Spring Security：给定连接 URL 和凭据集的 LDAP 身份验证答案

【问题标题】：Spring Security: LDAP Authentication for given set of Connection URL & CredentialsSpring Security：给定连接 URL 和凭据集的 LDAP 身份验证
【发布时间】：2016-12-18 18:52:50
【问题描述】：

我获得了以下用于身份验证的 LDAP 配置。这如何转化为 Java 代码？

通过 SSL 扩展 ldap

ext.secure.adapter.ConnectionURL=ldap://ext_host:999 encrypted.ext.secure.adapter.UserName=CN=Administrator,CN=Users,DC=ext-pre,DC=corp-pre,DC=com encrypted.ext.secure.adapter.Password=HelloWorld1

corp ldap over SSL

corp.secure.adapter.ConnectionURL=ldap://corp_host:888 encrypted.corp.secure.adapter.UserName=CN=Administrator,CN=Users,DC=corp-pre,DC=com encrypted.corp.secure.adapter.Password=HelloWorld1

下面的代码看起来对吗？

package com.company.boot;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .anyRequest().fullyAuthenticated()
                .and()
                .formLogin();
    }

    @Configuration
    protected static class AuthenticationConfiguration extends
            GlobalAuthenticationConfigurerAdapter {

        @Override
        public void init(AuthenticationManagerBuilder auth) throws Exception {
            auth
                    .ldapAuthentication()
                    .userDnPatterns("uid={0},ou=people")
                    .groupSearchBase("ou=groups")
                    .contextSource()
                    .url("ldap://ext_host:999/CN=Administrator,CN=Users,DC=ext-pre,DC=corp-pre,DC=com");
        }
    }
}

上面的代码只包含一个 ConnectionURL。如何包含其他 ConnectionURL？

【问题讨论】：

标签： spring-security ldap

【解决方案1】：

只需使用不同的网址添加两次。首先，它将针对ldap://ext_host:999进行身份验证，如果未找到将签入ldap://corp_host:888

        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth
            .ldapAuthentication()
            .userDnPatterns("uid={0},ou=people")
            .groupSearchBase("ou=groups")
            .contextSource()
            .url("ldap://ext_host:999/CN=Administrator,CN=Users,DC=ext-pre,DC=corp-pre,DC=com");

            auth
            .ldapAuthentication()
            .userDnPatterns("uid={0},ou=people")
            .groupSearchBase("ou=groups")
            .contextSource()
            .url("ldap://corp_host:888/CN=Administrator,CN=Users,DC=corp-pre,DC=com");
}

【讨论】：