Java Spring LDAP 身份验证：总是失败

Question

我对 Java/Spring 很陌生。如果需要更多信息，请随时指出。

首先，我在 Javascript(nodejs) 中测试了以下代码，这些代码工作正常。

var ldap = require('ldapjs');

var client = ldap.createClient({

  url: 'ldap://xx.xx.xx.xx:389'

});

client.bind('domain\\user1', 'user1_password', function (err) {

  if (err) {

    throw err;

    return

  }

  var opts = {

    filter: '(sAMAccountName=user2)',

    scope: 'sub',

    attributes: ['l', 'sn', 'cn', 'mail', 'displayName', 'postalCode', 'physicalDeliveryOfficeName', 'telephoneNumber' ]

  };

  client.search('dc=aaa,dc=bbb,dc=ccc', opts, function(err, res) {

    res.on('searchEntry', function(entry) {

      Object.entries(entry.object).forEach(([key, value]) => {

        console.log('Found Attribute: ', key, '; value:', value)

      })

    });

  });

然后按照本指南：

http://forum.spring.io/forum/spring-projects/security/110491-how-to-modify-authority-after-loading-it-from-ldap

但它失败了。

1. 如果提交（http-post）一个表单（用户名使用域\用户名）username=domain%5Cuser1&password=user1_password&submit=Login，它返回Reason: Bad credentials

2. 如果提交（http-post）一个表单（用户名不包含域）username=user1&password=user1_password&submit=Login，则返回500 错误：

   org.springframework.ldap.NameNotFoundException：[LDAP：错误代码 32 - 0000208D：NameErr：DSID-031001E5，问题 2001（NO_OBJECT），数据 0，最佳匹配：'']；嵌套异常是 javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031001E5, question 2001 (NO_OBJECT), data 0, best match of: '' ]; 剩下的名字''

对于第一种情况，条目似乎存在但未能验证密码。所以返回错误的凭据。

对于第二种情况，错误似乎表明搜索过滤器错误（正如CAS AD LDAP 32 错误指出的那样）

但我确定我输入了正确的用户名和密码，并且搜索过滤器与 nodejs 中已经测试过的相同。

已经被这个问题困扰了很长时间，但找不到一个解决方案。

感谢任何建议和解决方案。

注意：我在 class= 的入口处设置了断点com.my.own.util.CustomUserDetailsMapper，但是一直没有触发，所以没有附上它的代码。

Answer 1

最后，我发现以下配置运行良好。下面<bean id="ldapAuthProvider"> 构造两个参数，第一个参数：它将验证最终用户在前端填写的用户名和密码。第二个参数：一旦成功通过验证器，它将调用我们自己的填充器 ( <bean class="com.my.own.util.MyCustomLdapAuthPopulator">) 来分配适当的角色或做其他你想做的事情。<sec:authentication-manager>&nbsp;&nbsp;&nbsp; &nbsp; <sec:authentication-provider&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ref="ldapAuthProvider"&nbsp; &nbsp; &nbsp; &nbsp; >&nbsp;&nbsp;&nbsp; &nbsp; </sec:authentication-provider>&nbsp;&nbsp;</sec:authentication-manager>&nbsp;<bean id="ldapAuthProvider"&nbsp;&nbsp;&nbsp; &nbsp; class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider" >&nbsp;&nbsp;&nbsp; &nbsp; <constructor-arg>&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; <bean id="authenticator"&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; class="org.springframework.security.ldap.authentication.BindAuthenticator">&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <constructor-arg ref="contextSource" />&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <property name="userSearch">&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <bean&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <constructor-arg value="dc=aaa,dc=bbb,dc=ccc" />&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <constructor-arg value="(sAMAccountName={0})" />&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <constructor-arg ref="contextSource" />&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </bean>&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </property>&nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; </bean>&nbsp;&nbsp;&nbsp; &nbsp; </constructor-arg>&nbsp; &nbsp; &nbsp; &nbsp; <constructor-arg>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <bean class="com.my.own.util.MyCustomLdapAuthPopulator">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <constructor-arg ref="contextSource" />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <constructor-arg value="dc=aaa,dc=bbb,dc=ccc" />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <property name="searchSubtree" value="true" />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <property name="ignorePartialResultException" value="true" />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <property name="groupSearchFilter" value="(member={0})" />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </bean>&nbsp; &nbsp; &nbsp; &nbsp; </constructor-arg></bean>&nbsp;<bean id="contextSource"&nbsp;&nbsp;&nbsp; &nbsp; class="org.springframework.security.ldap.DefaultSpringSecurityContextSource" >&nbsp;&nbsp;&nbsp; &nbsp; <constructor-arg value="ldap://xx.xx.xx.xx:389/" />&nbsp; &nbsp; <property name="userDn" value="domain\user1" />&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; <property name="password" value="user1_password" /></bean>&nbsp;下面是我们自己的填充器的一个简单实现。import org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator;public class MyCustomLdapAuthPopulator extends DefaultLdapAuthoritiesPopulator {&nbsp; &nbsp; @Autowired&nbsp; &nbsp; public MyCustomLdapAuthPopulator(ContextSource contextSource, String groupSearchBase) {&nbsp; &nbsp; &nbsp; &nbsp; super(contextSource, groupSearchBase);&nbsp; &nbsp; &nbsp; &nbsp; // TODO Auto-generated constructor stub&nbsp; &nbsp; }&nbsp; &nbsp; @Override&nbsp; &nbsp; protected Set<GrantedAuthority> getAdditionalRoles(DirContextOperations user, String username) {&nbsp; &nbsp; &nbsp; &nbsp; Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>();&nbsp; &nbsp; &nbsp; &nbsp; authorities.add((new SimpleGrantedAuthority("ROLE_XXX")));&nbsp; &nbsp; &nbsp; &nbsp; return authorities;&nbsp; &nbsp; }}