Rudder

Using LDAP authentication (configuration included below), LDAP users are authenticated but immediately logged out - due to Rudder being unable to read the group membership.

This was discussed on #rudder (see attached conversation).

NB: It was also mentioned during the IRC conversation that the documentation references the wrong version of an LDAP library required for functionality. The corrected version was used in revealing this bug.

    <authentication-manager>
        <authentication-provider ref="ldapAuthenticationProvider"/>
    </authentication-manager>

    <beans:bean id="contextSource" 
     class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
        <beans:constructor-arg value="ldap://XX.YY.ZZ.AA:389/dc=BBBB"/>
        <beans:property name="anonymousReadOnly" value="true"/>
    </beans:bean>

    <beans:bean id="ldapAuthenticationProvider" 
     class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
        <beans:constructor-arg>
            <beans:bean class="org.springframework.security.ldap.authentication.BindAuthenticator">
                <beans:constructor-arg ref="contextSource"/>
                <beans:property name="userDnPatterns">
                    <beans:list><beans:value>cn={0},ou=Users</beans:value></beans:list>
                </beans:property>
            </beans:bean>
        </beans:constructor-arg>
        <beans:constructor-arg>
            <beans:bean
             class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
                <beans:constructor-arg ref="contextSource"/>
                <beans:constructor-arg value="ou=Groups"/>
                <beans:property name="groupRoleAttribute" value="cn"/>
            </beans:bean>
        </beans:constructor-arg>
    </beans:bean>