F auths spi

Ah, I meant to say, shouldn't you pass the DataStore parameter Map into the getAuths method?  That way, the default implementation can pull the auths from the Map (which assumes that the client code has properly authenticated and set the params up correctly).  In the Spring context, the getAuth method can pull the principal from the Map and resolve auths against LDAP.

Basically, the client code needs to pass enough information in the parameter map to authenticate and authorize.