What You Will Learn

• What LDAP is and where it is used.
• How bind authentication works.
• How users and groups are stored in a directory.
• How Spring Security integrates with LDAP.
• Production considerations for enterprise login.

Introduction

LDAP stands for Lightweight Directory Access Protocol.

Enterprises use LDAP-compatible directories to store identities, groups, departments, and authentication data.

Common directory systems include:

• Microsoft Active Directory.
• OpenLDAP.
• Apache Directory Server.

LDAP Directory Concepts

Term	Meaning
DN	Distinguished Name, unique path to an entry
OU	Organizational Unit
CN	Common Name
Bind	Login operation against LDAP
Group	Collection of users used for authorization

Authentication Flow

sequenceDiagram
    participant User
    participant App as Spring Boot App
    participant LDAP
    User->>App: Username and password
    App->>LDAP: Bind or user lookup
    LDAP-->>App: Authentication result
    App->>LDAP: Load groups
    LDAP-->>App: Groups
    App-->>User: Authenticated session or token

Spring Security LDAP Setup

Typical dependencies:

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-ldap</artifactId>
</dependency>

Example configuration:

@Bean
AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
    LdapBindAuthenticationManagerFactory factory =
            new LdapBindAuthenticationManagerFactory(contextSource);
    factory.setUserDnPatterns("uid={0},ou=people");
    return factory.createAuthenticationManager();
}

Group to Role Mapping

LDAP groups often become application authorities.

Example:

cn=app-admins,ou=groups,dc=example,dc=com -> ROLE_ADMIN
cn=app-users,ou=groups,dc=example,dc=com -> ROLE_USER

Production Checklist

• Use LDAPS or StartTLS.
• Do not log passwords or bind credentials.
• Use a read-only service account for lookup.
• Map groups carefully to application roles.
• Handle directory outages with clear errors.
• Monitor failed bind attempts.

Summary

LDAP is common in enterprise authentication. Spring Security can authenticate users against LDAP and map directory groups to application roles.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: CORS and CSRF Protection in Spring Boot
• Next: SAML SSO Integration in Java Applications