SEC-12: Add LDAP Capabilities about spring-security

[spring-projects-issues]

Jeoff Wilks said:

I noticed that #SEC-107 listed SecurityLDAP as a component. Perhaps someone can explain to me how the AuthenticationDao/UserDetailsService interface is supposed to be used for LDAP authentication. The LDAP code in the sandbox implements an alternative PasswordAuthenticationDao (which loads by username and password), but as of 0.9.0 that interface appears to be gone from the main codebase. How can you authenticate to LDAP as the user without knowing their password? If you’re talking to LDAP via a manager account that may work, but that approach doesn’t allow you to authenticate as the actual user.

I ended up just rewriting the LDAP authentication as a provider that extends AbstractUserDetailsAuthenticationProvider directly. (The retrieveUser() method allows access to the password). That seems to make more sense to me than going through a constrained AuthenticationDao interface which only provides access to the username and not a password.

[spring-projects-issues]

Ben Alex said:

Jeoff, you are correct in having extended AbstractUserDetailsAuthenticationProvider. The PasswordAuthenticationDao approach is deprecated and has been replaced by AbstractUserDetailsAuthenticationProvider.

[spring-projects-issues]

Luke Taylor said:

I’m working on getting a version of the LdapProvider together for the 1.0 RC release and have implemented it this way. It’s not always possible to retrieve the password though. I’ve worked for a client before where it wasn’t possible to authenticate as the user, or to retrieve the password, but you could perform an LDAP “compare” operation to see if the password matched. I believe this kind of variation is quite common. So I’m hoping to include support for:
1. Binding as the user
2. Binding as a manager user and checking the password locally
3. Performing a compare of the password with the stored value, without actually retrieving it (either anonymously or as the manager user).

Any other suggestions or comments will be most welcome.

[spring-projects-issues]

Luke Taylor said:

LDAP provider is pretty much in place now, so we can probably use more specific issues now.

[spring-projects-issues]

Ben Alex said:

Will be in 1.0.0 RC2.