Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-09-08 20:51:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expand LDAP authentication FAQ with information about bind authentication and unreadable password attributes.

Browse Source
This commit is contained in:
Luke Taylor 2011-07-14 13:13:39 +01:00
parent 8440743108
commit ac3d8b25f2
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
docs/faq/src/docbook/faq.xml
View File

@ -284,6 +284,15 @@
<qandaentry xml:id="faq-ldap-authentication"> <qandaentry xml:id="faq-ldap-authentication">
<question><para>I can't get LDAP authentication to work. What's wrong with my configuration?</para></question> <question><para>I can't get LDAP authentication to work. What's wrong with my configuration?</para></question>
<answer> <answer>
<para>
Note that the permissions for an LDAP directory often do not allow you to read the password
for a user. Hence it is often not possible to use the <link xlink:href="#faq-what-is-userdetailservice"><interfacename>UserDetailsService</interfacename>
approach</link> where Spring Security compares the stored password with the one submitted by the user.
The most common approach is to use LDAP <quote>bind</quote>, which is one of the operations
supported by <link xlink:href="http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol">the LDAP protocol</link>.
With this approach, Spring Security validates the password by attempting to authenticate to the directory
as the user.
</para>
<para>The most common problem with LDAP authentication is a lack of knowledge of the <para>The most common problem with LDAP authentication is a lack of knowledge of the
directory server tree structure and configuration. This will be different in different directory server tree structure and configuration. This will be different in different
companies, so you have to find it out yourself. Before adding a Spring Security LDAP companies, so you have to find it out yourself. Before adding a Spring Security LDAP
@ -305,7 +314,8 @@
} }
]]></programlisting> ]]></programlisting>
</para></answer> </para>
</answer>
</qandaentry> </qandaentry>
</qandadiv> </qandadiv>
@ -626,7 +636,7 @@
</qandaentry> </qandaentry>
<qandaentry xml:id="faq-what-is-userdetailservice"> <qandaentry xml:id="faq-what-is-userdetailservice">
<question> <question>
<para>What is a <literal>UserDetailsService</literal> and do I need <para>What is a <interfacename>UserDetailsService</interfacename> and do I need
one?</para> one?</para>
</question> </question>
<answer> <answer>
@ -639,7 +649,8 @@
<classname>DaoAuthenticationProvider</classname>, which is injected with <classname>DaoAuthenticationProvider</classname>, which is injected with
a <interfacename>UserDetailsService</interfacename> to allow it to load a <interfacename>UserDetailsService</interfacename> to allow it to load
the password (and other data) for a user in order to compare it with the the password (and other data) for a user in order to compare it with the
submitted value.</para> submitted value. Note that if you are using LDAP,
<link xlink:href="#faq-ldap-authentication">this approach may not work</link>.</para>
<para> If you want to customize the authentication process then you should <para> If you want to customize the authentication process then you should
implement <interfacename>AuthenticationProvider</interfacename> implement <interfacename>AuthenticationProvider</interfacename>
yourself. See this <link yourself. See this <link
@ -838,7 +849,7 @@
database?</para> database?</para>
</question> </question>
<answer> <answer>
<para> The <code>LdapAuthenticationProvider</code> bean (which handles <para> The <classname>LdapAuthenticationProvider</classname> bean (which handles
normal LDAP authentication in Spring Security) is configured with two normal LDAP authentication in Spring Security) is configured with two
separate strategy interfaces, one which performs the authenticatation separate strategy interfaces, one which performs the authenticatation
and one which loads the user authorities, called and one which loads the user authorities, called