CAS LDAP Configuration for Active Directory

deployerConfigContext.xml

<bean id="ldapAuthenticationHandler"
      class="org.jasig.cas.authentication.LdapAuthenticationHandler"
      p:principalIdAttribute="sAMAccountName"
      c:authenticator-ref="authenticator">
  <property name="principalAttributeMap">
      <map>
          <!--
             | This map provides a simple attribute resolution mechanism.
             | Keys are LDAP attribute names, values are CAS attribute names.
             | Use this facility instead of a PrincipalResolver if LDAP is
             | the only attribute source.
             --> 
          <entry key="displayName" value="displayName" />
          <entry key="mail" value="mail" />
          <entry key="memberOf" value="memberOf" />
      </map>
  </property>
</bean>

<bean id="authenticator" class="org.ldaptive.auth.Authenticator"
      c:resolver-ref="dnResolver"
      c:handler-ref="authHandler" />

<bean id="dnResolver"
      class="org.ldaptive.auth.FormatDnResolver"
      c:format="${ldap.authn.format}" />

<bean id="authHandler" class="org.ldaptive.auth.PooledBindAuthenticationHandler"
      p:connectionFactory-ref="pooledLdapConnectionFactory" />

<bean id="pooledLdapConnectionFactory"
      class="org.ldaptive.pool.PooledConnectionFactory"
      p:connectionPool-ref="connectionPool" />

<bean id="connectionPool"
      class="org.ldaptive.pool.BlockingConnectionPool"
      init-method="initialize"
      p:poolConfig-ref="ldapPoolConfig"
      p:blockWaitTime="${ldap.pool.blockWaitTime}"
      p:validator-ref="searchValidator"
      p:pruneStrategy-ref="pruneStrategy"
      p:connectionFactory-ref="connectionFactory" />

<bean id="ldapPoolConfig" class="org.ldaptive.pool.PoolConfig"
      p:minPoolSize="${ldap.pool.minSize}"
      p:maxPoolSize="${ldap.pool.maxSize}"
      p:validateOnCheckOut="${ldap.pool.validateOnCheckout}"
      p:validatePeriodically="${ldap.pool.validatePeriodically}"
      p:validatePeriod="${ldap.pool.validatePeriod}" />

<bean id="connectionFactory" class="org.ldaptive.DefaultConnectionFactory"
      p:connectionConfig-ref="connectionConfig" />

<bean id="connectionConfig" class="org.ldaptive.ConnectionConfig"
      p:ldapUrl="${ldap.url}"
      p:connectTimeout="${ldap.connectTimeout}"
      p:useStartTLS="${ldap.useStartTLS}"
      p:connectionInitializer-ref="fastBindConnectionInitializer" />

<bean id="fastBindConnectionInitializer"
      class="org.ldaptive.ad.extended.FastBindOperation.FastBindConnectionInitializer" />

<bean id="pruneStrategy" class="org.ldaptive.pool.IdlePruneStrategy"
      p:prunePeriod="${ldap.pool.prunePeriod}"
      p:idleTime="${ldap.pool.idleTime}" />

<bean id="searchValidator" class="org.ldaptive.pool.SearchValidator" />

p:connectionFactory="connectionFactory" />

should be

p:connectionFactory-ref="connectionFactory" />

You're going to add a connection pool here?

Typo noted, thanks. Not planning on a pool since we discussed that pooling might be unnecessary or even detrimental due to the way Fast Bind multiplexes authentications on a single connection.

Open to suggestions, of course.

Typo fixed in example and decided to use connection pooling based on private discussion w/@dfish3r:

Daniel:
i now believe you want a pool for the fastbind stuff
Daniel:
not much point in closing and reopening a connection with fastbind
it's meant to be reused
Marvin Addison:
Ok, makes sense.