spring-projects / spring-projects/spring-security
Problem with Active Directory 2016
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Summary
First of all sorry for my English abilities. I'm a freshman yet.
AD 2016 doesn't implements RFC 822 for field userPrincipalName (username@domain)
Actual Behavior
The default searchFilter is:
(&(objectClass=user)(userPrincipalName={0}))
but AD 2016 has no data in userPrincipalName... then I send my "own" search filter instead of default with:
(sAMAccountName={0})
When you defines the AuthenticationProvider with a domain and an URL, It always use the method "createBindPrincipal" for the username and "{0}" will be (username@domain) and It is different to the "sAMAccountName".
If you send a "null" domain "createBindPrincipal" will return (username) as expected, although the "contextFactory" will throws an exception in "createContext" method.
Expected Behavior
Actually I don't know the best solution for this, but I expected configuring my domain, my URL and an account wich those executes "doAuthentication" succesfully.
Configuration
I have a Java config. I don't know if I might put my code here. But my code words under previous versions of active directory like this link:
https://msdn.microsoft.com/en-us/library/ms680857(v=vs.85).aspx
Version
Gradle Var:
springSecurityLdapVersion = "4.2.3.RELEASE"
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing AuthenticationProvider through createBindPrincipal and the contextFactory/createContext path, comparing the configured domain and URL with the custom searchFilter. Check how doAuthentication receives the username and whether the sAMAccountName filter is usable with the generated principal. Done means a Java-configured AD 2016 provider authenticates successfully with the documented account settings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100