Spring Security + LDAP + CustomLdapAuthoritiesPopulator + RememberMe

From Spring Docs Remember-Me

If you are using an authentication provider that does not use UserDetailsService

(like an LDAP provider ) then it won't work unless you also have a UserDetailsService bean in the context of your application .

Try adding below to applicationContext.xml

: -

Add RoleVoter . From Spring Docs

Voices, if any, ConfigAttribute.getAttribute()

start with a prefix indicating that this is a role. The default prefix string ROLE_

, but this can be overridden to any value. It can also be set to empty, which means that essentially any attribute will vote. As described below, the effect of an empty prefix may not be very desirable.

Abstains from voting if the configuration attribute does not start with a role prefix. Votes to grant access if there is an exact match GrantedAuthority

and ConfigAttribute

starting with the role prefix. Votes deny access unless GrantedAuthority matches the ConfigAttribute exactly, starting with the role prefix.

All comparisons and prefixes are case sensitive.

<bean id="roleVoter" 
    class="org.springframework.security.access.vote.RoleVoter" p:rolePrefix="" />

      

        
        
        
      

    

Add AuthenticatedVoter . From Soring Docs

Voices if a ConfigAttribute.getAttribute()

of IS_AUTHENTICATED_FULLY

or IS_AUTHENTICATED_REMEMBERED

or is present IS_AUTHENTICATED_ANONYMOUSLY

. This list is in order of most stringent verification for minimum stringent verification.

The current authentication will be checked to determine if the principal has a specific level of authentication. The "FULLY" option is authenticated because the user is fully authenticated (ie, AuthenticationTrustResolver.isAnonymous(Authentication)

false, but AuthenticationTrustResolver.isRememberMe(Authentication)

false). "REMEMBERED"

will grant access if the supervisor was either authenticated using the mem-me function OR, or fully authenticated. "ANONYMOUSLY"

will grant access if the principal was authenticated through mem-mem, OR anonymously, OR through full authentication.

All comparisons and prefixes are case sensitive.

<bean id="authVoter" 
    class="org.springframework.security.access.vote.AuthenticatedVoter">               
</bean>

      

        
        
        
      

    

Now, configure Spring AccessDecisionManager

, which uses the above two voters, to determine if the user has been given the correct access to the resource.

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.ConsensusBased">
    <property name="allowIfAllAbstainDecisions" value="false" />
    <property name="decisionVoters">
        <list>
            <ref bean="roleVoter"  />
            <ref bean="authVoter" />
        </list>
    </property>
</bean>

      

        
        
        
      

    

For more information: Visit Spring security 3 remember me with LDAP authentication

EDIT 1:

• Spring Security with LDAP and Database Roles
• Spring Security 3.1 - Implementing UserDetailsService with Spring Data JPA

EDIT 2:

Below is the source originally posted on Configuring Spring Security Form Login with Remember Me enabled .

Create custom RememberMeProcessingFilter:

public class MyRememberMeProcessingFilter extends RememberMeProcessingFilter { 
    private myService; 

    @Override 
    protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) { 
        // perform some custom logic when the user has been 'remembered' & authenticated - e.g. update a login count etc 
        this.myService.doSomeCustomBusinessLogic(authResult.getName()); 

        super.onSuccessfulAuthentication(request, response, authResult); 
    } 
} 

      

        
        
        
      

    

RememberMeProcessingFilter

enable any custom business logic that you want to run when the user returns to your site and is "remembered by the application".

Don't forget to add:

<custom-authentication-provider /> 

      

        
        
        
      

    

This ensures that remember that I am indeed being used as an authentication provider - that is, when your user returns a message previously requested to remember, it adds, remember me, to the list of providers that validate authenticates.