LDAP: error code 34 - Incorrect DN given - spring-security

Question

I am new with active directory and spring security, in fact, I want to change my spring security configuration so that use active directory in authentififcation so I use this in my SecurityConfig:
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(activeDirectoryLdapAuthenticationProvider());
auth.eraseCredentials(false);
}
#Bean
public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
ActiveDirectoryLdapAuthenticationProvider authenticationProvider = new ActiveDirectoryLdapAuthenticationProvider(
"dc=example,dc=com", "ldap://localhost:10389/dc=example,dc=com");
authenticationProvider.setConvertSubErrorCodesToExceptions(true);
authenticationProvider.setUseAuthenticationRequestCredentials(true);
authenticationProvider.setUserDetailsContextMapper(mapper);
return authenticationProvider;
}
and active directory studio I have a partition: dc=example,dc=com which contains an entry ou=people.
When I try to put a username and password I have this error:
javax.naming.InvalidNameException: [LDAP: error code 34 - Incorrect DN given : admin#dc=example,dc=com (0x73 0x79 0x73 0x61 0x64 0x6D 0x69 0x6E 0x40 0x64 0x63 0x3D 0x70 0x75 0x70 0x70 0x75 0x74 0x2C 0x64 0x63 0x3D 0x63 0x6F 0x6D ) is invalid]
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3076)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2883)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2797)..
Have you any idea please?

Answer 1

ActiveDirectoryLdapAuthenticationProvider is intended to let you authenticate with usernames in the AD-specific form user#example.com, which are not standard LDAP DN format. As such, the first argument in the constructor should be the domain (example.com) not an LDAP DN. When you log in as admin, the code uses the configured domain to build the string admin#example.com and passes that to AD.
Since you are using dc=example,dc=com as the domain name, you end up with admin#dc=example,dc=com which is invalid.