Spring Security LDAP身份验证不适用于Java 8

Question

Caused by: java.lang.RuntimeException: Could not postProcess org.springframework.security.ldap.server.ApacheDSContainer@54a76efa of type class org.springframework.security.ldap.server.ApacheDSContainer
    at org.springframework.security.config.annotation.configuration.AutowireBeanFactoryObjectPostProcessor.postProcess(AutowireBeanFactoryObjectPostProcessor.java:70)
    at org.springframework.security.config.annotation.SecurityConfigurerAdapter$CompositeObjectPostProcessor.postProcess(SecurityConfigurerAdapter.java:123)
    at org.springframework.security.config.annotation.SecurityConfigurerAdapter.postProcess(SecurityConfigurerAdapter.java:82)
    at org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer.access$400(LdapAuthenticationProviderConfigurer.java:58)
    at org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer$ContextSourceBuilder.build(LdapAuthenticationProviderConfigurer.java:555)
    at org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer$ContextSourceBuilder.access$500(LdapAuthenticationProviderConfigurer.java:446)
    at org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer.getContextSource(LdapAuthenticationProviderConfigurer.java:606)
    at org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer.build(LdapAuthenticationProviderConfigurer.java:76)

我在谷歌的研究中列出了一篇2013年的帖子，其中说这个问题是因为Spring Security LDAP和Java8之间的不兼容。同一篇文章说，它已经在一些Spring引导版本中得到修复。它没有谈到任何非Spring Boot库的修复。

有人尝试过使用Java8进行Spring Security LDAP身份验证吗？请帮忙。

Answer 1

下面是我使用Java8和Spring Security LDAP的工作配置。我们将Spring Web应用程序连接到Active Directory实例，以确保通过URL进行访问。

如果我没记错的话，这比我预期的要长。

您需要更改LDAP上下文路径的“base”，并注意LDAP.user是完整的LDAP CN，而不仅仅是用户名。您可以使用诸如JXplorer（http://JXplorer.org/）之类的LDAP浏览器来正确地设置LDAP。

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.ldap.core.support.BaseLdapPathContextSource;
import org.springframework.ldap.core.support.LdapContextSource;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private static final Logger LOGGER = LoggerFactory.getLogger(SecurityConfig.class);

    @Value("ldap://${ldap.host}:${ldap.port:389}")
    private String url;

    @Value("${ldap.user}")
    private String user;

    @Value("${ldap.password}")
    private String password;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        LOGGER.info("Configuring security...");
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/index.html").permitAll()
                .anyRequest().fullyAuthenticated()
                .and()
                .httpBasic();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.ldapAuthentication()
            .userSearchFilter("(&(objectClass=user)(sAMAccountName={0}))")
            .contextSource(ldapContextSource());
    }

    @Bean
    public BaseLdapPathContextSource ldapContextSource() {
        LOGGER.info("LDAP: {}", url);
        LdapContextSource bean = new LdapContextSource();
        bean.setUrl(url);
        bean.setBase("DC=CORP,DC=MyCompany,DC=com");
        bean.setUserDn(user);
        bean.setPassword(password);
        bean.setPooled(true);
        bean.setReferral("follow");
        return bean;
    }
}

ldap.host=ldap.mycompany.com
ldap.user=CN=MyUser,OU=Service Accounts,OU=New-York,DC=CORP,DC=MyCompany,DC=com
# Encrypt using Jasypt or something
ldap.password=B1gS3cr3t