How to get Spring Boot Actuator LdapHealthIndicator running with Ldap from Spring Security?

Question

I'm developing a spring boot 2.3 application using spring security. Authentication and authorization is done via spring security against an AD. So I'm using spring-security-ldap and the following code.

public class SecurityConfiguration extends WebSecurityConfigurerAdapter  {
...
    public AuthenticationProvider adAuthenticationProvider() {

        ActiveDirectoryLdapAuthenticationProvider adProvider =
            new ActiveDirectoryLdapAuthenticationProvider(ldapDomain, ldapUrl);
        adProvider.setSearchFilter(ldapSearchFilter);

        adProvider.setAuthoritiesMapper(authorities -> {
            Collection<GrantedAuthority> gaCollection = new ArrayList<>();
            for (GrantedAuthority authority : authorities) {
                if ("admin".equals(authority.getAuthority())) {
                    gaCollection.add(new SimpleGrantedAuthority(Role.ADMIN));
                }
            }
            return gaCollection;
        });
        return adProvider;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.authenticationProvider(adAuthenticationProvider());
        auth.eraseCredentials(false);
    }

}

The relevant dependencies should be this:

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
...
    </dependencyManagement>

    <dependencies>
        <!-- Spring -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-autoconfigure</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>org.apache.tomcat</groupId>
                    <artifactId>tomcat-juli</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.tomcat</groupId>
                    <artifactId>tomcat-jdbc</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-ldap</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- End Spring -->
...
    </dependencies>

This works fine.

Now I decided to use Spring Boot Actuators via spring-boot-starter-actuator dependency for application monitoring.

Via auto config it detects the actuator for my data source and the LdapHealthIndicator. While datasource is ok, the LdapHealthIndicator always reports the following error.

CONDITIONS EVALUATION REPORT (only LDAP lines)

positive matches:
   LdapAutoConfiguration matched:
      - @ConditionalOnClass found required class 'org.springframework.ldap.core.ContextSource' (OnClassCondition)

   LdapAutoConfiguration#ldapContextSource matched:
      - @ConditionalOnMissingBean (types: org.springframework.ldap.core.support.LdapContextSource; SearchStrategy: all) did not find any beans (OnBeanCondition)

   LdapAutoConfiguration#ldapTemplate matched:
      - @ConditionalOnMissingBean (types: org.springframework.ldap.core.LdapOperations; SearchStrategy: all) did not find any beans (OnBeanCondition)

   LdapHealthContributorAutoConfiguration matched:
      - @ConditionalOnClass found required class 'org.springframework.ldap.core.LdapOperations' (OnClassCondition)
      - @ConditionalOnEnabledHealthIndicator management.health.ldap.enabled is true (OnEnabledHealthIndicatorCondition)
      - @ConditionalOnBean (types: org.springframework.ldap.core.LdapOperations; SearchStrategy: all) found bean 'ldapTemplate' (OnBeanCondition)

   LdapHealthContributorAutoConfiguration#ldapHealthContributor matched:
      - @ConditionalOnMissingBean (names: ldapHealthIndicator,ldapHealthContributor; SearchStrategy: all) did not find any beans (OnBeanCondition)

negative matches:
   EmbeddedLdapAutoConfiguration:
      Did not match:
         - @ConditionalOnClass did not find required class 'com.unboundid.ldap.listener.InMemoryDirectoryServer' (OnClassCondition)

   LdapRepositoriesAutoConfiguration:
      Did not match:
         - @ConditionalOnClass did not find required class 'org.springframework.data.ldap.repository.LdapRepository' (OnClassCondition)

o.s.b.actuate.ldap.LdapHealthIndicator   : LDAP health check failed
org.springframework.ldap.CommunicationException: localhost:389; nested exception is 
javax.naming.CommunicationException: localhost:389 
[Root exception is java.net.ConnectException: Connection refused: connect]

My AD is running on a remote server and not localhost. Spring security is working fine.

So why does the LdapHealthIndicator try to validate ldap server on localhost? What is the designed way to let LdapHealthIndicator use my AuthenticationProvider from my SecurityConfiguration?

Answer 1

There could possibly be other issues; however, the primary problem appears to be that you are missing the spring-ldap-core dependency from your pom:

<dependency>
    <groupId>org.springframework.ldap</groupId>
    <artifactId>spring-ldap-core</artifactId>
</dependency>

Including this will place it on the classpath. In combination with the correct properties, Spring Boot's LDAP auto-configuration will engage.

Also, the reference docs state that the property is spring.ldap.urls, so I believe it should be changed to that instead.