title: How do I configure Spring Security authentication to deal with a complex Active Directory / LDAP account tree?
body: <p>(Context: I'm an experienced programmer, but new to LDAP, AD and Spring.)</p>
  
  <p>We are a Windows shop, so all of our authentication is done with Active Directory. We are attempting to integrate a third-party product that is written in Java, so it does all of its authentication using Spring Security. So far, so good -- they've done that integration before, and there's a good deal online about how to set things up.</p>
  
  <p>The problem is, our AD setup is a bit complex: in particular, our user accounts exist in various nodes in the AD/LDAP tree. To give a simplified example, say the LDAP tree looks like this:</p>
  
  <pre><code>DC=my-domain,DC=com
  + CN=Users
  ++ CN=user1,CN=Users,DC=my-domain,DC=com
  + CN=Staff
  ++ CN=user2,CN=Staff,DC=my-domain,DC=com
  </code></pre>
  
  <p>The thing is, all of the examples I have found let me authenticate <em>either</em> user1 or user2, but not both. That is, the following XML snippet will work to authenticate user1 against roles defined under "Groups":</p>
  
  <pre><code>&lt;security:ldap-server url="ldap://my-domain.com:389" manager-dn="CN=manager_svc,OU=System Users,DC=my-domain,DC=com" manager-password="MyPa55w0rd"/&gt;
  
  &lt;security:ldap-authentication-provider
            user-dn-pattern=""
            user-search-base="CN=Users,DC=my-domain,DC=com"
            user-search-filter="(&amp;amp;(sAMAccountName={0})(objectclass=user))"
            group-search-base="OU=Groups,DC=mydomain,DC=com"
            group-search-filter="member={0}"
            /&gt;
  </code></pre>
  
  <p>but that won't authenticate user2, since he doesn't match the user-search-base. Contrariwise, I can change user-search-base to <code>CN=Staff,DC=my-domain,DC=com</code>, which will work for user2, but then it won't work for user1.</p>
  
  <p>So the question is, how do I make this search work for user accounts that are scattered across the AD/LDAP tree? I can imagine two possibilities, but I haven't figured out how to do either yet:</p>
  
  <ul>
  <li><p>On the one hand, if I can make user-search-base multi-valued, that solves my problem easily and correctly: I just put in all of the locations where user accounts might be found. So far, all of my attempts to do this have met with one error or another, but I'm still experimenting.</p></li>
  <li><p>OTOH, there is Subtree scoping of the search. I can see in the interactive LDAP tools that search can be either single-level or subtree. Far as I can tell, Spring out of the box is doing single-level. I can see that the underlying FilterBasedLdapUserSearch class has a setSearchSubtree() method, which looks like what I want, but I can't find a way to set that to true from the XML. (For now, let's assume that it isn't feasible to change the underlying Java program.)</p></li>
  </ul>
  
  <p>The first option would be ideal, since it is probably much more efficient, but if that isn't possible and the second is, I suspect we can make it work.</p>
  
  <p>I have a suspicion that the second approach is possible using thorny bean hackery, but I know next to nothing about beans, so I'd rather not wade into those thickets by myself. Does anybody have a good recipe to recommend? </p>
  
  <p>Thanks much for any guidance you can provide...</p>