x509 authentication with Active directory using Spring security -


hi iam new spring security,
task authenticate user against active directory matching username retrieved x509 client certificate. far did enabled ssl mutual authentication

that above part working fine have security.xml file in have configured related x509 reference , active directory configuration 

      <global-method-security secured-annotations="enabled" />               <http >                <intercept-url pattern="/**" access="role_user,role_anonymous" requires-     channel="https"/>      <intercept-url pattern="/userlogin/*"  access="role_admin,role_user" requires-channel="https"/>          <x509 subject-principal-regex="cn=(.*?)," user-service-ref="ldapuserservice" />   </http>  <authentication-manager>          <authentication-provider user-service-ref="ldapuserservice" />  </authentication-manager>    <bean:bean id="contextsource" class="org.springframework.security.ldap.defaultspringsecuritycontextsource">   <bean:constructor-arg value="ldap://activedirectoryurl:389/cn=example,dc=net"/>   <bean:property name="userdn" value="mkanaka@example.local"/> <bean:property name="password" value="secuera1smk"/> </bean:bean>   <bean:bean name="ldapuserservice" class="org.springframework.security.ldap.userdetails.ldapuserdetailsservice">     <bean:constructor-arg ref="ldapusersearch"/>     <bean:constructor-arg ref="ldapauthoritiespopulator"/> </bean:bean> <bean:bean name="ldapusersearch" class="org.springframework.security.ldap.search.filterbasedldapusersearch">     <bean:constructor-arg value=""/>     <bean:constructor-arg value="(&amp;(samaccountname={0})(objectclass=users))"/>     <bean:constructor-arg ref="contextsource" /> </bean:bean> <bean:bean name="ldapauthoritiespopulator"   class="org.springframework.security.ldap.userdetails.defaultldapauthoritiespopulator">     <bean:constructor-arg ref="contextsource" />     <bean:constructor-arg value="" />     <bean:property name="groupsearchfilter" value="member={0}" />     <bean:property name="searchsubtree" value="true" /> </bean:bean>

now problem facing when try retrieve securitycontextholder.getcontext().getauthentication().getprincipal(); it's return type string rather userdetails(certificate details used while logging), string output getprincipal() anonymoususer , authorities give role_anonymous when call getauthentication.isauthenticated() returns true. using tomcat 7, spring security 3.1
might problem please me in regard

with configuration, username extracted certificate "mohankumar kanaka" , spring security try use authentication.

with ldap configuration, search directory entry samaccountname attribute matching (which doesn't find).

you need way of mapping name in certificate active directory entry. there's no way spring security can automatically. ideally part of subject name in certificate should match ad user name can extract easily.


Comments

Post a Comment

Popular posts from this blog

jquery - How can I dynamically add a browser tab? -

since using iframes house external pages are, accounts "not preferred method" , disallowed sites (flickr, one), want dynamically generate browser tabs. e.g., when user submits form, want dynamically generate tab on browser in response submitted. e.g., might want add new tab url like: http://www.bigsurgarrapata.com/contact how in jquery? you want form target attribute action attribute. http://www.w3schools.com/tags/att_form_target.asp browsers have ultimate control on result of target attribute open new tab value of _blank. <form action="contact_submit.php" target="_blank" method="post">
Read more

node.js - Getting the socket id,user id pair of a logged in user(s) -

i have web application done using node js , in it,i have authentication system requires users log in before can access pages. have 2 pages,the homepage , updates page. from read docs,a new socket id issued when user opens tab in browser. me being admin,i know socket id of logged in user , more so,the socket id,logged in user id pair logged in users. what method can use socket id,logged in user id pair make sure broadcast realtime info users online?.
Read more

keyboard - C++ GetAsyncKeyState alternative -

i using windows.h library's getasynckeystate function define key pushed on keyboard . here program returns int value of pushed key example. #include <iostream> #include <windows.h> using namespace std; int main (){ char i; for(i=8;i<190;i++){ if(getasynckeystate(i)== -32767){ cout<<int (i)<<endl; } } return 0; } but trying make opengl simple game , function appeared slow . there function not need cycle 180 times , if statement . thanks you're trying make opengl game, you're going use glfw. if that's case can away using glfwgetkey() such: if (glfwgetkey(glfw_key_up) == glfw_press) {...} if (glfwgetkey(glfw_key_down) == glfw_press) {...} that method nicely explained in tutorial 6 opengl-tutorial.org . should start first tutorial of beginners tutorials , later intermediate tutorials . if you're going make win32 window can listen wm_keydown or wm_keyup messages , virtua
Read more