I am trying to gather user permissions from Active Directory in my Spring 4.0.6 application, using Spring Security 3.2.4.

Some details:

• Authentication works. I can get the current username.
• Pre-authentication is done by JBoss 7.2 using JCIFS (NTLM).
• LDAP server works, so host and port are correct.
• Domain is correct.

SecurityConfig.java

@Configuration
@EnableWebMvcSecurity
@PropertySource( "classpath:/resources/ldap-config.properties" )
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value( "${domain}" )
    private String strDomain;

    @Value( "${ldap.host}" )
    private String strHost;

    @Value( "${ldap.basedn}" )
    private String strBaseDn;

    @Value( "${ldap.userdn}" )
    private String strUserDn;

    @Value( "${ldap.userdn.password}" )
    private String strUserDnPassword;

    @Bean
    public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
        return new PropertySourcesPlaceholderConfigurer();
    }

    @Bean 
    public ActiveDirectoryGrantedAuthoritiesMapper grantedAuthoritiesMapper() {
        return new ActiveDirectoryGrantedAuthoritiesMapper();
    }

    @Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {

        ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new ActiveDirectoryLdapAuthenticationProvider(strDomain, strHost);
        activeDirectoryLdapAuthenticationProvider.setUseAuthenticationRequestCredentials(true);
        activeDirectoryLdapAuthenticationProvider.setConvertSubErrorCodesToExceptions(true);

        activeDirectoryLdapAuthenticationProvider.setAuthoritiesMapper(this.grantedAuthoritiesMapper());

        return activeDirectoryLdapAuthenticationProvider;
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {

        authenticationManagerBuilder
        .authenticationProvider(this.activeDirectoryLdapAuthenticationProvider());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
            .jee();
    }
}

ActiveDirectoryGrantedAuthoritiesMapper.java

public class ActiveDirectoryGrantedAuthoritiesMapper implements GrantedAuthoritiesMapper {

    // Constants for group defined in LDAP
    private final String ROLE_ADMIN = "A_SPECIFIC_ADMIN_GROUP_IN_AD";
    private final String ROLE_USER = "A_SPECIFIC_GROUP_IN_AD";

    public ActiveDirectoryGrantedAuthoritiesMapper() {
    }

    @Override
    public Collection mapAuthorities(final Collection authorities) {

        Set roles = EnumSet.noneOf(SecurityContextAuthority.class);

        for (GrantedAuthority authority : authorities) {

            System.out.println("GrantedAuthority : " + authority.getAuthority());

            if (ROLE_ADMIN.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_ADMIN);
            }

            if (ROLE_USER.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_USER);
            }
        }

        return roles;
    }

}

SecurityContextAuthority.java

public enum SecurityContextAuthority implements GrantedAuthority {

    ROLE_ADMIN, ROLE_USER;

    @Override
    public String getAuthority() {
        return name();
    }
}

What I got in my console:

2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) MY_DOMAIN\MY_USERNAME
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Authorities: []
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Auth Type: NTLM
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Is Authenticated: true

With debugging turned on, I got the follow extra details:

2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Checking secure context token: null
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) PreAuthenticated J2EE principal: MY_DOMAIN\MY_USERNAME
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) preAuthenticatedPrincipal = MY_DOMAIN\MY_USERNAME, trying to authenticate
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource] (http-localhost/127.0.0.1:8080-1) J2EE roles [[]] mapped to Granted Authorities: [[]]
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.authentication.ProviderManager] (http-localhost/127.0.0.1:8080-1) Authentication attempt using org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider] (http-localhost/127.0.0.1:8080-1) PreAuthenticated authentication request: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f99efc97: Principal: MY_DOMAIN\MY_USERNAME; Credentials: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Authentication success: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@661034c: Principal: org.springframework.security.core.userdetails.User@f99c56bc: Username: MY_DOMAIN\MY_USERNAME; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Not granted any authorities; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities

Other debugging info:

• Authorities are always empty
• mapAuthorities and getAuthority never seem to be invoked. Adding breakpoints does nothing at all.

Any help would be much appreciated.