No password check when DefaultTlsDirContextAuthenticationStrategy is activated #430
Description
We stumbled over this problem one week ago and thought it would be nice to tell you about this.
When the DefaultTlsDirContextAuthenticationStrategy is set as authentication strategy on the LdapContextSource every password will be accepted, because there happens no bind with user credentials against ldap.
After deep debugging into your code and a lot of searching on the web, we found this post in the spring forum from Jul 18th, 2013.
http://forum.spring.io/forum/spring-projects/data/ldap/129629-ldap-with-tls-authentication-issues
mwebb describes very detailed the problem and gives an code example approach to fix this.
It appears that SimpleDirContextAuthenticationStrategy and DefaultTlsDirContextAuthenticationStrategy are not symmetrical in their behaviour. I resolved this be creating a custom TlsDirContextAuthenticationStrategy and adding a ctx.reconnect() to the applyAuthentication(), after the environment settings for a simple bind have been set, as follows:
private void applyAuthentication(LdapContext ctx, String userDn, String password) throws NamingException {
ctx.addToEnvironment(Context.SECURITY_AUTHENTICATI ON, SIMPLE_AUTHENTICATION);
ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDn);
ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);
// Force reconnect with user credentials
ctx.reconnect(null)
}The problem he describes was exactly the same we had. The line ctx.reconnect(null) fixed it for us.