Devops Monk

<!-- Spring LDAP / Spring Security LDAP -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-ldap</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.ldap</groupId>
    <artifactId>spring-ldap-core</artifactId>
</dependency>

<!-- Embedded LDAP server for development/testing -->
<dependency>
    <groupId>com.unboundid</groupId>
    <artifactId>unboundid-ldapsdk</artifactId>
    <scope>test</scope>
</dependency>

@Configuration
@EnableWebSecurity
public class LdapSecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public LdapAuthenticationProvider ldapAuthenticationProvider() {
        return new LdapAuthenticationProvider(
            bindAuthenticator(),
            authoritiesPopulator()
        );
    }

    @Bean
    public BindAuthenticator bindAuthenticator() {
        BindAuthenticator authenticator = new BindAuthenticator(contextSource());
        // Search pattern — {0} is replaced with the username
        authenticator.setUserSearch(new FilterBasedLdapUserSearch(
            "ou=users",                        // search base (relative to root)
            "(uid={0})",                       // search filter — {0} = username
            contextSource()
        ));
        // Or use direct DN pattern (faster, no search needed)
        // authenticator.setUserDnPatterns(new String[]{"uid={0},ou=users"});
        return authenticator;
    }

    @Bean
    public LdapAuthoritiesPopulator authoritiesPopulator() {
        DefaultLdapAuthoritiesPopulator populator =
            new DefaultLdapAuthoritiesPopulator(contextSource(), "ou=groups");
        populator.setGroupSearchFilter("(member={0})");       // {0} = user's full DN
        populator.setGroupRoleAttribute("cn");                // group name attribute
        populator.setRolePrefix("ROLE_");                     // prefix added to group name
        populator.setConvertToUpperCase(true);                // cn=developers → ROLE_DEVELOPERS
        return populator;
    }

    @Bean
    public DefaultSpringSecurityContextSource contextSource() {
        DefaultSpringSecurityContextSource contextSource =
            new DefaultSpringSecurityContextSource("ldap://ldap.example.com:389/dc=example,dc=com");
        contextSource.setUserDn("cn=serviceaccount,dc=example,dc=com"); // manager DN
        contextSource.setPassword("manager-password");
        return contextSource;
    }
}

@Bean
public AuthenticationProvider activeDirectoryAuthProvider() {
    ActiveDirectoryLdapAuthenticationProvider provider =
        new ActiveDirectoryLdapAuthenticationProvider(
            "example.com",           // AD domain
            "ldap://ad.example.com"  // AD server URL
        );

    // AD-specific: use SAM account name for login
    provider.setSearchFilter("(&(objectClass=user)(sAMAccountName={1}))");

    // Convert AD groups to Spring roles
    provider.setConvertSubErrorCodesToExceptions(true);
    provider.setUseAuthenticationRequestCredentials(true);

    return provider;
}

# application-dev.yml
spring:
  ldap:
    embedded:
      base-dn: dc=example,dc=com
      ldif: classpath:test-ldap-data.ldif
      port: 8389
      validation:
        enabled: false

// Profile-based configuration — embedded for dev, real LDAP for prod
@Configuration
@Profile("dev")
public class EmbeddedLdapConfig {

    @Bean
    public DefaultSpringSecurityContextSource contextSource() {
        return new DefaultSpringSecurityContextSource(
            "ldap://localhost:8389/dc=example,dc=com"
        );
    }
}

@Configuration
@Profile("prod")
public class ProductionLdapConfig {

    @Value("${ldap.url}")
    private String ldapUrl;

    @Value("${ldap.manager-dn}")
    private String managerDn;

    @Value("${ldap.manager-password}")
    private String managerPassword;

    @Bean
    public DefaultSpringSecurityContextSource contextSource() {
        DefaultSpringSecurityContextSource ctx =
            new DefaultSpringSecurityContextSource(ldapUrl);
        ctx.setUserDn(managerDn);
        ctx.setPassword(managerPassword);
        return ctx;
    }
}

@Component
public class CustomLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator {

    private static final Map<String, String> GROUP_TO_ROLE = Map.of(
        "developers",    "ROLE_DEVELOPER",
        "devops",        "ROLE_DEVOPS",
        "qa-engineers",  "ROLE_QA",
        "team-leads",    "ROLE_MANAGER",
        "sre-team",      "ROLE_SRE"
    );

    @Override
    public Collection<? extends GrantedAuthority> getGrantedAuthorities(
        DirContextOperations userData,
        String username
    ) {
        // Get group memberships from LDAP attribute
        String[] groups = userData.getStringAttributes("memberOf");
        if (groups == null) return List.of();

        return Arrays.stream(groups)
            .map(dn -> extractCn(dn).toLowerCase())
            .map(cn -> GROUP_TO_ROLE.getOrDefault(cn, "ROLE_" + cn.toUpperCase()))
            .map(SimpleGrantedAuthority::new)
            .toList();
    }

    private String extractCn(String dn) {
        // Extract CN from full DN: "CN=developers,OU=groups,DC=example,DC=com" → "developers"
        return dn.split(",")[0].replace("CN=", "").replace("cn=", "");
    }
}

@Component
public class HybridLdapAuthoritiesPopulator implements LdapAuthoritiesPopulator {

    private final UserRepository userRepository;
    private final DefaultLdapAuthoritiesPopulator ldapPopulator;

    @Override
    public Collection<? extends GrantedAuthority> getGrantedAuthorities(
        DirContextOperations userData,
        String username
    ) {
        // Get LDAP groups
        Collection<GrantedAuthority> ldapAuthorities =
            ldapPopulator.getGrantedAuthorities(userData, username);

        // Merge with local DB roles
        Set<GrantedAuthority> combined = new HashSet<>(ldapAuthorities);
        userRepository.findByUsername(username)
            .ifPresent(user -> user.getAppRoles()
                .forEach(role -> combined.add(new SimpleGrantedAuthority("ROLE_" + role))));

        return combined;
    }
}

logging:
  level:
    org.springframework.security.ldap: DEBUG
    org.springframework.ldap: DEBUG
    com.sun.jndi.ldap: ALL  # very verbose — shows raw LDAP protocol messages