Http basic authentication using ldap credentials in spring security(spring-boot project) to secure rest service calls

Question

Using Spring Security Basic authentication setup works against some hardcoded username passwords as shown here:

http://thoughtfulsoftware.wordpress.com/2013/12/08/adding-security-to-spring-guides-rest-service/

So trying to extend it to use LDAP.

Completed the set up for LDAP authentication with our LDAP server

Now when I try to call my rest service through REST Console plug-in an authorization window keeps on popping up for username password. If I cancel it authorization fails, not sure where I am going wrong

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
    protected void configure(HttpSecurity http) throws Exception {http
        .authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .csrf().disable()
        .httpBasic();


    @Override
    protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
        authManagerBuilder
            .ldapAuthentication()
            .userSearchFilter("(uid={0})").userSearchBase("ou=people,dc=zzz,dc=xxxx,dc=yyy")
            .groupRoleAttribute("cn").groupSearchFilter("(member={0})")
                //.userDnPatterns("uid={0},ou=people")
                //.groupSearchBase("ou=groups")
                .contextSource().url("ldaps://ldap.xxxx.yyy:636/cn=cw-grpreader,ou=people,dc=xxx,dc=xxxx,dc=xxx")
                .managerDn("cn=xx-xxr,ou=people,dc=med,dc=xxxx,dc=xxx")
                .managerPassword("#$%^^");
    }

This is one way I tried which give the recurring authentication popup if I cancel the popup I get HTTP Status 401 - [LDAP: error code 49 - NDS error: failed authentication (-669)]; error even if the credentials are correct Link to some tutorial will be really helpful

Sounds like it's working. Can you type your ldap credentials into the dialog and authenticate? (Post your configuration.) — Dave Syer
@Dave I am putting in the credentials but its coming back Adding the configuration — user3255021
At least it looks like you are connecting to the server. Did you test the url and DN separately? I suspect it's just the LDAP configuration that's wrong (although I would recommend pulling it out into a separate GlobalAuthenticationConfigurerAdapter). — Dave Syer
@Dave I am now using the GlobalAuthenticationConfigurerAdapter as suggested. It seems the httpbasic authentication is still failing to go against the LDAP service for authentication (HTTP Status 401 - Bad credentials with status report This request requires HTTP authentication) — user3255021

Dev707 Dev707 · Accepted Answer · 2015-06-29T14:49:38

This is due to httpbasic authentication that you have set up. Spring boot generates a random password thats shown on console which you could use.

To disable that pop-up simply add this to your application.properties file.

security.basic.enabled: false

Http basic authentication using ldap credentials in spring security(spring-boot project) to secure rest service calls

1 Answers