Spring Security 6中LDAP身份认证实现及LDIF文件认证问题

1. 先校验.ldif文件合法性 #

• 确保文件语法严格符合LDAP规范：每条条目以dn:开头，属性键值对无多余空格，换行符格式正确
• 示例合法.ldif片段：

dn: uid=testuser,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
uid: testuser
cn: Test User
sn: User
userPassword: {SSHA}xxxxxxxxxxxxxxxxxxxxxx

• 本地装有OpenLDAP工具的话，用命令验证文件可正常导入：

  ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f your-file.ldif
  

  能成功导入则排除文件本身的问题。

2. Spring Security 6 核心配置实现 #

2.1 依赖引入（Maven） #

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-ldap</artifactId>
</dependency>
<dependency>
    <groupId>org.apache.directory.server</groupId>
    <artifactId>apacheds-server-jndi</artifactId>
    <version>2.0.0.AM26</version>
</dependency>

2.2 安全配置类编写 #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.LdapShaPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
import org.springframework.security.ldap.userdetails.LdapUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public DefaultSpringSecurityContextSource contextSource() {
        return new DefaultSpringSecurityContextSource("ldap://localhost:33389/dc=example,dc=com");
    }

    @Bean
    public UserDetailsService userDetailsService(DefaultSpringSecurityContextSource contextSource) {
        LdapUserDetailsManager manager = new LdapUserDetailsManager(contextSource);
        // 匹配.ldif中的用户DN格式
        manager.setUserDnPatterns("uid={0},ou=users");
        manager.setGroupSearchBase("ou=groups");
        return manager;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        // 对应.ldif中密码的加密格式，明文用NoOpPasswordEncoder.getInstance()
        return new LdapShaPasswordEncoder();
    }
}

2.3 配置文件简化（application.properties） #

用配置文件替代硬编码，更灵活：

spring.ldap.embedded.base-dn=dc=example,dc=com
spring.ldap.embedded.ldif=classpath:your-ldif-file.ldif
spring.ldap.embedded.port=33389

3. 常见错误排查 #

• 连接失败：检查端口是否被占用，确保嵌入式LDAP端口与配置一致
• 用户找不到：确认userDnPatterns与.ldif中用户DN完全匹配，比如用户DN是uid=testuser,ou=users,dc=example,dc=com，则userDnPatterns需设为uid={0},ou=users
• 密码验证失败：密码编码器必须和.ldif中密码加密格式对应，明文密码用NoOpPasswordEncoder，SSHA用LdapShaPasswordEncoder
• 条目导入失败：检查.ldif中是否有重复DN，或属性不符合对象类要求（比如inetOrgPerson必须包含sn属性）

内容的提问来源于stack exchange，提问作者user22066003