How to assign roles based on group name when a user login in Spring security
<p>I am trying to assign roles to the user who successfully login to a Spring web app. I am using LDAP authentication to do this. </p>

<p>My <strong>WebSecurityConfig.java</strong></p>

<pre><code>package com.logsniffer.web.util;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider;
import org.springframework.context.annotation.Bean;
import org.apache.log4j.Logger;
import org.springframework.security.core.Authentication;
import org.springframework.core.env.Environment;
import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
import org.springframework.security.core.context.SecurityContextHolder;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    Environment env;

    @Autowired
    public void registerGlobalAuthentication(AuthenticationManagerBuilder auth)
            throws Exception
    {
        if ("h2".equals(env.getProperty("spring.profiles.active")))
            return;

        DefaultSpringSecurityContextSource context = new DefaultSpringSecurityContextSource("ldap://10.100.7.99:389/dc=ldap,dc=com");
        context.afterPropertiesSet();

        auth.ldapAuthentication()
                .contextSource(context)
                .userSearchFilter("uid={0}")
                .userSearchBase("ou=support")
       //         .groupSearchBase("ou=support")
       //         .groupSearchFilter(String groupSearchFilter)
                .groupRoleAttribute("cn")
                .rolePrefix("");


    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
 //               .antMatchers("/", "/home").permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .permitAll();
         }
}
</code></pre>

<p>Maybe I am understanding this wrong. I thought using</p>

<pre><code>.groupRoleAttribute("cn")
</code></pre>

<p>sets the user role. But when I try to print the user authorities like,</p>

<pre><code>Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
String r= authentication.getAuthorities().toString();
log.info("$$$$$$$$$$ " + r);
</code></pre>

<p>I get an empty string. My LDAP tree has the following configuration</p>

<pre><code>+--&gt; dc=ldap,dc=com (1+)
---&gt; cn=admin
---&gt; ou=hr
+--&gt; ou=support (1+)
| +--&gt; cn=admin (2)
| | ---&gt; cn=kaushan deva
| | ---&gt; cn=sameera ramasinghe
| | ---&gt; Create new entry here
| +--&gt; cn=regular (1)
| | ---&gt; cn=chamitha abe
</code></pre>

<p>I am prettry sure in <code>registerGlobalAuthentication</code> method, the way I'm trying to authenticate users is wrong. That is why I cannot set group role attributes. But I cannot find the error since I am very new to this.</p>

<p>What I want to do is to set user roles to each user who logs in, based on his group (<code>admin</code> or <code>regular</code>). </p>