PasswordEncoderFactories.createDelegatingPasswordEncoder() is not compatible with LdapShaPasswordEncoder

Summary

PasswordEncoderFactories.createDelegatingPasswordEncoder() is creating wrong key for LdapShaPasswordEncoder(). Additionally, DelegatingPasswordEncoder removes the {SHA} prefix before call LdapShaPasswordEncoder.matches() that is expecting for it.

Actual Behavior

1. PasswordEncoderFactories.createDelegatingPasswordEncoder() creates LdapShaPasswordEncoder() with key ldap but LdapShaPasswordEncoder() expects internally that encoded password starts with SHA or SSHA.
2. LdapShaPasswordEncoder.matches() expectes that the encoded key is started by prefix {SHA} however DelegatingPasswordEncoder.matches() remove prefix before call LdapShaPasswordEncoder.

Expected Behavior

1. LdapShaPasswordEncoder() must accept ldap as prefix or PasswordEncoderFactories.createDelegatingPasswordEncoder() instantiate LdapShaPasswordEncoder() with key SHA.
2. DelegatingPasswordEncoder.matches() doesn't remove prefix or LdapShaPasswordEncoder() doesn't expect for it internally

Configuration

build.gradle
compile('org.springframework.boot:spring-boot-starter-data-ldap')
compile('org.springframework.boot:spring-boot-starter-security')
compile('org.springframework:spring-jdbc')
compile('org.springframework.session:spring-session-core')

compile("org.springframework.ldap:spring-ldap-core")
compile("org.springframework.security:spring-security-ldap")
compile("org.springframework:spring-tx")
compile("com.unboundid:unboundid-ldapsdk")

code
DelegatingPasswordEncoder delegatingPasswordEncoder =
(DelegatingPasswordEncoder) PasswordEncoderFactories.createDelegatingPasswordEncoder();
delegatingPasswordEncoder.setDefaultPasswordEncoderForMatches(NoOpPasswordEncoder.getInstance());

Version

springBootVersion = '2.0.1.RELEASE'

Start by tracing PasswordEncoderFactories.createDelegatingPasswordEncoder(), DelegatingPasswordEncoder.matches(), and LdapShaPasswordEncoder.matches() in the Spring Security source. Use the configuration in build.gradle to reproduce the LDAP encoder setup, then verify that the delegated prefix handling and LDAP SHA matching agree with the expected behavior.