title: Combining Spring Security and Active Directory with JWT-Tokens
body: <p>I am currently working on building an Angular2-Application accessing a Spring Boot backend server for authentication and editing database data via REST-APIs. My current basic configuration to authenticate against our Active Directory looks like this:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests().anyRequest().authenticated().and().formLogin();
  }
  
  @Override
  protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
      authManagerBuilder.authenticationProvider(activeDirectoryLdapAuthenticationProvider()).userDetailsService(userDetailsService());
  }
  
  @Bean
  public AuthenticationManager authenticationManager() {
      return new ProviderManager(Arrays.asList(activeDirectoryLdapAuthenticationProvider()));
  }
  @Bean
  public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
      ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider(AD_DOMAIN, "ldap://" + AD_URL);
      provider.setConvertSubErrorCodesToExceptions(true);
      provider.setUseAuthenticationRequestCredentials(true);
  
      return provider;
  }
  </code></pre>
  
  <p>This works so that I can access the basic Spring Boot Actuator-APIs after logging in using the default Boot Login Form.  </p>
  
  <p>The next step would be intertwining the activeDirectoryLdapAuthenticationProvider with a token-based authentication solution that can be accessed by Angular2 - for that, i found <a href="https://github.com/RedFroggy/angular-spring-hmac" rel="nofollow noreferrer">an example repository on gitHub</a>. It implements HMAC-based authentication using JWT tokens with a custom service structure.</p>
  
  <p>My issue now comes in understanding how the components of Spring Security work together in the background. As i understand the example, it implements a customised version of UserDetailsService and its environment using the UserDTO and LoginDTO. These access a MockUser-Service for example user data - which is what I want to avoid, instead accessing our Active Directory to authenticate users.  </p>
  
  <p>I am still digging through the repository trying to understand every customised class implementation and if I can customise the AuthenticationService to fit my needs, but I feel relatively lost.<br>
  What I am looking for are experiences in combining these three components, or with Spring Security and how exactly the default UserDetailsService and AuthenticationProviders interact, so I can try and fit the ActiveDirectory-logic into the token solution.</p>
  
  <p>Alternatively, is there a way to combine the default-LDAP/AD-Configuration with a <a href="https://stackoverflow.com/questions/42257585/spring-security-with-jwt">default JWT-Solution such as this</a>?</p>