or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

authentication.mdauthorities.mdcontext-management.mdembedded-server.mdindex.mdjson-serialization.mdpassword-policy.mduser-details.md
tile.json

tessl/maven-org-springframework-security--spring-security-ldap

Spring Security LDAP module providing comprehensive LDAP authentication and authorization capabilities for enterprise applications

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
mavenpkg:maven/org.springframework.security/spring-security-ldap@6.5.x

To install, run

npx @tessl/cli install tessl/maven-org-springframework-security--spring-security-ldap@6.5.0

index.mddocs/

Spring Security LDAP

Spring Security LDAP is a comprehensive Java library that provides LDAP (Lightweight Directory Access Protocol) authentication and authorization capabilities for Spring Security applications. It enables seamless integration with LDAP directory servers for user authentication, user details retrieval, and role-based access control, supporting both traditional and modern enterprise environments.

Package Information

  • Package Name: org.springframework.security:spring-security-ldap
  • Package Type: maven
  • Language: Java
  • Installation: Add to your Maven dependencies:
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-ldap</artifactId>
    <version>6.5.1</version>
</dependency>

For Gradle:

implementation 'org.springframework.security:spring-security-ldap:6.5.1'

Core Imports

import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
import org.springframework.security.ldap.userdetails.LdapUserDetailsService;
import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
import org.springframework.security.ldap.LdapUsernameToDnMapper;
import org.springframework.security.ldap.DefaultLdapUsernameToDnMapper;

Basic Usage

import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
import org.springframework.security.ldap.authentication.BindAuthenticator;
import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;

// Configure LDAP context source
DefaultSpringSecurityContextSource contextSource = 
    new DefaultSpringSecurityContextSource("ldap://localhost:389/dc=springframework,dc=org");
contextSource.setUserDn("cn=manager,dc=springframework,dc=org");
contextSource.setPassword("password");

// Configure user search
FilterBasedLdapUserSearch userSearch = 
    new FilterBasedLdapUserSearch("ou=people", "uid={0}", contextSource);

// Configure authenticator
BindAuthenticator authenticator = new BindAuthenticator(contextSource);
authenticator.setUserSearch(userSearch);

// Create authentication provider
LdapAuthenticationProvider authProvider = new LdapAuthenticationProvider(authenticator);

Architecture

Spring Security LDAP is organized around several key architectural components:

  • Context Management: DefaultSpringSecurityContextSource manages LDAP connections and context operations
  • Authentication Strategies: Multiple authentication approaches including bind authentication and password comparison
  • User Details Services: Integration with Spring Security's UserDetailsService for user information retrieval
  • Search Strategies: Flexible user search implementations for locating users in LDAP directories
  • Authorities Population: Automatic role and authority mapping from LDAP groups and attributes
  • Server Integration: Support for embedded LDAP servers for testing and development
  • Enterprise Features: Password policy support, Active Directory integration, and modern serialization

Capabilities

LDAP Authentication

Core authentication functionality supporting multiple authentication strategies including bind authentication and password comparison for flexible integration with different LDAP server configurations.

public class LdapAuthenticationProvider implements AuthenticationProvider {
    public LdapAuthenticationProvider(LdapAuthenticator authenticator);
    public Authentication authenticate(Authentication authentication) throws AuthenticationException;
    public void setUserDetailsContextMapper(UserDetailsContextMapper mapper);
    public void setAuthoritiesPopulator(LdapAuthoritiesPopulator authoritiesPopulator);
}

LDAP Authentication

User Details and Search

User details services and search implementations for retrieving user information from LDAP directories with comprehensive mapping and customization options.

public class LdapUserDetailsService implements UserDetailsService {
    public LdapUserDetailsService(LdapUserSearch userSearch);
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException;
    public void setUserDetailsMapper(UserDetailsContextMapper mapper);
}

public interface LdapUserSearch {
    DirContextOperations searchForUser(String username);
}

User Details and Search

Context Management

LDAP context source and template classes for managing connections to LDAP servers with support for authentication, connection pooling, and operation execution.

public class DefaultSpringSecurityContextSource implements InitializingBean, DisposableBean {
    public DefaultSpringSecurityContextSource(String providerUrl);
    public void setUserDn(String userDn);
    public void setPassword(String password);
    public DirContext getReadOnlyContext() throws NamingException;
    public DirContext getReadWriteContext() throws NamingException;
}

public class SpringSecurityLdapTemplate {
    public SpringSecurityLdapTemplate(ContextSource contextSource);
    public DirContextOperations searchForSingleEntry(String base, String filter, Object[] params);
    public boolean authenticate(String base, String filter, Object[] params, String password);
}

Context Management

Authorities Population

Authority and role mapping from LDAP groups and attributes with customizable population strategies for complex authorization scenarios.

public interface LdapAuthoritiesPopulator {
    Collection<? extends GrantedAuthority> getGrantedAuthorities(
        DirContextOperations userData, String username);
}

public class DefaultLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator {
    public DefaultLdapAuthoritiesPopulator(ContextSource contextSource, String groupSearchBase);
    public void setGroupSearchFilter(String groupSearchFilter);
    public void setGroupRoleAttribute(String groupRoleAttribute);
}

Authorities Population

Embedded Server Support

Embedded LDAP server containers for testing and development environments with support for Apache Directory Server and UnboundID implementations.

public class ApacheDSContainer implements InitializingBean, DisposableBean, Lifecycle {
    public ApacheDSContainer(String root, String ldifs);
    public void start();
    public void stop();
    public int getPort();
    public void setPort(int port);
}

Embedded Server Support

Password Policy Support

LDAP password policy controls and exception handling for enterprise environments requiring advanced password management features.

public class PasswordPolicyControl extends BasicControl {
    public static final String OID = "1.3.6.1.4.1.42.2.27.8.5.1";
    public PasswordPolicyControl();
    public PasswordPolicyControl(boolean criticality);
}

public enum PasswordPolicyErrorStatus {
    PASSWORD_EXPIRED, ACCOUNT_LOCKED, CHANGE_AFTER_RESET,
    PASSWORD_MOD_NOT_ALLOWED, MUST_SUPPLY_OLD_PASSWORD,
    INSUFFICIENT_PASSWORD_QUALITY, PASSWORD_TOO_SHORT,
    PASSWORD_TOO_YOUNG, PASSWORD_IN_HISTORY;
}

Password Policy Support

JSON Serialization Support

Jackson JSON serialization support for Spring Security LDAP classes enabling serialization and deserialization of LDAP user details and authorities.

public class LdapJackson2Module extends SimpleModule {
    public LdapJackson2Module();
    public void setupModule(SetupContext context);
}

JSON Serialization Support

Types

public interface LdapUserDetails extends UserDetails {
    String getDn();
    Attributes getAttributes();
}

public class LdapUserDetailsImpl implements LdapUserDetails, CredentialsContainer {
    public String getDn();
    public Attributes getAttributes();
    // UserDetails implementation methods
    public String getUsername();
    public String getPassword();
    public Collection<? extends GrantedAuthority> getAuthorities();
    public boolean isAccountNonExpired();
    public boolean isAccountNonLocked();
    public boolean isCredentialsNonExpired();
    public boolean isEnabled();
}

public interface UserDetailsContextMapper {
    UserDetails mapUserFromContext(DirContextOperations ctx, String username, 
        Collection<? extends GrantedAuthority> authorities);
    void mapUserToContext(UserDetails user, DirContextAdapter ctx);
}

public interface LdapAuthenticator {
    DirContextOperations authenticate(Authentication authentication);
}

public interface LdapAuthoritiesPopulator {
    Collection<? extends GrantedAuthority> getGrantedAuthorities(
        DirContextOperations userData, String username);
}

public class LdapAuthority implements GrantedAuthority {
    private final String role;
    private final String dn;
    
    public LdapAuthority(String role, String dn);
    public String getAuthority();
    public String getDn();
}

public interface LdapUsernameToDnMapper {
    LdapName buildLdapName(String username);
    @Deprecated
    DistinguishedName buildDn(String username);
}

public class DefaultLdapUsernameToDnMapper implements LdapUsernameToDnMapper {
    public DefaultLdapUsernameToDnMapper(String userDnBase, String usernameAttribute);
    public LdapName buildLdapName(String username);
}