Spring security 2.0.5 LDAP authentication setup w/Active Directory

Question

I've been having a hell of a time trying to get LDAP authentication working with this application (apache Roller). It seems like it would just be "populate the right fields and go", but I'm still attempting to authenticate against the database (the default authentication method).

I don't understand what's telling spring-security to use one authentication manager over another, so that's probably the first thing to change. After spending two days reading documentation, no closer to figuring it out.

<beans:bean id="ldapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
    <beans:constructor-arg index="0" value="CN=stuff,DC=domain"/>
    <beans:constructor-arg index="1" value="uid={0}"/>
    <beans:constructor-arg index="2" ref="initialDirContextFactory"/>         
    <beans:property name="searchSubtree" value="true"/>           
</beans:bean>     

<beans:bean id="ldapAuthProvider" class="org.springframework.security.providers.ldap.LdapAuthenticationProvider">
    <beans:constructor-arg>
        <beans:bean class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">
            <beans:constructor-arg ref="initialDirContextFactory"/>
            <beans:property name="userSearch" ref="ldapUserSearch"/>
        </beans:bean>
    </beans:constructor-arg>
    <beans:constructor-arg ref="jdbcAuthoritiesPopulator"/>
</beans:bean>    

<beans:bean id="jdbcAuthoritiesPopulator" class="org.apache.roller.weblogger.ui.core.security.AuthoritiesPopulator">
    <beans:property name="defaultRole" value="groupNameUserHasToBelongTo"/>
</beans:bean>

Answer 1

We need more details to help you out. What error message are you seeing if there is any, copy the stack trace.

One thing I noticed is in the BindAuthenticator, you can specify the context source and userDnPatterns instead of creating the ldapUserSearch bean.

<bean id="ldapAuthProvider"
        class="org.springframework.security.providers.ldap.LdapAuthenticationProvider">
  <constructor-arg>
    <bean class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">
      <constructor-arg ref="contextSource">
      </constructor-arg>
        <property name="userDnPatterns">
          <list>
              <value>CN={0},OU=Users,OU=_Units,DC=corporate,DC=mycompany,DC=com</value>
          </list>
        </property>
        <property name="userAttributes">
            <list>
                <value>objectSID</value>
                <value>userPrincipalName</value>                    
            </list>
        </property>
    </bean>
  </constructor-arg>
    <constructor-arg>
      <bean class="com.security.AuthoritiesPopulator">
      </bean>
    </constructor-arg>
    <property name="userDetailsContextMapper">
        <bean class="com.corp.CustomLdapUserDetailsMapper"/>
    </property>
    <security:custom-authentication-provider/>
</bean>