Java Doc for LdapAuthenticationProvider.java in  » Security » acegi-security » org » acegisecurity » providers » ldap » Java Source Code / Java DocumentationJava Source Code and Java Documentation

There are many ways in which an LDAP directory can be configured so this class delegates most of its responsibilites to two separate strategy interfaces, LdapAuthenticator and LdapAuthoritiesPopulator .

LdapAuthenticator

The task of retrieving the user attributes is delegated to the authenticator because the permissions on the attributes may depend on the type of authentication being used; for example, if binding as the user, it may be necessary to read them with the user's own permissions (using the same context used for the bind operation).

LdapAuthoritiesPopulator

A custom implementation could obtain the roles from a completely different source, for example from a database.

Configuration

 <bean id="initialDirContextFactory" class="org.acegisecurity.providers.ldap.DefaultInitialDirContextFactory">
 <constructor-arg value="ldap://monkeymachine:389/dc=acegisecurity,dc=org"/>
 <property name="managerDn"><value>cn=manager,dc=acegisecurity,dc=org</value></property>
 <property name="managerPassword"><value>password</value></property>
 </bean>
 <bean id="ldapAuthProvider" class="org.acegisecurity.providers.ldap.LdapAuthenticationProvider">
 <constructor-arg>
 <bean class="org.acegisecurity.providers.ldap.authenticator.BindAuthenticator">
 <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
 <property name="userDnPatterns"><list><value>uid={0},ou=people</value></list></property>
 </bean>
 </constructor-arg>
 <constructor-arg>
 <bean class="org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator">
 <constructor-arg><ref local="initialDirContextFactory"/></constructor-arg>
 <constructor-arg><value>ou=groups</value></constructor-arg>
 <property name="groupRoleAttribute"><value>ou</value></property>
 </bean>
 </constructor-arg>
 </bean>

This would set up the provider to access an LDAP server with URL ldap://monkeymachine:389/dc=acegisecurity,dc=org. Authentication will be performed by attempting to bind with the DN uid=<user-login-name>,ou=people,dc=acegisecurity,dc=org. After successful authentication, roles will be assigned to the user by searching under the DN ou=groups,dc=acegisecurity,dc=org with the default filter (member=<user's-DN>). The role name will be taken from the "ou" attribute of each match.

The authenticate method will reject empty passwords outright. LDAP servers may allow an anonymous bind operation with an empty password, even if a DN is supplied. In practice this means that if the LDAP directory is configured to allow unauthenitcated access, it might be possible to authenticate as any user just by supplying an empty password. More information on the misuse of unauthenticated access can be found in draft-ietf-ldapbis-authmeth-19.txt.

The LdapAuthoritiesPopulator will be used to create the granted authorites for the user.

Can be overridden to customize the creation of the final UserDetails instance.

The LdapAuthoritiesPopulator will be used to create the granted authorites for the user.

Can be overridden to customize the creation of the final UserDetails instance. The default will merge any additional authorities retrieved from the populator with the propertis of original ldapUser object and set the values of the username and password.