SEC-2482: ldapAuthentication().withObjectPostProcessor(...) can't change order of post processors

Bruce Brouwer (Migrated from SEC-2482) said:

I am trying to use DefaultTlsDirContextAuthenticationStrategy() in an ObjectPostProcessor to make all my connections to LDAP secured. That part seems to work, however in my environment, that means I need to turn off pooling. I have tried in the ObjectPostProcessor to simply call contextSource.setPooled(false), but this ObjectPostProcessor is called too late because .afterPropertiesSet(), which configures the environment based on the pooled property is called by AutowireBeanFactoryObjectPostProcessor before my post processor ever gets a chance to call .setPooled(false).

Is there a way to make it so my post processors go before any of the default Spring post processors? Should mine always go before Spring's post processors? Or do we need something new, like a pre-processor?

public class SecureLdapContextSourcePostProcessor implements ObjectPostProcessor<LdapContextSource> {
    @Override
    public <O extends LdapContextSource> O postProcess(final O contextSource) {
        contextSource.setPooled(false);
        contextSource.setAuthenticationStrategy(new DefaultTlsDirContextAuthenticationStrategy());
        return contextSource;
    }
}

Start with ldapAuthentication().withObjectPostProcessor(...) and the AutowireBeanFactoryObjectPostProcessor mentioned in the report. Trace the post-processor ordering and determine how a custom processor could run before the default processing; done means setPooled(false) and the TLS authentication strategy take effect in the requested order.