Add ability to provide custom search root/filter when creating ActiveDirectoryLDAPAuthenticationProvider

[jdpgrailsdev]

The current implementation of the ActiveDirectoryLdapAuthenticationProvider does not allow for a custom search root/filter. The attached change adds a new constructor that allows for a custom search root and filter to be provided and used if present. Otherwise, the current logic is used for generating the search root and filter used to find the user in AD.

[ghatchue]

1. Allowing the search root to be customized would certainly be useful.
   The default/generated search root doesn't work for my company AD server because the domain (e.g. us.example.com) doesn't match the user principal name in our configuration. ([email protected]).
2. Allowing the search filter to be customized as is suggested in this pull request has very limited use-cases. For example, it wouldn't allow you to bind using a different username attribute like sAMAccountName. This is because the search filter is customization, but the bind value is not (bindPrincipal = createBindPrincipal(username)).

Removing the final modifier on this class would help a lot.

[pivotal-issuemaster]

@jdpgrailsdev Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-issuemaster]

@jdpgrailsdev Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[jdpgrailsdev]

@rwinch @ghatchue Is it worth trying to dust off this PR and re-submit it? Admittedly, I haven't been doing much in the spring-security space lately, so this functionality has already been added, I can close this PR.

[rwinch]

@jdpgrailsdev Thanks for touching base. We plan to integrate this in 4.2.0.M1 which will be starting as soon as we get 4.1.1 out.

[andrei-ivanov]

I've just tried to use the ActiveDirectoryLDAPAuthenticationProvider to realize that this change might also help my situation:
The AD accepts bind using userId@domain combination but searchForUser fails as userPrincipalName is andrei.ivanov@domain, not userId@domain.
I hope this change would allow to change the filter and the value that gets passed to it, which is hardcoded to createBindPrincipal(username).

[jdpgrailsdev]

@rwinch Sounds good. Let me know if you need me to do anything with this PR. Otherwise, feel free to close this if you have a similar fix already in the pipe.

[pivotal-issuemaster]

@jdpgrailsdev Thank you for signing the Contributor License Agreement!

[jgrandja]

Thanks for submitting this PR @jdpgrailsdev.

We are currently re-thinking our approach to an Active Directory AuthenticationProvider implementation. Our direction is to deprecate ActiveDirectoryLdapAuthenticationProvider and leverage the existing LdapAuthenticationProvider and provide a custom strategy of LdapAuthenticator for Active Directory.

The work has already started in #4064 if you would like to track the progress and provide any input/feedback.

I'm going to close this PR as we will address your input/feedback in #4064.
Thank you.