spring-projects / spring-projects/spring-security
SEC-2494: DefaultLdapAuthoritiesPopulator should allow to use the DN as value for groupRoleAttribute
Open
Nobody has claimed this yet.
in: ldap
type: bug
type: jira
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Bernhard Thalmayr (Migrated from SEC-2494) said:
Attributes of LDAP entries need not be unique within the Directory Information Tree, only the DN is unique so it would be quite nice to use the whole DN as 'role' name.
following configuration leads to no role mapping ..
<beans:bean id="ldapAuthoritiesPopulator" class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
<beans:constructor-arg ref="ldapContextSource"/>
<beans:constructor-arg value=""/>
<beans:property name="groupRoleAttribute" value="dn"/>
<beans:property name="rolePrefix" value=""/>
<beans:property name="searchSubtree" value="true"/>
</beans:bean>
Feb 19 17:30:05 DEBUG [SpringSecurityLdapTemplate] No attribute value found for 'dn'
Feb 19 17:30:05 DEBUG [SpringSecurityLdapTemplate] No attribute value found for 'dn'
Feb 19 17:30:05 DEBUG [DefaultLdapAuthoritiesPopulator] Roles from search: []
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading DefaultLdapAuthoritiesPopulator and the LDAP authority lookup it uses, focusing on how groupRoleAttribute values are retrieved. Reproduce the shown configuration with groupRoleAttribute set to "dn", then verify that roles are populated from complete group DNs rather than reporting missing attribute values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100