LDAP fails authentication ONLY first time

[voidance]

Hi all,

I am using spring security just for authentication. Roles will be get via db.

The first time I try to authenticate a user it fails returning:

2012-10-05 14:35:01,245 [qtp14301726-22] DEBUG org.springframework.security.ldap.search.FilterBasedLdapUserSearch - Searching for user 'dolbert', with user search [ searchFilter: '(uid={0})', searchBase: 'ou=users,ou=Internal,o=company', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
2012-10-05 14:35:01,861 [qtp14301726-22] DEBUG org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter - Authentication request failed: org.springframework.security.authentication.AuthenticationServiceException: [LDAP: error code 32 - No Such Object]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 32 - No Such Object]
2012-10-05 14:35:01,861 [qtp14301726-22] DEBUG org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter - Updated SecurityContextHolder to contain null Authentication
2012-10-05 14:35:01,861 [qtp14301726-22] DEBUG org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter - Delegating to authentication failure handlerorg.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@20c6a5

Then the second one login goes ok showing:

2012-10-05 14:38:27,397 [qtp14301726-26] DEBUG org.springframework.security.ldap.search.FilterBasedLdapUserSearch - Searching for user 'dolbert', with user search [ searchFilter: '(uid={0})', searchBase: 'ou=users,ou=Internal,o=company', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
2012-10-05 14:38:27,514 [qtp14301726-26] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Searching for entry in under DN '', base = 'ou=users,ou=Internal,o=company', filter = '(uid={0})'
2012-10-05 14:38:27,576 [qtp14301726-26] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Found DN: uid=dolbert,ou=users,ou=Internal,o=company
2012-10-05 14:38:27,596 [qtp14301726-26] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Found DN: uid=dolbert,ou=users,ou=Internal,o=company
2012-10-05 14:38:27,613 [qtp14301726-26] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Found DN: uid=dolbert,ou=users,ou=Internal,o=company
2012-10-05 14:38:27,626 [qtp14301726-26] DEBUG org.springframework.security.ldap.authentication.BindAuthenticator - Attempting to bind as uid=dolbert,ou=users,ou=Internal,o=company
2012-10-05 14:38:27,626 [qtp14301726-26] DEBUG org.springframework.security.ldap.DefaultSpringSecurityContextSource - Removing pooling flag for user uid=dolbert,ou=users,ou=Internal,o=company
2012-10-05 14:38:28,157 [qtp14301726-26] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Getting authorities for user uid=dolbert,ou=users,ou=Internal,o=company
2012-10-05 14:38:28,157 [qtp14301726-26] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Searching for roles for user 'dolbert', DN = 'uid=dolbert,ou=users,ou=Internal,o=company', with filter (uniqueMember={0}) in search base ''
2012-10-05 14:38:28,158 [qtp14301726-26] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Using filter: (uniqueMember=uid=dolbert,ou=users,ou=Internal,o=company)
2012-10-05 14:38:28,274 [qtp14301726-26] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Roles from search: [EP_ESS_01_A_MUS]

My spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
	   		http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
			http://www.springframework.org/schema/security 
			http://www.springframework.org/schema/security/spring-security-3.0.xsd">


	<security:http auto-config="true"
		access-denied-page="/flows/login/accessDenied.xhtml" create-session="never">
		<security:http-basic />
		<security:intercept-url pattern="/flows/admin/**"
			access="ROLE_ADMIN" />
		<security:intercept-url pattern="/flows/csrHandler/**"
			access="ROLE_USER" />
		<security:intercept-url pattern="/*"
			access="IS_AUTHENTICATED_ANONYMOUSLY" />

		<security:form-login login-processing-url="/j_spring_security_check"
			login-page="/flows/login/login.xhtml" default-target-url="/flows/index.xhtml"
			authentication-failure-url="/flows/login/login.xhtml?error='true'"
			always-use-default-target='true' />
		<security:logout logout-url="/flows/logout/logout.xhtml"
			logout-success-url="/" />

	</security:http>
	<bean id="customUserContextMapper" class="com.company.boat.login.service.CustomUserDetailsMapper" />
	<security:authentication-manager>
		<security:ldap-authentication-provider
			user-search-base="ou=users,ou=Internal,o=company"
			user-search-filter="(uid={0})" user-context-mapper-ref="customUserContextMapper" />

	</security:authentication-manager>
	<security:ldap-server url="ldap://ecd.company.se"
		manager-dn="uid=Uname,ou=Users,ou=Internal,o=company"
		manager-password="PWD" />
</beans>

I am using spring security 3.0.5.RELEASE

I tried adding to the spring-security.xml in the

<security:http

create-session="never"

and

<security:http-basic />

but the error is still there.

Any ideas?

Thanks in advance!

[voidance]

Maybe an admin can move the thread to spring-security.

I am back with this error as it is one of the last issues to sort out.

I tried updating to spring-security 3.1.3.RELEASE, spring to 3.0.6.RELEASE but the error is still there. Now at least I have a stack trace.

First login attempt with error:

2012-12-07 10:44:29,598 [qtp6825008-24] DEBUG org.springframework.security.ldap.DefaultSpringSecurityContextSource - Removing pooling flag for user uid=efedrep,ou=users,ou=Internal,o=company
2012-12-07 10:44:30,006 [qtp6825008-24] DEBUG org.springframework.security.ldap.authentication.BindAuthenticator - Retrieving attributes...
2012-12-07 10:44:30,192 [qtp6825008-24] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Getting authorities for user uid=efedrep,ou=users,ou=Internal,o=company
2012-12-07 10:44:30,192 [qtp6825008-24] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Searching for roles for user 'efedrep', DN = 'uid=efedrep,ou=users,ou=Internal,o=company', with filter (uniqueMember={0}) in search base ''
2012-12-07 10:44:30,193 [qtp6825008-24] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Using filter: (uniqueMember=uid=efedrep,ou=users,ou=Internal,o=company)
2012-12-07 10:44:30,200 [qtp6825008-24] INFO  org.springframework.ldap.core.LdapTemplate - The returnObjFlag of supplied SearchControls is not set but a ContextMapper is used - setting flag to true
2012-12-07 10:44:30,358 [qtp6825008-24] DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2012-12-07 10:44:30,359 [qtp6825008-24] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed
2012-12-07 10:44:30.359:WARN:oejs.ServletHandler:/boat2/j_spring_security_check
org.springframework.ldap.AuthenticationException: [LDAP: error code 32 - No Such Object]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 32 - No Such Object]
	at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:182)
	at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:266)
	at org.springframework.ldap.core.support.AbstractContextSource.getContext(AbstractContextSource.java:106)
	at org.springframework.ldap.core.support.AbstractContextSource.getReadOnlyContext(AbstractContextSource.java:125)
	at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:287)
	at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:259)
	at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:606)
	at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:524)
	at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleAttributeValues(SpringSecurityLdapTemplate.java:173)
	at org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGroupMembershipRoles(DefaultLdapAuthoritiesPopulator.java:215)
	at org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGrantedAuthorities(DefaultLdapAuthoritiesPopulator.java:185)
	at org.springframework.security.ldap.authentication.LdapAuthenticationProvider.loadUserAuthorities(LdapAuthenticationProvider.java:197)
	at org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:63)
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174)
	at 
...
Caused by: 
javax.naming.AuthenticationException: [LDAP: error code 32 - No Such Object]
	at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:290)
	at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)
	at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:316)

Second attempt goes fine:

2012-12-06 17:09:52,845 [qtp17518647-22] DEBUG org.springframework.security.ldap.DefaultSpringSecurityContextSource - Removing pooling flag for user uid=efedrep,ou=users,ou=Internal,o=company
2012-12-06 17:09:53,251 [qtp17518647-22] DEBUG org.springframework.security.ldap.authentication.BindAuthenticator - Retrieving attributes...
2012-12-06 17:09:53,341 [qtp17518647-22] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Getting authorities for user uid=efedrep,ou=users,ou=Internal,o=company
2012-12-06 17:09:53,342 [qtp17518647-22] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Searching for roles for user 'efedrep', DN = 'uid=efedrep,ou=users,ou=Internal,o=company', with filter (uniqueMember={0}) in search base ''
2012-12-06 17:09:53,342 [qtp17518647-22] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Using filter: (uniqueMember=uid=efedrep,ou=users,ou=Internal,o=company)
2012-12-06 17:09:53,343 [qtp17518647-22] INFO  org.springframework.ldap.core.LdapTemplate - The returnObjFlag of supplied SearchControls is not set but a ContextMapper is used - setting flag to true
2012-12-06 17:09:53,465 [qtp17518647-22] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Roles from search: [EP_ESS_01_A_MUS]
2012-12-06 17:09:53,469 [qtp17518647-22] DEBUG org.springframework.security.ldap.userdetails.LdapUserDetailsMapper - Mapping user details from context with DN: uid=efedrep,ou=users,ou=Internal,o=company

Haven't modified much of the spring security but here it is:

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
	xsi:schemaLocation="
           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">


	<security:http create-session="never" auto-config="false">

		<security:intercept-url pattern="/spring/main/**" access="ROLE_ADMIN, ROLE_MANAGER, ROLE_TEAMLEADER" />
		<security:access-denied-handler error-page="/spring/denied" /> 
	
		<security:form-login authentication-failure-url="/spring/login?login_error=1" default-target-url="/spring/main"
			login-processing-url="/j_spring_security_check" login-page="/spring/login" />
		<security:logout logout-success-url="/spring/logoutSuccess" logout-url="/spring/logout" />
		<security:http-basic />
	</security:http>


	<bean class="com.company.boat.login.service.CustomUserDetailsMapper" id="customUserContextMapper" />
	
	<security:authentication-manager>
		<security:ldap-authentication-provider user-context-mapper-ref="customUserContextMapper" user-dn-pattern="uid={0},ou=users,ou=Internal,o=company" />
	</security:authentication-manager>


	<security:ldap-server manager-password="PWD" manager-dn="uid=Uname,ou=Users,ou=Internal,o=company" url="ldap://egd.company.es" />
</beans>

What it catches my attention is why the first time logs

org.springframework.security.web.context.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
org.springframework.security.web.context.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed

and the second one

org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Roles from search: [EP_ESS_01_A_MUS]
org.springframework.security.ldap.userdetails.LdapUserDetailsMapper - Mapping user details from context with DN: uid=efedrep,ou=users,ou=Internal,o=company

Any help would be very appreciated!

[voidance]

I quit trying to make it work so created a CustomLdapAuthenticatorProvider that extends AbstractUserDetailsAuthenticatorProvider and authenticates over the ldap server

	<bean class="com.company.boat.login.service.CustomLdapAuthenticationProvider" id="customLdapAuthenticationProvider" />


	<security:authentication-manager>
		<security:authentication-provider ref="customLdapAuthenticationProvider"/>
	</security:authentication-manager>

public class CustomLdapAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

	@Override
	protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
			throws AuthenticationException {
		final Hashtable<String, String> env = new Hashtable<String, String>();
		env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
		env.put(Context.PROVIDER_URL, props.getProperty("ldap.server", "ldap://ldap.server"));
		String ldapPrincipal = props.getProperty("ldap.principal", "uid={0},ou=users,ou=internal,o=company");
		env.put(Context.SECURITY_PRINCIPAL, MessageFormat.format(ldapPrincipal, username));
		env.put(Context.SECURITY_CREDENTIALS, (String)authentication.getCredentials());
		try {
			new InitialLdapContext(env, null).close();
               .... (if no exception is thrown search for authorities and add them) ...