[#SEC-130] Support for Active Directory logins - Spring Projects Issue Tracker

Spring Security

Support for Active Directory logins

Created: 20/Dec/05 06:06 PM Updated: 07/Feb/06 11:27 PM

Component/s:

LDAP

Affects Version/s:

None

Fix Version/s:

1.0.0 RC2

Time Tracking:

Not Specified

Description

« Hide

This can probably be done using a specific authenticator implementation or by extending the existing BindAuthenticator.

All

Comments

Work Log

Change History

FishEye

Builds

Sort Order:

[ Permalink | « Hide ]

Luke Taylor added a comment - 03/Feb/06 09:07 AM

It seems that AD can be supported using the existing authentictor. From my post of the dev list:

[quote]
I've heard of two "alternative" pseudo-DN syntaxes supported by AD. One
is "username@domain" and the other is "domain\username".

I think you can try binding with either of these using the existing
BindAuthenticator. If the user types in the entire name, you could have:

   <property name="userDnPatterns">
    <list>
     <value>{0}</value>
    </list>
   </property>

or if they only type in the username part, you could use something like

   <property name="userDnPatterns">
    <list>
     <value>{0}@mycompany.com</value>

     <value>domain\{0}</value>
    </list>
   </property>

[/quote]

Anthony Geoghegan's response:

[quote]

I've tested both:
     <value>{0}@mycompany.com</value>

    <value>domain\{0}</value>

And they work with Active Directory 2003. The top one is of special
interest as this is the Kerberos service principal name.

[/quote]

User's can of course also bind with a full DN directly.