title: Spring LDAP Context.REFERRAL to follow
body: <p>How do I set the LDAP Context.REFERRAL to follow in a Spring Security configuration? This is related to a problem I already reported and for which I found an unsatisfactory solution before discovering the real solution I am seeking for involve setting this environment attribute in the LDAP context to follow the referral for the ActiveDirectoryLdapAuthenticationProvider.</p>
  
  <p>Here is the reference to my original question: <a href="https://stackoverflow.com/questions/29658844/spring-security-4-0-0-activedirectoryldapauthenticationprovider-badcredentia">Spring Security 4.0.0 + ActiveDirectoryLdapAuthenticationProvider + BadCredentialsException PartialResultException</a></p>
  
  <p><strong>Addendum:</strong> It seems no one is having such an environment here. Despite the silence on this problem, I post here my configuration hoping someone will be able to help me with this. I just don't know what I should do to solve this problem.</p>
  
  <p>Here are the error messages in my log:</p>
  
  <pre><code>2015-06-15 10:32:19,810 DEBUG (o.s.s.w.FilterChainProxy$VirtualFilterChain.doFilter) [http-8443-1] /identite.proc at position 7 of 13 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
  2015-06-15 10:32:19,810 DEBUG (o.s.s.w.u.m.AntPathRequestMatcher.matches) [http-8443-1] Checking match of request : '/identite.proc'; against '/identite.proc'
  2015-06-15 10:32:19,810 DEBUG (o.s.s.w.a.AbstractAuthenticationProcessingFilter.doFilter) [http-8443-1] Request is to process authentication
  2015-06-15 10:32:19,811 DEBUG (o.s.s.a.ProviderManager.authenticate) [http-8443-1] Authentication attempt using org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider
  2015-06-15 10:32:19,811 DEBUG (o.s.s.l.a.AbstractLdapAuthenticationProvider.authenticate) [http-8443-1] Processing authentication request for user: myusername
  2015-06-15 10:32:19,841 DEBUG (o.s.s.l.SpringSecurityLdapTemplate.searchForSingleEntryInternal) [http-8443-1] Searching for entry under DN '', base = 'dc=dept,dc=company,dc=com', filter = '(&amp;(userPrincipalName={0})(objectClass=user)(objectCategory=inetOrgPerson))'
  2015-06-15 10:32:19,842 DEBUG (o.s.s.w.a.AbstractAuthenticationProcessingFilter.unsuccessfulAuthentication) [http-8443-1] Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
  2015-06-15 10:32:19,842 DEBUG (o.s.s.w.a.AbstractAuthenticationProcessingFilter.unsuccessfulAuthentication) [http-8443-1] Updated SecurityContextHolder to contain null Authentication
  2015-06-15 10:32:19,842 DEBUG (o.s.s.w.a.AbstractAuthenticationProcessingFilter.unsuccessfulAuthentication) [http-8443-1] Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@a5d7f2
  </code></pre>
  
  <p>And here is the configuration:</p>
  
  <pre><code>&lt;b:bean id="monFournisseurAD" class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider"&gt;
      &lt;b:constructor-arg value="dept.company.com" /&gt;
      &lt;b:constructor-arg value="ldap://dept.company.com:3268/" /&gt;
      &lt;b:constructor-arg value="dc=dept,dc=company,dc=com" /&gt;
      &lt;b:property name="searchFilter" value="(&amp;amp;(userPrincipalName={0})(objectClass=user)(objectCategory=inetOrgPerson))" /&gt;
      &lt;b:property name="userDetailsContextMapper"&gt;
          &lt;b:bean class="org.springframework.security.ldap.userdetails.InetOrgPersonContextMapper" /&gt;
      &lt;/b:property&gt;
      &lt;b:property name="authoritiesMapper" ref="grantedAuthoritiesMapper" /&gt;
      &lt;b:property name="convertSubErrorCodesToExceptions" value="true" /&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"&gt;
      &lt;b:constructor-arg value="ldap://dept.company.com:3268/dc=dept,dc=company,dc=com" /&gt;
      &lt;b:property name="baseEnvironmentProperties"&gt;
          &lt;b:map&gt;
              &lt;b:entry key="java.naming.referral" value="follow" /&gt;
          &lt;/b:map&gt;
      &lt;/b:property&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="ldapTemplate" class="org.springframework.ldap.core.LdapTemplate"&gt;
      &lt;b:constructor-arg ref="contextSource" /&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter" /&gt;
  &lt;b:bean id="myDeconnexionHandler" class="com.company.dept.web.my.DeconnexionHandler" /&gt;
  </code></pre>
  
  <p>The two beans with ids contextSource and ldapTemplate seems not to change anything. I was trying to get the referral follow behavior. It seems not the right way to configure it. Also, here the port in the ldap URL is set to 3268 because it is the general catalog and someone in another description elsewhere suggested to use it. But, the results are exactly the same with port 389.</p>
  
  <p>If I change the first constructor argument in the bean monFournisseurAD to set it to a single userPrincipalName domain, it will work for all users into that domain. While I can actually authenticate anyone from the command line using ldapsearch command using dept.company.com instead of the userPrincipalName domain associated directly to the user. In fact, if I enter a wrong password, I will get the specific wrong password message. This seems to prove the user is actually authenticated by AD/LDAP, however Spring fails later to fetch the attributes for that user.</p>
  
  <p>How can I solve this problem?</p>