spring-projects / spring-projects/spring-security
DefaultLdapAuthoritiesPopulator does not provide all authorities if pagination is enforced on LDAP Server
@jzheaux is already working on this.
Since Jul 8, 2024.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
DefaultLdapAuthoritiesPopulator does not provide a way to fetch all authorities belonging to the user if pagination is enforced on the LDAP Server.
We have a use-case where, on the LDAP server, users are mapped to 1000+ groups. Size limit is enforced, which can fetch 500 records at a time. Refer to OpenLDAP limits.
DefaultLdapAuthoritiesPopulator uses SpringSecurityLdapTemplate, and a search with the default NullDirContextProcessor is triggered. See the code sample below from DefaultLdapAuthoritiesPopulator.
The search call on LdapTemplate should be made with DirContextProcessor.
The default value could be NullDirContextProcessor for DirContextProcessor, but whoever wants to use a paginated one can customize it and use PagedResultsDirContextProcessor.
To Reproduce
Add 1000+ groups in LDAP and assign any user to all these groups. Make sure to set the limit as 500 on the LDAP. Now, when DefaultLdapAuthoritiesPopulator is used along with LdapAuthenticationProvider, only the first 500 groups are fetched.
Expected behavior
DefaultLdapAuthoritiesPopulator should provide a way to customize DirContextProcessor, and that should be used with SpringSecurityLdapTemplate.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.