title: Spring security authentication using active directory failed
body: <p>I've been working on a spring web application project in our company. It used to authenticate users using database, but recently we decided to use our active directory server as a means of authentication party. So, we changed the spring-security.xml to the code below:</p>
  
  <pre><code>&lt;http auto-config="true" entry-point-ref="loginUrlAuthenticationEntryPoint"&gt;
          &lt;intercept-url pattern="/Content/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
          &lt;intercept-url pattern="/Desktop/New_Them/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
          &lt;intercept-url pattern="/App/Index" access="ROLE_USER" /&gt;
          &lt;intercept-url pattern="/App/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
          &lt;intercept-url pattern="/rest/clc/ClcLogPhon/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
          &lt;intercept-url pattern="/**" access="ROLE_USER" /&gt;
          &lt;custom-filter ref="concurrencyFilter" position="CONCURRENT_SESSION_FILTER" /&gt;
          &lt;logout logout-success-url="/App/Login" /&gt;
          &lt;remember-me key="myAppKey" /&gt;
          &lt;session-management
              session-authentication-strategy-ref="sas"&gt;
          &lt;/session-management&gt;
          &lt;csrf /&gt;
          &lt;headers&gt;
              &lt;xss-protection /&gt;
          &lt;/headers&gt;
      &lt;/http&gt;
  &lt;beans:bean id="contextSource"
          class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"&gt;
          &lt;beans:constructor-arg
              value="ldap://192.168.1.199:389/DC=myDomain,DC=org" /&gt;
          &lt;beans:property name="userDn"
              value="CN=myUsername,CN=Users,DC=myDomain,DC=org" /&gt;
          &lt;beans:property name="password" value="myPassword" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="ldapAuthProvider"
          class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider"&gt;
          &lt;beans:constructor-arg&gt;
              &lt;beans:bean
                  class="org.springframework.security.ldap.authentication.BindAuthenticator"&gt;
                  &lt;beans:constructor-arg ref="contextSource" /&gt;
                  &lt;beans:property name="userDnPatterns"&gt;
                      &lt;beans:list&gt;
                          &lt;beans:value&gt;uid={0},ou=users&lt;/beans:value&gt;
                      &lt;/beans:list&gt;
                  &lt;/beans:property&gt;
              &lt;/beans:bean&gt;
          &lt;/beans:constructor-arg&gt;
          &lt;beans:constructor-arg&gt;
              &lt;beans:bean
                  class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"&gt;
                  &lt;beans:constructor-arg ref="contextSource" /&gt;
                  &lt;beans:constructor-arg value="ou=groups" /&gt;
                  &lt;beans:property name="groupRoleAttribute" value="ou" /&gt;
              &lt;/beans:bean&gt;
          &lt;/beans:constructor-arg&gt;
      &lt;/beans:bean&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider ref="ldapAuthProvider"/&gt;
      &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>And the web application starts up well. But when I want to login with users which declared before in the active directory, the error below is occurred:</p>
  
  <pre><code>DEBUG UsernamePasswordAuthenticationFilter - Request is to process authentication
  DEBUG ProviderManager - Authentication attempt using org.springframework.security.ldap.authentication.LdapAuthenticationProvider
  DEBUG LdapAuthenticationProvider - Processing authentication request for user: m.fazel
  DEBUG BindAuthenticator - Attempting to bind as uid=m.fazel,ou=users,dc=myDomain,dc=org
  DEBUG DefaultSpringSecurityContextSource - Removing pooling flag for user uid=m.fazel,ou=users,dc=myDomain,dc=org
  DEBUG BindAuthenticator - Failed to bind as uid=m.fazel,ou=users: org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1];
  DEBUG DefaultListableBeanFactory - Returning cached instance of singleton bean 'sessionRegistry'
  DEBUG DefaultListableBeanFactory - Returning cached instance of singleton bean 'logoutSuccessHandler'
  DEBUG UsernamePasswordAuthenticationFilter - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
  DEBUG UsernamePasswordAuthenticationFilter - Updated SecurityContextHolder to contain null Authentication
  DEBUG UsernamePasswordAuthenticationFilter - Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@560d9ba6
  DEBUG TokenBasedRememberMeServices - Interactive login attempt was unsuccessful.
  DEBUG TokenBasedRememberMeServices - Cancelling cookie
  DEBUG SimpleUrlAuthenticationFailureHandler - Redirecting to /spring_security_login?login_error
  DEBUG DefaultRedirectStrategy - Redirecting to '/hafizApps/spring_security_login?login_error'
  </code></pre>
  
  <p>As you can see debug result above, it caused due to Ldap error:</p>
  
  <pre><code>LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1
  </code></pre>
  
  <p>However, I have already connected to the server with <a href="http://jxplorer.org/" rel="nofollow noreferrer">JXplorer</a>. There is no alternative error in ldap connection settings. And also the test user which I trying to connect with (i.e. m.fazel), is already declared in ldap as you can see in the figure below:</p>
  
  <p><a href="https://i.stack.imgur.com/5XKIG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/5XKIG.png" alt="JXplorer: ldap users"></a></p>
  
  <p><strong>After @jeemster edit:</strong></p>
  
  <p>However, uid was exactly what was written in <a href="http://docs.spring.io/spring-security/site/docs/3.1.x/reference/ldap.html" rel="nofollow noreferrer">spring security ldap authentication</a>.I change the spring-security.xml just like jeemster said and put cn={0},ou=test instead of uid={0},ou=users. The bean with id="ldapAuthProvider" is changed to the bean demonstrated below:</p>
  
  <pre><code>&lt;beans:bean id="ldapAuthProvider"
          class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider"&gt;
          &lt;beans:constructor-arg&gt;
              &lt;beans:bean
                  class="org.springframework.security.ldap.authentication.BindAuthenticator"&gt;
                  &lt;beans:constructor-arg ref="contextSource" /&gt;
                  &lt;beans:property name="userDnPatterns"&gt;
                      &lt;beans:list&gt;
                          &lt;beans:value&gt;CN={0},OU=test&lt;/beans:value&gt;
                      &lt;/beans:list&gt;
                  &lt;/beans:property&gt;
              &lt;/beans:bean&gt;
          &lt;/beans:constructor-arg&gt;
          &lt;beans:constructor-arg&gt;
              &lt;beans:bean
                  class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"&gt;
                  &lt;beans:constructor-arg ref="contextSource" /&gt;
                  &lt;beans:constructor-arg value="ou=groups" /&gt;
                  &lt;beans:property name="groupRoleAttribute" value="ou" /&gt;
              &lt;/beans:bean&gt;
          &lt;/beans:constructor-arg&gt;
      &lt;/beans:bean&gt;
  </code></pre>
  
  <p>Also, I create a new user in the test group and named it alialavi. The new user which created in the ldap was shown in the figure below.</p>
  
  <p><a href="https://i.stack.imgur.com/w88SH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/w88SH.png" alt="enter image description here"></a></p>
  
  <p>As demonstrated in the above figure that capture from JXplorer, the distinguished name for the new user is:</p>
  
  <pre><code>cn=alialavi,ou=test,dc=hafiz-co,dc=org
  </code></pre>
  
  <p>But after the web application starts up, I see this error again in login page:</p>
  
  <pre><code>DEBUG UsernamePasswordAuthenticationFilter - Request is to process authentication
  DEBUG ProviderManager - Authentication attempt using org.springframework.security.ldap.authentication.LdapAuthenticationProvider
  DEBUG LdapAuthenticationProvider - Processing authentication request for user: alialavi
  DEBUG BindAuthenticator - Attempting to bind as cn=alialavi,ou=test,dc=hafiz-co,dc=org
  DEBUG DefaultSpringSecurityContextSource - Removing pooling flag for user cn=alialavi,ou=test,dc=hafiz-co,dc=org
  DEBUG BindAuthenticator - Failed to bind as CN=alialavi,OU=test: org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]
  DEBUG UsernamePasswordAuthenticationFilter - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
  DEBUG UsernamePasswordAuthenticationFilter - Updated SecurityContextHolder to contain null Authentication
  DEBUG UsernamePasswordAuthenticationFilter - Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@4481f947
  DEBUG TokenBasedRememberMeServices - Interactive login attempt was unsuccessful.
  </code></pre>
  
  <p>Again it caused error with the new distinguishedName:</p>
  
  <pre><code>cn=alialavi,ou=test,dc=hafiz-co,dc=org
  </code></pre>
  
  <p>Although both distinguishedName is the same, the error occurred.</p>