SEC-2994: ActiveDirectoryLdapAuthenticationProvider seems to be making assumption that UPN suffix is always same as Domain Name

Satyapal Reddy (Migrated from SEC-2994) said:

In our test AD with domain "my.company.com" we seemed to have two sets of users, one set with UPN in the format user1@my.company.com and other set in the form of user2@corp.com

And when I use ActiveDirectoryLdapAuthenticationProvider and try to authenticate users only one with UPN format user1@my.company.com works.

I tried passing third param in constructor ("corp.com", ldapurl1, "dc=my,dc=company,dc=com"), in which case user2@corp.com worked but not other one.

Looking at Microsoft tech net article: [https://technet.microsoft.com/en-us/library/cc739093(v=ws.10).aspx] it appears like while UPN suffix normally is same as domain name, it is not a must and could be suffixed with something else. Quoting that article

The second part of the UPN, the UPN suffix, identifies the domain in which the user account is located. This UPN suffix can be the DNS domain name, the DNS name of any domain in the forest, or it can be an alternative name created by an administrator and used just for log on purposes. This alternative UPN suffix does not need to be a valid DNS name.

In Active Directory, the default UPN suffix is the DNS name of the domain in which user account created. In most cases, this is the domain name registered as the enterprise domain on the Internet. Using alternative domain names as the UPN suffix can provide additional logon security and simplify the names used to log on to another domain in the forest.

For example, if your organization uses a deep domain tree, organized by department and region, domain names can get quite long. The default user UPN for a user in that domain might be sales.westcoast.microsoft.com. The logon name for a user in that domain would be user@sales.westcoast.microsoft.com. Creating a UPN suffix of "microsoft" would allow that same user to log on using the much simpler logon name of user@microsoft. For more information about user accounts, see User and computer accounts and Object names.

However it appears ActiveDirectoryLdapAuthenticationProvider.java seems to be making an assumption that domain name is same as UPN suffix. I made a local fix to ActiveDirectoryLdapAuthenticationProvider.java to ignore appending the domain name when the username passed already contains a UPN Suffix (which may be different than domain name)

String createBindPrincipal(String username) {
    if (domain == null || username.contains("@")) {
            return username;
    }
    return username + "@" + domain;
}

And with this it works for both types of UPNs.

Read ActiveDirectoryLdapAuthenticationProvider.java, focusing on createBindPrincipal and the reported behavior for usernames with and without a UPN suffix. Verify both UPN forms against the configured domain; done means a username with an existing suffix is accepted without incorrectly appending the domain, while usernames without one still use the configured domain.