I have a working proof-of-concept application which can successfully authenticate against Active Directory via LDAP on a test server, but the production application will have to do so over TLS -- the domain controller closes any connection which does not initiate via TLS.

I have installed the LDAP browser in Eclipse, and I can indeed bind as myself using TLS in *it*, but I cannot for the life of me figure out how to get my application to use TLS.

**ldap.xml**:

```
<bean id="ldapAuthenticationProvider"
        class="my.project.package.OverrideActiveDirectoryLdapAuthenticationProvider">

    <!-- this works to authenticate by binding as the user in question -->
    <constructor-arg value="test.server"/>
    <constructor-arg value="ldap://192.168.0.2:389"/>

    <!-- this doesn't work, because the server requires a TLS connection -->
    <!-- <constructor-arg value="production.server"/> -->
    <!-- <constructor-arg value="ldaps://192.168.0.3:389"/> -->

    <property name="convertSubErrorCodesToExceptions" value="true"/>
</bean>

```

`OverrideActiveDirectoryLdapAuthenticationProvider` is an override class which extends a copy of Spring's `ActiveDirectoryLdapAuthenticationProvider` class, which is for some reason designated `final`. My reasons for overriding have to do with customizing the way permissions/authorities are populated on the user object (we will either use group membership of relevant groups to build the user's permissions, or we will read from a field on the AD user object). In it, I'm only overriding the `loadUserAuthorities()` method, but I suspect I may also need to override the `bindAsUser()` method or possibly the `doAuthentication()` method.

The XML and one override class are the only two places where authentication is being managed by my application as opposed to letting Spring do the work. I've read several places that to enable TLS I need to extend the `DefaultTlsDirContextAuthenticationStrategy` class, but where do I wire it in? Is there a namespace solution? Do I need to do something else entirely (i.e. abandon the use of Spring's `ActiveDirectoryLdapAuthenticationProvider` and instead use `LdapAuthenticationProvider`)?

Any help is appreciated.