spring-projects / spring-projects/spring-security

Problem with Active Directory 2016

Open
#5,105 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Summary

First of all sorry for my English abilities. I'm a freshman yet.
AD 2016 doesn't implements RFC 822 for field userPrincipalName (username@domain)

Actual Behavior

The default searchFilter is:
(&(objectClass=user)(userPrincipalName={0}))
but AD 2016 has no data in userPrincipalName... then I send my "own" search filter instead of default with:
(sAMAccountName={0})

When you defines the AuthenticationProvider with a domain and an URL, It always use the method "createBindPrincipal" for the username and "{0}" will be (username@domain) and It is different to the "sAMAccountName".

If you send a "null" domain "createBindPrincipal" will return (username) as expected, although the "contextFactory" will throws an exception in "createContext" method.

Expected Behavior

Actually I don't know the best solution for this, but I expected configuring my domain, my URL and an account wich those executes "doAuthentication" succesfully.

Configuration

I have a Java config. I don't know if I might put my code here. But my code words under previous versions of active directory like this link:
https://msdn.microsoft.com/en-us/library/ms680857(v=vs.85).aspx

Version

Gradle Var:
springSecurityLdapVersion = "4.2.3.RELEASE"

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing AuthenticationProvider through createBindPrincipal and the contextFactory/createContext path, comparing the configured domain and URL with the custom searchFilter. Check how doAuthentication receives the username and whether the sAMAccountName filter is usable with the generated principal. Done means a Java-configured AD 2016 provider authenticates successfully with the documented account settings.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.