:authentication-manager>

<bean id="activeDirectoryAuthenticationProvider"
        class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">
    <constructor-arg value="${activedirectory.domain}" />
    <constructor-arg value="${activedirectory.server}" />
    <property name="convertSubErrorCodesToExceptions" value="true"/>
</bean>

where domain = example.com (from your example, jlp.uk) and server = ldap://ip

Answer 2

I remember that I came across with the same issue and the solution was to set the value of manager-dn to manageruser@yourdomain

eg

<ldap-server url="ldap://servner ip/o=JLP,c=UK" manager-dn="morrislgn@example.com" manager-password="manager" />

Answer 3

Slight necromancy here, but for those who stumble across this via Google, the most helpful tool I found regarding configuring my LDAP connection was to install Apache Directory Studio LDAP browser . It was via this tool that I was able to get verbose enough error messages to discover what was wrong with my LDAP configuration, and how to correct it.

Answer 4

Thanks for your answers they were very helpful.

Also found that the user account you are using for the manager-dn needs to be added to the reader role within LDS to allow it to search.

If you add the user role to the Administrators group you can connect but not search.

Cheers for your help