我有一个使用REST服务进行LDAP身份验证的项目。我的LDAP配置具有Salted SHA(SSHA)密码哈希方法。在Spring的LDAP身份验证最佳实践指南中支持SHA方法,当我使用它时我得到了错误的凭据,而crendentials是可以的。
我的配置类参考:
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.ldapAuthentication()
.userSearchFilter("uid={0}")
.contextSource(contextSource())
.passwordCompare()
.passwordEncoder(new LdapShaPasswordEncoder())
.passwordAttribute("userPassword");
}
@Bean
public DefaultSpringSecurityContextSource contextSource() {
return new DefaultSpringSecurityContextSource(Arrays.asList("ldap://localhost:8389/"), "dc=springframework,dc=org");
}
}
我的ldif配置;
dn: uid=ben,ou=people,dc=springframework,dc=org
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetOrgPerson
cn: Ben Alex
sn: Alex
uid: ben
userPassword: {SSHA}pcFdFhO/NS98EhTRup60PMkHMWFRDkJ3jUu1Zg==
我的原始密码是Test1234
。我的pom.xml
文件;
<dependency>
<groupId>org.springframework.ldap</groupId>
<artifactId>spring-ldap-core</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-ldap</artifactId>
</dependency>
<dependency>
<groupId>com.unboundid</groupId>
<artifactId>unboundid-ldapsdk</artifactId>
</dependency>
如何使用我的用户名/密码对使用SSHA密码加密的ldap服务器进行身份验证?
答案 0 :(得分:1)
尝试这种方法
auth
.ldapAuthentication()
.userSearchFilter("uid={0}")
.contextSource(contextSource())
.passwordCompare().passwordAttribute("userPassword")
.and()
.passwordEncoder(passwordEncoder());
并创建自定义密码编码器
private PasswordEncoder passwordEncoder() {
final LdapShaPasswordEncoder sha = new LdapShaPasswordEncoder();
return new PasswordEncoder() {
@Override
public String encode(CharSequence rawPassword) {
return sha.encodePassword(rawPassword.toString(), null);
}
@Override
public boolean matches(CharSequence rawPassword, String encodedPassword) {
return sha.isPasswordValid(encodedPassword, rawPassword.toString(), null);
}
};
}
我有同样的问题,对我有用。
希望它可以帮到你!
答案 1 :(得分:0)
坚持使用您的初始代码,但这一次尝试将.userSearchFilter("uid={0}")
变为.userSearchFilter("uid={0},ou=people")
或.userDnPatterns("uid={0},ou=people")
。
答案 2 :(得分:0)
我使用apache目录支持的bcrypt遇到了类似的问题。由于@jrdalpra建议的解决方案,我得以解决。这是我给处于相同情况的任何人的解决方案:
private PasswordEncoder newPasswordEncoder() {
final BCryptPasswordEncoder crypt = new BCryptPasswordEncoder();
return new PasswordEncoder() {
@Override
public String encode(CharSequence rawPassword) {
// Prefix so that apache directory understands that bcrypt has been used.
// Without this, it assumes SSHA and fails during authentication.
return "{CRYPT}" + crypt.encode(rawPassword);
}
@Override
public boolean matches(CharSequence rawPassword, String encodedPassword) {
// remove {CRYPT} prefix
return crypt.matches(rawPassword, encodedPassword.substring(7));
}
};
}