Announcement Announcement Module
No announcement yet.
Spring 3.1: LDAP: "Bad Credentials" That Aren't Page Title Module
Move Remove Collapse
Conversation Detail Module
  • Filter
  • Time
  • Show
Clear All
new posts

  • Spring 3.1: LDAP: "Bad Credentials" That Aren't

    Spring 3.1
    Tomcat 6.*

    I'm working on making a Spring 3.1 webapp, authenticating with LDAP. When I hit submit on my login page, it just hangs and after a very, very long time returns with this error message:

    socket closed;
    nested exception is javax.naming.ServiceUnavailableException:; socket closed

    I was able to connect to my organizations LDAP server by using Softerra's LDAP browser using a real user's password and plugging in the "principal" ( with the username swapped out for "uid={0}" ), which I use in my *-security.xml file:


    I was also able to connect with a JNDI styled Java program I wrote (quoted below ). That program dumped all of the users attributes, including the password, which seems to be encrypted on the LDAP server. Do I need to tell Spring 3.1 this or encrypt the password that is collected on the login screen?

    I noticed that Java program I wrote/copied/adapted specified "ssl" in the context. When I commented that out, the client program also hanged for a long time and returned with the same error message as Spring 3.1. I uncommented that out, changed "ldap://" to "ldaps://" in the client program and that worked fine.

    I tried the same thing in my *-security.xml. I changed "ldap://" to "ldaps://" in the ldap url. This time the webapp did not hang, but returned very quickly with a message of

    "Bad Credentials"

    I tested my username and password out. They are legitimate.

    I also tried typing in the encrypted version of my password, but that didn't make a difference.

    I'm guessing something with SSL and/or password encryption is now my problem.

    Any ideas of things I could check out?

    My *-security.xml and the java LDAP demo I wrote are quoted below


    My *-security.xml file:

        <beans xmlns=""  
          <s:http auto-config="true">  
            <s:intercept-url pattern="/welcome*" access="ROLE_USER" />  
            <s:form-login login-page="/login" default-target-url="/welcome"  
              authentication-failure-url="/loginfailed" />  
            <s:logout logout-success-url="/logout" />  
          <s:ldap-server url = "ldap://"/>  
             <s:ldap-authentication-provider user-dn-pattern="uid={0},ou=People," >
                 <s:password-compare hash="md5">
                     <s:password-encoder hash="md5"/>
    Here is the JNDI style LDAP Java program that WORKS with the same credentials:

    mport javax.naming.*;  
    import java.util.*;  
    import java.sql.*;  
    public class LDAPDEMO {  
        public static void main(String args[]) {  
            String lcf                = "com.sun.jndi.ldap.LdapCtxFactory";  
            String ldapurl            = "ldap://";  
            String loginid            = "John.A.Smith";  
            String password           = "passowordforjohn";  
            DirContext ctx            = null;  
            Hashtable env             = new Hashtable();  
            Attributes attr           = null;  
            Attributes resultsAttrs   = null;  
            SearchResult result       = null;  
            NamingEnumeration results = null;  
            int iResults              = 0;  
            env.put(Context.INITIAL_CONTEXT_FACTORY, lcf);  
            env.put(Context.PROVIDER_URL, ldapurl);  
            env.put(Context.SECURITY_PROTOCOL, "ssl");  
            env.put(Context.SECURITY_AUTHENTICATION, "simple");  
            env.put(Context.SECURITY_PRINCIPAL, "uid=" + loginid + ",ou=People,");  
            env.put(Context.SECURITY_CREDENTIALS, password);  
            try {  
                ctx     = new InitialDirContext(env);  
                attr    = new BasicAttributes(true);  
                attr.put(new BasicAttribute("uid",loginid));  
                results ="ou=People",attr);  
                while (results.hasMore()) {  
                    result       = (SearchResult);  
                    resultsAttrs = result.getAttributes();  
                    for (NamingEnumeration enumAttributes  = resultsAttrs.getAll(); enumAttributes.hasMore();) {  
                        Attribute a = (Attribute);  
                        System.out.println("attribute: " + a.getID() + " : " + a.get().toString());  
                    }// end for loop  
                }// end while loop  
                System.out.println("iResults == " + iResults);  
            }// end try  
            catch (Exception e) {  
        }// end function main()  
    }// end class LDAPDEMO

  • #2
    I got it working. The final version of my *-security.xml is quoted below.

    I took the "" out of the DN pattern and the LDAP worked.

    I had originally put the "" in both the LDAP URL and the DN pattern because I am new to Spring 3.1 and LDAP, and that is similar to how it is/was done in the Java JNDI version of the LDAP demo I wrote based on the legacy code I am replacing. That demo program is quoted in the original post above.

    <beans xmlns=""  
      xsi:schemaLocation="   ">  
      <s:http auto-config="true" use-expressions="true">  
        **<s:intercept-url pattern="/welcome*" access="isAuthenticated()" />** 
        <s:form-login login-page="/login" default-target-url="/welcome"  
          authentication-failure-url="/loginfailed" />  
        <s:logout logout-success-url="/logout" />  
      <s:ldap-server url = "ldap://"/>  
        <s:ldap-authentication-provider user-dn-pattern="uid={0},ou=People" />