spring-projects / spring-projects/spring-security

DefaultLdapAuthoritiesPopulator does not provide all authorities if pagination is enforced on LDAP Server

Open
#14,741 1 comment 0 reactions 1 assignee View on GitHub

@jzheaux is already working on this.

Since Jul 8, 2024.

in: ldap type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
DefaultLdapAuthoritiesPopulator does not provide a way to fetch all authorities belonging to the user if pagination is enforced on the LDAP Server.

We have a use-case where, on the LDAP server, users are mapped to 1000+ groups. Size limit is enforced, which can fetch 500 records at a time. Refer to OpenLDAP limits.

DefaultLdapAuthoritiesPopulator uses SpringSecurityLdapTemplate, and a search with the default NullDirContextProcessor is triggered. See the code sample below from DefaultLdapAuthoritiesPopulator.

https://github.com/spring-projects/spring-security/blob/f57a0931377975779fb318e818ab318ec659110f/ldap/src/main/java/org/springframework/security/ldap/userdetails/DefaultLdapAuthoritiesPopulator.java#L231

The search call on LdapTemplate should be made with DirContextProcessor.

https://github.com/spring-projects/spring-security/blob/f57a0931377975779fb318e818ab318ec659110f/ldap/src/main/java/org/springframework/security/ldap/SpringSecurityLdapTemplate.java#L197

The default value could be NullDirContextProcessor for DirContextProcessor, but whoever wants to use a paginated one can customize it and use PagedResultsDirContextProcessor.

To Reproduce
Add 1000+ groups in LDAP and assign any user to all these groups. Make sure to set the limit as 500 on the LDAP. Now, when DefaultLdapAuthoritiesPopulator is used along with LdapAuthenticationProvider, only the first 500 groups are fetched.

Expected behavior
DefaultLdapAuthoritiesPopulator should provide a way to customize DirContextProcessor, and that should be used with SpringSecurityLdapTemplate.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.