title: Handling roles when authenticated to active directory with spring security 3.1
body: <p>I'm trying to use a authenticate with an Active directory using Spring Security 3.1.
  I get authenticated and all is well. </p>
  
  <pre><code>&lt;sec:ldap-server id="ldapServer" url="ldap://ldap/dc=sub,dc=domain,dc=com" port="389" /&gt;
  
  &lt;sec:authentication-manager erase-credentials="true"  &gt;
      &lt;sec:authentication-provider ref="ldapActiveDirectoryAuthProvider" /&gt;
  &lt;/sec:authentication-manager&gt;
  
  &lt;bean id="ldapActiveDirectoryAuthProvider" 
          class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider"&gt;
      &lt;constructor-arg value="domain" /&gt;
      &lt;constructor-arg value="ldap://server:389/"/&gt; 
  &lt;/bean&gt;
  </code></pre>
  
  <p>Now to the question. How do I handle roles for the user so that I can setup my filters?</p>
  
  <p>eg.</p>
  
  <pre><code>&lt;sec:intercept-url pattern="/**" access="ROLE_USER"/&gt;
  </code></pre>
  
  <h2>Solution</h2>
  
  <p>I found out how to do this by using the UserDetailContextMapper and map my AD groups to ROLE_USER,ROLE_ADMIN etc. </p>
  
  <pre><code>    &lt;bean id="ldapActiveDirectoryAuthProvider" 
          class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider"&gt;
      &lt;constructor-arg value="domain" /&gt;
      &lt;constructor-arg value="ldap://host:389/"/&gt; 
      &lt;property name="userDetailsContextMapper" ref="tdrUserDetailsContextMapper"/&gt;
      &lt;property name="useAuthenticationRequestCredentials" value="true"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="tdrUserDetailsContextMapper" class="com.bla.bla.UserDetailsContextMapperImpl"/&gt;
  </code></pre>
  
  <p>Mapper class:</p>
  
  <pre><code>public class UserDetailsContextMapperImpl implements UserDetailsContextMapper, Serializable{
      private static final long serialVersionUID = 3962976258168853954L;
  
      @Override
      public UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection&lt;? extends GrantedAuthority&gt; authority) {
  
          List&lt;GrantedAuthority&gt; mappedAuthorities = new ArrayList&lt;GrantedAuthority&gt;();
  
  
          for (GrantedAuthority granted : authority) {
  
              if (granted.getAuthority().equalsIgnoreCase("MY USER GROUP")) {
                  mappedAuthorities.add(new GrantedAuthority(){
                      private static final long serialVersionUID = 4356967414267942910L;
  
                      @Override
                      public String getAuthority() {
                          return "ROLE_USER";
                      } 
  
                  });
              } else if(granted.getAuthority().equalsIgnoreCase("MY ADMIN GROUP")) {
                  mappedAuthorities.add(new GrantedAuthority() {
                      private static final long serialVersionUID = -5167156646226168080L;
  
                      @Override
                      public String getAuthority() {
                          return "ROLE_ADMIN";
                      }
                  });
              }
          }
          return new User(username, "", true, true, true, true, mappedAuthorities);
      }
  
      @Override
      public void mapUserToContext(UserDetails arg0, DirContextAdapter arg1) {
      }
  }
  </code></pre>