Why does Spring Security BindAuthenticator require read permission for users?

Question

I am currently implementing / configuring LDAP authentication for a Java web application using Spring Security 3.0. I am using Microsoft AD LDS as an LDAP server and have selected Spring BindAuthenticator. I found out that authentication only works if the authenticated user is a member of the role of section readers. BindAuthenticator attempts to read user attributes after authentication, which seems reasonable in scenarios where privileges are retrieved from a directory service.

Being new to LDAP and AD, is this an acceptable practice when an application is integrated into an existing AD framework? Can fine tuning give the dns user only read permissions for their own attributes, and not add them to the Reader group?

Thank you Thomas

---

Edit 3/8/2010: Here is what I ended up doing: I copied Spring BindAuthenticator (the whole class) and changed the bindWithDn () method as shown below. Differences are marked by DIFF.

private DirContextOperations bindWithDn(String userDn, String username, String password) {
    BaseLdapPathContextSource ctxSource = (BaseLdapPathContextSource) getContextSource();
    DistinguishedName fullDn = new DistinguishedName(userDn);
    fullDn.prepend(ctxSource.getBaseLdapPath());

    logger.debug("Attempting to bind as " + fullDn);

    DirContext ctx = null;
    try {
        ctx = getContextSource().getContext(fullDn.toString(), password);
        // Check for password policy control
        PasswordPolicyControl ppolicy = PasswordPolicyControlExtractor.extractControl(ctx);

        // *DIFF* Attributes attrs = ctx.getAttributes(userDn, getUserAttributes());

        DirContextAdapter result = new DirContextAdapter(null, new DistinguishedName(userDn),  // *DIFF*
                ctxSource.getBaseLdapPath());

        if (ppolicy != null) {
            result.setAttributeValue(ppolicy.getID(), ppolicy);
        }

        return result;
    } catch (NamingException e) {
        // This will be thrown if an invalid user name is used and the method may
        // be called multiple times to try different names, so we trap the exception
        // unless a subclass wishes to implement more specialized behaviour.
        if ((e instanceof org.springframework.ldap.AuthenticationException)
                || (e instanceof org.springframework.ldap.OperationNotSupportedException)) {
            handleBindException(userDn, username, e);
        } else {
            throw e;
        }
    // *DIFF* } catch (javax.naming.NamingException e) {
    // *DIFF*     throw LdapUtils.convertLdapException(e);
    } finally {
        LdapUtils.closeContext(ctx);
    }

    return null;
}

Answer 1

, BindAuthenticator LDAP " " LDAP . , LDAP , , .

( setUserAttributes) . , AD RBAC , , "Reader", - .

:

• RBAC LDAP, , .
• , . .