无法获得spring security with ldap的权限

Question

我正在尝试用spring Security授权用户。到目前为止，我能够通过ldap对它们进行身份验证，但还无法获得授权。

我还将ldap与Apache Directory Studio连接起来，查询用户信息，可以在用户中找到权限。但spring security ldap配置无法收集它们。

下面是application-config.xml的ldap部分：

<sec:authentication-manager>
  <sec:ldap-authentication-provider 
    user-dn-pattern="uid={0},ou=myComp,o=myComp,dc=myComp,dc=ldap"
    group-search-base="dc=myComp,dc=ldap"
    group-search-filter="uniqueMember={0}"
    role-prefix="none" />

import java.util.Hashtable;

import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;

public class LdapTest2 {

    public static void main(String[] args) {
        Hashtable env = new Hashtable(11);
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://myCompldap.mycomp.local:389/");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, "uid=myUser,ou=myComp,o=myComp,dc=myComp,dc=ldap");
        env.put(Context.SECURITY_CREDENTIALS, "myPass");

        try {
            LdapContext ctx = new InitialLdapContext(env, null);
            ctx.setRequestControls(null);
            NamingEnumeration<?> namingEnum = ctx.search("uid=myUser,ou=myComp,o=myComp,dc=myComp,dc=ldap", "(objectClass=*)", getSimpleSearchControls());
            while (namingEnum.hasMore ()) {
                SearchResult result = (SearchResult) namingEnum.next ();
                Attributes attrs = result.getAttributes ();
                Attribute lattr = attrs.get("nsrole");

                NamingEnumeration allRoles = lattr.getAll();
                while(allRoles.hasMore()) {
                    Object role = allRoles.next();
                    System.out.println(role);
                }

            } 
            namingEnum.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private static SearchControls getSimpleSearchControls() {
        SearchControls searchControls = new SearchControls();
        searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
        searchControls.setTimeLimit(30000);
        String[] attrIDs = {"nsRole"};
        searchControls.setReturningAttributes(attrIDs);
        return searchControls;
    }

}

Answer 1

由于用户角色是用户目录条目的一部分，您应该能够使用自定义的UserDetailsContextMapper加载它们。将自定义角色加载代码移动到MapUserFromContext方法。您可以使用nullldapauthoritiespopulator跳过对角色的正常搜索。

您需要显式配置身份验证提供程序：

<bean id="ldapAuthProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
   <constructor-arg>
       <bean class="org.springframework.security.ldap.authentication.BindAuthenticator">
           <constructor-arg ref="contextSource"/>
           <property name="userDnPatterns">
             <list><value>uid={0},ou=myComp,o=myComp,dc=myComp,dc=ldap</value></list>
           </property>
       </bean>
   </constructor-arg>
   <constructor-arg>
       <bean class="org.springframework.security.ldap.authentication.NullLdapAuthoritiesPopulator" />
   </constructor-arg>
   <property name="userDetailsContextMapper" ref="yourContextMapperImplementation" />
</bean>