georchestra/georchestra — pull request #687 by pmauduit (2014-06-12 15:08:44+00:00)
Title: security-proxy - mixing LDAP authentication / roles mapping sources

@jesseeichar, @fgravin, (and other Java people interested in a review)

On a geOrchestra project, we have to mix 2 different authentication sources:

- First, the user credentials are tested against an active directory (which uses specific DN formats for user, which do not seem compatible with the regular LDAP authenticator class (LdapAuthenticationProvider). So the main idea was to use specific AD classes from Spring security, but unavailable in the version of Spring-security we were using in the security proxy.

- Secondly, the user roles are guessed from an OpenLDAP using a bean (LdapAuthoritiesPopulator) passed as argument of the LdapAuthenticationProvider. But since we are willing to use a specific Active Directory class to check the user credentials (ActiveDirectoryLDAPAuthenticationProvider), I could not pass the populator anymore.

So I had to rewrite an AD-like class that adds the missing feature of the previous LdapAuthenticationProvider, that I called CustomAuthenticationProvider. From now on, I'm unsure that the spring security version bump is useful anymore, and I doubt that I had the good approach to tackle this problem.

Anyway, it works and it is currently deployed onto sig-test's rennes-métropole infrastructure. So what do you think about it ?