基于Spring Cloud Gateway的远程LDAP用户认证实现方案咨询

Great question! Integrating LDAP authentication into Spring Cloud Gateway is a solid way to centralize security for your microservices ecosystem. Let’s walk through exactly how to implement this, covering dependencies, configuration, and core code.

First, add these dependencies to your project. If you’re using Maven, update your pom.xml:

<dependencies>
    <!-- Spring Cloud Gateway core -->
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-gateway</artifactId>
    </dependency>
    <!-- Spring Security for authentication -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <!-- Spring Security LDAP support -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-ldap</artifactId>
    </dependency>
    <!-- UnboundID LDAP SDK (recommended for robust LDAP interactions) -->
    <dependency>
        <groupId>com.unboundid</groupId>
        <artifactId>unboundid-ldapsdk</artifactId>
        <scope>runtime</scope>
    </dependency>
</dependencies>

For Gradle users, add to build.gradle:

dependencies {
    implementation 'org.springframework.cloud:spring-cloud-starter-gateway'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.security:spring-security-ldap'
    runtimeOnly 'com.unboundid:unboundid-ldapsdk'
}

Next, set up your LDAP connection details and security rules. Start with your application.yml (or .properties):

spring:
  ldap:
    urls: ldap://your-ldap-server:389  # Use ldaps:// for SSL (port 636)
    base: dc=example,dc=com
    username: cn=admin,dc=example,dc=com  # LDAP admin user for binding
    password: admin-password

  cloud:
    gateway:
      routes:
        - id: backend-service
          uri: http://your-backend-service:8080
          predicates:
            - Path=/api/**

Now create a security configuration class to wire up LDAP authentication for the gateway (since Gateway uses WebFlux, we’ll use reactive security components):

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.ldap.authentication.ReactiveLdapAuthenticationManager;
import org.springframework.security.ldap.server.UnboundIdContainer;
import org.springframework.security.web.server.SecurityWebFilterChain;

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        return http
            .authorizeExchange(exchanges -> exchanges
                .anyExchange().authenticated()
            )
            .httpBasic()  // Use Basic Auth for simplicity; switch to OAuth2/JWT if needed
            .and()
            .csrf().disable()  // Typically disabled for API gateways
            .build();
    }

    @Bean
    public ReactiveLdapAuthenticationManager authenticationManager() {
        // Configure LDAP user search: find user by username in the "users" OU
        UnboundIdContainer ldapContainer = new UnboundIdContainer(
            "dc=example,dc=com",
            "ldap://your-ldap-server:389"
        );
        ldapContainer.setUserDnPatterns("uid={0},ou=users");
        ldapContainer.setManagerDn("cn=admin,dc=example,dc=com");
        ldapContainer.setManagerPassword("admin-password");

        return new ReactiveLdapAuthenticationManager(ldapContainer);
    }
}

If you need to map LDAP user attributes (like roles, email) to Spring Security’s UserDetails, add a custom UserDetailsContextMapper:

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.ldap.userdetails.UserDetailsContextMapper;
import org.springframework.ldap.core.DirContextOperations;
import java.util.Collection;

public class CustomLdapUserDetailsMapper implements UserDetailsContextMapper {
    @Override
    public UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection<? extends GrantedAuthority> authorities) {
        // Extract custom attributes from LDAP
        String email = ctx.getStringAttribute("mail");
        String fullName = ctx.getStringAttribute("cn");
        
        // Build custom UserDetails object
        return User.withUsername(username)
            .password("")  // LDAP handles password validation, so leave this empty
            .authorities(authorities)
            .email(email)
            .build();
    }

    @Override
    public void mapUserToContext(UserDetails user, DirContextAdapter ctx) {
        // Not needed for authentication flow
    }
}

Update your ReactiveLdapAuthenticationManager to use this mapper:

@Bean
public ReactiveLdapAuthenticationManager authenticationManager() {
    UnboundIdContainer ldapContainer = new UnboundIdContainer(
        "dc=example,dc=com",
        "ldap://your-ldap-server:389"
    );
    ldapContainer.setUserDnPatterns("uid={0},ou=users");
    ldapContainer.setManagerDn("cn=admin,dc=example,dc=com");
    ldapContainer.setManagerPassword("admin-password");

    ReactiveLdapAuthenticationManager authManager = new ReactiveLdapAuthenticationManager(ldapContainer);
    authManager.setUserDetailsContextMapper(new CustomLdapUserDetailsMapper());
    return authManager;
}

To forward the authenticated user’s details to your backend services, add a custom Gateway Filter:

import org.springframework.cloud.gateway.filter.GatewayFilter;
import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
import org.springframework.stereotype.Component;
import reactor.core.publisher.Mono;
import java.util.stream.Collectors;

@Component
public class UserInfoHeaderFilter extends AbstractGatewayFilterFactory<UserInfoHeaderFilter.Config> {

    public UserInfoHeaderFilter() {
        super(Config.class);
    }

    @Override
    public GatewayFilter apply(Config config) {
        return (exchange, chain) -> ReactiveSecurityContextHolder.getContext()
            .map(ctx -> ctx.getAuthentication())
            .flatMap(auth -> {
                // Add username to request header
                exchange.getRequest().mutate()
                    .header("X-Authenticated-User", auth.getName());
                // Add roles if needed
                String roles = auth.getAuthorities().stream()
                    .map(GrantedAuthority::getAuthority)
                    .collect(Collectors.joining(","));
                exchange.getRequest().mutate()
                    .header("X-Authenticated-Roles", roles);
                return chain.filter(exchange);
            });
    }

    public static class Config {
        // Add configuration properties if needed
    }
}

Update your gateway route to use this filter:

spring:
  cloud:
    gateway:
      routes:
        - id: backend-service
          uri: http://your-backend-service:8080
          predicates:
            - Path=/api/**
          filters:
            - UserInfoHeaderFilter

• SSL/TLS for LDAP: If your LDAP server uses SSL (ldaps://), import the server’s certificate into your JVM truststore or configure SSL properties in your application.
• LDAP Search Filters: Adjust userDnPatterns or userSearchFilter to match your directory structure (e.g., userSearchFilter: (sAMAccountName={0}) for Active Directory).
• Error Handling: Add custom exception handlers to return meaningful 401 Unauthorized responses when authentication fails.
• Performance: Consider adding caching for LDAP authentication results to reduce load on your LDAP server (use Spring Cache with a suitable provider).

内容的提问来源于stack exchange，提问作者Christopher K.