How to avoid plain text LDAP password in spring security?

Question

I just managed to get my OpenLDAP + Spring Security work, all works fine except one small issue that in spring security xml, I have to put plain text password there:

<beans:bean id="ldapContextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
    <beans:constructor-arg value="ldap://153.65.x.y:389/dc=example,dc=com" />
    <beans:property name="userDn" value="cn=Manager,dc=example,dc=com" />
    <beans:property name="password" value="secret" />
</beans:bean>

Is there any way to avoid this?

When I set up my OpenLDAP, I could actually add digest instead of plain text password in slapd.conf:

rootpw {SSHA}ZMFfVNPAazmLcif1xC2l9y9SFdKd+x4

So I'm hoping that spring security can do the similar thing.

EDIT:

I just realized that it's unnecessary to put LDAP manager name and password here, just provide uri and it would be good enough for spring security to work:

<beans:bean id="ldapContextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
    <beans:constructor-arg value="ldap://153.65.x.y:389/dc=example,dc=com" />
</beans:bean>

I had some misunderstanding here. When I tried to wrote this sample, quite a few samples I got from google put manager name and password in the spring security xml. So I once thought that this was like connecting to database via JDBC and we had to provide the database user name and password. This is not true, the manager name and password are not required.

Vilmantas Baranauskas Vilmantas Baranauskas · Accepted Answer · 2015-11-27T07:42:54

The reason why you are able to store rootpw as SSHA on LDAP server is because it does not need to know your original password in order to verify it - digest (in this case SSHA - salted secure hash) is sufficient for that. The client, however, needs to send the original password so server can compute a hash and compare it to the stored one.

At best, spring could offer some kind of encryption for password storage on the client, but I am not familiar with this.

EDIT: StackOverflow Encrypting a password within a Spring configuration file links to this: http://www.jasypt.org/spring3.html

How to avoid plain text LDAP password in spring security?

1 Answers