Hotfix3960ActiveDirectoryLdapAuthenticationProvider is not configurable to allow nested groups

[christopherfrieler]

Hi,

in our setup we want to use nested LDAP-groups, but the Hotfix3960ActiveDirectoryLdapAuthenticationProvider reads only the direct memberships from the users memberOf-attribute. For the regular LdapAuthenticationProvider and its LdapAuthoritiesPopulator it is possible to configure the group-filter to read nested groups.

Is there a reason, why the Hotfix3960ActiveDirectoryLdapAuthenticationProvider cannot use the LdapAuthenticationProvider as well, but has its own logic implemented in loadUserAuthorities()? Or could this be a possible enhancement?

[christopherfrieler]

I just had a closer look. Nested groups has been an open issue for years: spring-projects/spring-security#2053. The regular ActiveDirectoryLdapAuthenticationProvider does not offer this, so it's not a limitation only of the Hotfix3960ActiveDirectoryLdapAuthenticationProvider.

[bierchitekt]

Hotfix3960ActiveDirectoryLdapAuthenticationProvider is now removed from the code.