dimanche 22 février 2015

Spring ldap authentication redirecting to specific page depend on whether group the user belongs

I'm deploying a sping web application that must redirect the users to the page of their LDAP group. The groups are administrators, managers and users. Here is a permissions table.


administrators con access to it's page, managers page and users page


managers can access to it's page and users page


users only can acces to their page


the ldap tree


|_groups |_cn=administrators |_cn=managers |_cn=userG


|_users |_uid=a1 |_uid=a2 |_uid=m1 |_uid=m2 |_uid=u1 |_uid=u2


I started coding from ldap authentication example. http://ift.tt/1wEZ5EB This is my webSecurityConfig.java:



package hello;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().antMatchers("/css/**").permitAll().anyRequest()
.fullyAuthenticated().and().formLogin();
}

@Configuration
protected static class AuthenticationConfiguration extends
GlobalAuthenticationConfigurerAdapter {

@Override
public void init(AuthenticationManagerBuilder auth) throws Exception {
auth.ldapAuthentication()
.userDnPatterns("uid={0},ou=people")
//.groupSearchBase("ou=group") //don't mind
.contextSource()
//.ldif("classpath:test-server.ldif");
.url("ldap://192.168.1.103:389/dc=example,dc=com");

}
}


}


I can authenticate all users, but i can't filter between the groups. I've tried all options in authenticating context (userDNpattern, SearchBaseFilter groupSearchBase rolePrefix, etc) but, for example forcing to filter managers group the result is te same for all groups/roles. Any help will be very much appreciated.


Aucun commentaire:

Enregistrer un commentaire