title: Spring Boot LDAP authentication over Tomcat (Pre-Authentication)
body: <p>I'm creating a Spring Boot application, which should be accessible only to users in LDAP. This application should be deployed to a Tomcat server (not an embedded server). The configuration for the LDAP is done in Tomcat itself:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;Realm className="org.apache.catalina.realm.LockOutRealm"&gt;
      &lt;Realm className="org.apache.catalina.realm.UserDatabaseRealm"
          resourceName="UserDatabase"/&gt;
      &lt;Realm className="org.apache.catalina.realm.JNDIRealm"
          connectionURL="ldap://someldapserver:389"
          userPattern="uid={0},dc=example,dc=com"
          roleBase="dc=example,dc=com"
          roleName="cn"
          roleSearch="(uniqueMember={0})"/&gt;
  &lt;/Realm&gt;
  </code></pre>
  
  <p>If I try to access the Tomcat Manager, I can authenticate with LDAP credentials, so the connection basically works.</p>
  
  <p>This is my configuration:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers("/test").permitAll()
                  .anyRequest().authenticated()
                  .and()
              .formLogin().permitAll()
                  .and()
              .logout().permitAll()
                  .and()
              .csrf().disable();
      }
  }
  </code></pre>
  
  <p>I know I could configure the LDAP connection directly in the application (<code>authenticationManagerBuilder.ldapAuthentication()...</code>), but this is not what I want.</p>
  
  <p>How can I tell Spring Boot to use the LDAP authentication from Tomcat for the application?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>It looks like I have to enable <a href="http://docs.spring.io/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#preauth" rel="nofollow noreferrer">Pre-Authentication</a>. This can be done with <code>.and().jee().mappableRoles("ROLE_ADMIN")</code>. This seems to work, but I still can't authenticate: <code>No pre-authenticated principal found in request</code>.</p>
  
  <p>Do I have to add something to Tomcats configuration?</p>