SEC-2754: ActiveDirectoryLdapAuthenticationProvider doesnt work on JBoss

Oscar Sjöholm (Migrated from SEC-2754) said:

Providing the ActiveDirectoryLdapAuthenticationProvider with incorrect credentials causes internal server error when running on JBoss.

This is because ActiveDirectoryLdapAuthenticationProvider only considers top-level LdapExceptions, whereas JBoss seems to wrap exceptions thrown by InitialLdapContext into a top-level NamingException.

I believe that the solution is to resolve the root exception that prevented the InitialLdapContext from being initialized. Something like the following should do the trick.

 try {
            return contextFactory.createContext(env);
        } catch (NamingException e) {
            NamingException rootException = e;
            while(rootException.getRootCause() != null && rootException.getRootCause() instanceof NamingException) {
                rootException = (NamingException)rootException.getRootCause();
            }
            if ((rootException instanceof AuthenticationException) || (rootException instanceof OperationNotSupportedException)) {
                handleBindException(bindPrincipal, rootException);
                throw badCredentials(rootException);
            } else {
                throw LdapUtils.convertLdapException(rootException);
            }
        }

Start by locating ActiveDirectoryLdapAuthenticationProvider and the InitialLdapContext creation path. Reproduce the incorrect-credentials case on JBoss, then verify that the wrapped exception is handled as a bad-credentials failure rather than an internal server error.