From 2162221589107eca2f0d7b520d1e26ddaa473a1e Mon Sep 17 00:00:00 2001 From: Trygve Aasjord Date: Tue, 18 Jul 2017 22:11:04 +0200 Subject: [PATCH] Pass username as second parameter for search filter. Allows the username only (without domain) to be used in custom search filter like "sAMAccountName={1}", in eg. situations where the userPrincipalName has a different suffix than domain. Thanks to contributors in issue. fixes gh-2448 (cherry picked from commit 8d717c62afd5d98b0aba467035389d3011434b51) --- .../ad/ActiveDirectoryLdapAuthenticationProvider.java | 5 +++-- .../ad/ActiveDirectoryLdapAuthenticationProviderTests.java | 6 +++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java b/ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java index 69d826301a..5599260c71 100644 --- a/ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java +++ b/ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java @@ -312,7 +312,7 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends try { return SpringSecurityLdapTemplate.searchForSingleEntryInternal(context, searchControls, searchRoot, searchFilter, - new Object[] { bindPrincipal }); + new Object[] { bindPrincipal, username }); } catch (IncorrectResultSizeDataAccessException incorrectResults) { // Search should never return multiple results if properly configured - just @@ -383,7 +383,8 @@ public final class ActiveDirectoryLdapAuthenticationProvider extends /** * The LDAP filter string to search for the user being authenticated. Occurrences of - * {0} are replaced with the {@code username@domain}. + * {0} are replaced with the {@code username@domain}. Occurrences of {1} are replaced + * with the {@code username} only. *

* Defaults to: {@code (&(objectClass=user)(userPrincipalName= 0}))} *

diff --git a/ldap/src/test/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProviderTests.java b/ldap/src/test/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProviderTests.java index d6463ca99e..ffd92f711e 100644 --- a/ldap/src/test/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProviderTests.java +++ b/ldap/src/test/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProviderTests.java @@ -140,9 +140,9 @@ public class ActiveDirectoryLdapAuthenticationProviderTests { any(Object[].class), any(SearchControls.class)); } - // SEC-2897 + // SEC-2897,SEC-2224 @Test - public void bindPrincipalUsed() throws Exception { + public void bindPrincipalAndUsernameUsed() throws Exception { // given final String defaultSearchFilter = "(&(objectClass=user)(userPrincipalName={0}))"; ArgumentCaptor captor = ArgumentCaptor.forClass(Object[].class); @@ -166,7 +166,7 @@ public class ActiveDirectoryLdapAuthenticationProviderTests { Authentication result = customProvider.authenticate(joe); // then - assertThat(captor.getValue()).containsOnly("joe@mydomain.eu"); + assertThat(captor.getValue()).containsExactly("joe@mydomain.eu", "joe"); assertThat(result.isAuthenticated()).isTrue(); }