Spring security ldap baseDN - spring-security

Question

I'm trying to configure the baseDN on my Spring ldap context source, but it keeps throwing an exception:
the config is as follows:
<beans:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<beans:constructor-arg index="0" value="${ldap_server}"/>
<beans:constructor-arg index="1" value="${ldap_searchbase}"/>
</beans:bean>
my ldap_searchbase has a space in it, and I've looked at the Spring code: that causes the issue:
public DefaultSpringSecurityContextSource(String providerUrl) {
Assert.hasLength(providerUrl, "An LDAP connection URL must be supplied.");
StringTokenizer st = new StringTokenizer(providerUrl);
ArrayList<String> urls = new ArrayList<String>();
// Work out rootDn from the first URL and check that the other URLs (if any) match
while (st.hasMoreTokens()) {
String url = st.nextToken();
String urlRootDn = LdapUtils.parseRootDnFromUrl(url);
urls.add(url.substring(0, url.lastIndexOf(urlRootDn)));
logger.info(" URL '" + url + "', root DN is '" + urlRootDn + "'");
if (rootDn == null) {
rootDn = urlRootDn;
} else if (!rootDn.equals(urlRootDn)) {
throw new IllegalArgumentException("Root DNs must be the same when using multiple URLs");
}
}
I get the "Root DNs must be the same when using multiple URLs" error, and I notice that the String tokenizer tokens by whitespace, so it's chomping my baseDN and making it into a seperate LDAP server URL. What gives? What am I doing wrong here?
I get the same issue (obviously) if I configure as such:
<beans:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<beans:constructor-arg index="0" value="${ldap_server}/${ldap_searchbase}"/>
</beans:bean>

Answer 1

DefaultSpringSecurityContextSource was written in a way that it cannot handle spaces as it self.
This was first reported as a bug in ISSUE-2264.
But as per the comments of the bug, it seems this was a known issue and solution suggest to use an escape character(i.e. %20)
More examples of LDAP URL can be found in : Section-3
Therefore when you define your LDAP DNs do as below:
Real URL:
ldap://ldap.itd.umich.edu/o=University of Michigan,c=US
Corrected URL to be used for DefaultSpringSecurityContextSource Parameter:
ldap://ldap.itd.umich.edu/o=University%20of%20Michigan,c=US

Answer 2

Alright - so I haven't figured out how I can provide a search base to the security context source, but by doing this:
<beans:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<beans:constructor-arg index="0" value="${ldap_server}"/>
</beans:bean>
and:
<beans:bean id="ldapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
<beans:constructor-arg index="0" value="${ldap_searchbase}"/>
<beans:constructor-arg index="1" value="${ldap_auth_search_filter}"/>
<beans:constructor-arg index="2" ref="contextSource" />
</beans:bean>
it works.