使用Spring Security LDAP用户查询无法完成用户认证求助

Let's break down your LDAP authentication issue step by step – silent failures are tricky, but we can narrow down the possible causes with targeted checks. First, let's recap your setup for clarity:

LDAP Server Hierarchy (from Apache Directory Studio) #

• Root DSE: DC=company,DC=com
  • OU=Offices
    • OU=Region Offices
      • OU=Region1 Office
        • OU=Users
          • CN=Jayesh Mulwani
  • OU=Misc (inferred from your config's service account path)

Current Spring Security LDAP Configuration #

public class LDAPSecurityConfig extends WebSecurityConfigurerAdapter{ 
    protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { 
        authenticationManagerBuilder.ldapAuthentication() 
            .contextSource().url("ldap://server-url/CN=auth_support,OU=Misc,DC=company,DC=com") 
            .managerDn("username").managerPassword("password") 
            .and() 
            .userSearchBase("OU=Offices,DC=company,DC=com") 
            .userSearchFilter("(&(objectClass=user)(cn={0}))"); 
    } 
}

The Problem #

After deploying the app to Tomcat, entering a valid username and password results in authentication failure with no visible error messages.

Troubleshooting Steps & Fixes #

1. Fix the LDAP Context Source URL & Manager DN #

Your context source URL is pointing directly to the CN=auth_support service account, which is incorrect. The URL should target the root/base DN of your LDAP server, and the managerDn needs to be the full distinguished name of the service account. Update this section:

.contextSource().url("ldap://server-url/DC=company,DC=com")
.managerDn("CN=auth_support,OU=Misc,DC=company,DC=com").managerPassword("password")

This is one of the most common misconfigurations that causes silent authentication failures, as the app can't properly bind to the LDAP server to search for users.

2. Validate User Search Base & Filter #

Looking at your LDAP tree, the user CN=Jayesh Mulwani lives under OU=Users,OU=Region1 Office,OU=Region Offices,OU=Offices,DC=company,DC=com. Your current userSearchBase is correct for recursive searches, but check these:

• Are you using the right attribute for login? Your filter uses cn={0} – that means you need to enter the full common name (e.g., "Jayesh Mulwani") as the username. If you're using a different attribute like sAMAccountName (Active Directory) or uid, adjust the filter:

  .userSearchFilter("(&(objectClass=user)(sAMAccountName={0}))")
  

• Does your LDAP server allow sub-tree searches? Some servers restrict search scope – confirm that the service account has permission to search recursively under OU=Offices.

3. Enable Debug Logging to Uncover Hidden Errors #

Silent failures usually mean exceptions are being swallowed somewhere. Enable debug logging for Spring Security and LDAP components to see exactly what's happening. Add this to your logging config (e.g., logback.xml):

<logger name="org.springframework.security" level="DEBUG"/>
<logger name="org.springframework.ldap" level="DEBUG"/>

This will log connection attempts, user search queries, bind operations, and any underlying errors that aren't being displayed to the user.

4. Test LDAP Connection & Permissions Outside the App #

Verify that your service account can actually connect to the LDAP server and find the user using a standalone tool:

• Apache Directory Studio: Use the service account credentials to bind, then search for cn=Jayesh Mulwani under OU=Offices,DC=company,DC=com.
• Command-line (ldapsearch):

  ldapsearch -x -H ldap://server-url -D "CN=auth_support,OU=Misc,DC=company,DC=com" -w "your-service-password" -b "OU=Offices,DC=company,DC=com" "cn=Jayesh Mulwani"
  

If this search fails, the issue is with the service account's permissions or LDAP server settings, not your app code.

5. Check Tomcat Network & SSL Settings (if applicable) #

If your LDAP server uses LDAPS (port 636):

• Ensure Tomcat trusts the LDAP server's certificate (add it to Tomcat's cacerts truststore).
• Update the context source URL to use ldaps://server-url.
• Confirm there's no firewall blocking traffic between Tomcat and the LDAP server.

6. Verify Password Encoding #

If your LDAP server stores passwords in a specific format (e.g., SSHA, MD5), you need to configure a matching password encoder in Spring Security. For testing with plain-text passwords (not recommended for production), you can use:

.and()
.passwordEncoder(NoOpPasswordEncoder.getInstance())

Replace this with the appropriate encoder (like LdapShaPasswordEncoder) for your production setup.

内容的提问来源于stack exchange，提问作者Jayesh Mulwani