title: Authentication using Spring Security and JBoss 7.2
body: <p>I am looking for a way to authenticate my users against Active Directory in a Spring Security web application, running on JBoss 7.2.</p>
  
  <p>Following <a href="http://www.mkyong.com/spring-security/get-current-logged-in-username-in-spring-security/" rel="nofollow">that link</a>, I always get "anonymousUser", but would like to see my own username instead. It seems that Spring Security uses anonymous authentication when the primary authentication strategy does not work.</p>
  
  <p>Here is my setup:</p>
  
  <ul>
  <li>Spring 4.0.6</li>
  <li>Spring Security 3.2.4</li>
  </ul>
  
  <p><strong>SecurityConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      public void registerGlobalAuthentication(AuthenticationManagerBuilder auth) throws Exception {
  
          DefaultSpringSecurityContextSource context = new DefaultSpringSecurityContextSource("ldap://my_ldap_server:389");
          context.setUserDn("MY_SERVICE_ACCOUNT_DISTINGUISHED_NAME");
          context.setPassword("MY_SERVICE_ACCOUNT_PASSWORD");
          context.afterPropertiesSet();
  
          auth
              .ldapAuthentication()
              .contextSource(context)
              .userDnPatterns("(sAMAccountName={0})")
              .rolePrefix("");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          /*
          http
              .authorizeRequests()
              .anyRequest().authenticated();
          */
      }
  }
  </code></pre>
  
  <p>If I uncomment the configure(HttpSecurity http) method body, I got the 403 Access Denied page, which means (I guess) I am not authenticated.</p>
  
  <p><strong>LoginController.java</strong></p>
  
  <pre><code>@Controller
  public class LoginController {
  
          @RequestMapping(value = "/login", method = RequestMethod.GET)
          public String login() {
  
              Authentication auth = SecurityContextHolder.getContext().getAuthentication();
              String strRemoteUser = auth.getName();
  
              System.out.println("[SPRING4BASE] Welcome " + strRemoteUser);
  
              return "welcome";
          }
  }
  </code></pre>
  
  <p><strong>jboss-web.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;!DOCTYPE policy PUBLIC 
      "-//JBoss//DTD JBOSS Security Config 3.0//EN" 
      "http://www.jboss.org/j2ee/dtd/security_config.dtd"&gt;
  
  &lt;jboss-web&gt;
      &lt;security-domain&gt;java:/jaas/other&lt;/security-domain&gt;
  &lt;/jboss-web&gt;
  </code></pre>
  
  <p><strong>JBoss security domain definition (standalone.xml):</strong></p>
  
  <pre><code>&lt;subsystem xmlns="urn:jboss:domain:security:1.2"&gt;
      &lt;security-domains&gt;
          &lt;security-domain name="other" cache-type="default"&gt;
              &lt;authentication&gt;
                  &lt;login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required"&gt;
                      &lt;module-option name="java.naming.provider.url" value="ldap://my_ldap_server:389"/&gt;
                      &lt;module-option name="java.naming.security.authentication" value="simple"/&gt;
                      &lt;module-option name="java.naming.referral" value="follow"/&gt;
                      &lt;module-option name="bindDN" value="MY_SERVICE_ACCOUNT_DISTINGUISHED_NAME"/&gt;
                      &lt;module-option name="bindCredential" value="MY_SERVICE_ACCOUNT_PASSWORD"/&gt;
                      &lt;module-option name="baseCtxDN" value="MY_BASE_LDAP_CONTEXT"/&gt;
                      &lt;module-option name="baseFilter" value="(sAMAccountName={0})"/&gt;
                      &lt;module-option name="rolesCtxDN" value="MY_BASE_LDAP_CONTEXT"/&gt;
                      &lt;module-option name="roleFilter" value="(member={1})"/&gt;
                      &lt;module-option name="roleAttributeID" value="CN"/&gt;
                      &lt;module-option name="searchScope" value="SUBTREE_SCOPE"/&gt;
                      &lt;module-option name="allowEmptyPasswords" value="false"/&gt;
                  &lt;/login-module&gt;
              &lt;/authentication&gt;
          &lt;/security-domain&gt;
      &lt;/security-domains&gt;
  &lt;/subsystem&gt;
  </code></pre>
  
  <p>Finally, my requirement is that if the current user has an active session on my organization's network, he must have access to the application. Then, the application security strategy handles the authorization.</p>
  
  <p>Your help is much appreciated.</p>