title: Spring project using CAS for Authentication and LDAP for Authorities
body: <p>I had a Spring 3 project that was using LDAP for Authentication and Authorities. We know changed the project to use CAS for authentication but still work like to use LDAP for Authorities.  can someone please look at this XML file and tell me how to get LDAP Authorities back and working</p>
  
  <pre><code>  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;b:beans xmlns:b="http://www.springframework.org/schema/beans"
      xmlns="http://www.springframework.org/schema/security" xmlns:p="http://www.springframework.org/schema/p"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
      xmlns:util="http://www.springframework.org/schema/util"
      xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
          http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
          http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd"&gt;
  
      &lt;http entry-point-ref="casEntryPoint" use-expressions="true"&gt;
          &lt;intercept-url pattern="/" access="permitAll" /&gt;
  
          &lt;intercept-url pattern="/index.jsp" access="permitAll" /&gt;
          &lt;intercept-url pattern="/cas-logout.jsp" access="permitAll" /&gt;
          &lt;intercept-url pattern="/casfailed.jsp" access="permitAll" /&gt;
  
          &lt;intercept-url pattern="/secure/**" access="hasRole('ROLE_USER')" /&gt;
          &lt;intercept-url pattern="/requests/**" access="hasRole('ROLE_MEMBER_INQUIRY')" /&gt;
  
          &lt;custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER" /&gt;
          &lt;custom-filter ref="singleLogoutFilter" before="CAS_FILTER" /&gt;
          &lt;custom-filter ref="casFilter" position="CAS_FILTER" /&gt;
  
  
          &lt;logout logout-success-url="/cas-logout.jsp" /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager alias="authManager"&gt;
          &lt;authentication-provider ref="casAuthProvider" /&gt;
      &lt;/authentication-manager&gt;
  
  
       &lt;user-service id="userService"&gt;
          &lt;user name="rod" password="rod" authorities="ROLE_SUPERVISOR,ROLE_USER" /&gt;
          &lt;user name="cpilling04@aol.com.dev" password="testing"
              authorities="ROLE_MEMBER_INQUIRY" /&gt;
      &lt;/user-service&gt;
  
      &lt;!-- This filter handles a Single Logout Request from the CAS Server --&gt;
      &lt;b:bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter" /&gt;
      &lt;!-- This filter redirects to the CAS Server to signal Single Logout should 
          be performed --&gt;
      &lt;b:bean id="requestSingleLogoutFilter"
          class="org.springframework.security.web.authentication.logout.LogoutFilter"
          p:filterProcessesUrl="/j_spring_cas_security_logout"&gt;
          &lt;b:constructor-arg
              value="https://${cas.server.host}/cas-server-webapp/logout" /&gt;
          &lt;b:constructor-arg&gt;
              &lt;b:bean
                  class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" /&gt;
          &lt;/b:constructor-arg&gt;
      &lt;/b:bean&gt;
  
      &lt;b:bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties"
          p:service="https://${cas.service.host}/MemberInquiry/j_spring_cas_security_check"
          p:authenticateAllArtifacts="true" /&gt;
  
      &lt;b:bean id="casEntryPoint"
          class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"
          p:serviceProperties-ref="serviceProperties"
          p:loginUrl="https://${cas.server.host}/cas-server-webapp/login" /&gt;
  
      &lt;b:bean id="casFilter"
          class="org.springframework.security.cas.web.CasAuthenticationFilter"
          p:authenticationManager-ref="authManager" p:serviceProperties-ref="serviceProperties"
          p:proxyGrantingTicketStorage-ref="pgtStorage"
          p:proxyReceptorUrl="/j_spring_cas_security_proxyreceptor"&gt;
          &lt;b:property name="authenticationDetailsSource"&gt;
              &lt;b:bean
                  class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource" /&gt;
          &lt;/b:property&gt;
  
          &lt;b:property name="authenticationFailureHandler"&gt;
              &lt;b:bean
                  class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
                  p:defaultFailureUrl="/casfailed.jsp" /&gt;
          &lt;/b:property&gt;
  
  
          &lt;b:property name="authenticationSuccessHandler"&gt;
              &lt;b:bean
                  class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"
                  p:defaultTargetUrl="/requests/add.html" /&gt;
          &lt;/b:property&gt;
      &lt;/b:bean&gt;
      &lt;!-- NOTE: In a real application you should not use an in memory implementation. 
          You will also want to ensure to clean up expired tickets by calling ProxyGrantingTicketStorage.cleanup() --&gt;
      &lt;b:bean id="pgtStorage"
          class="org.jasig.cas.client.proxy.ProxyGrantingTicketStorageImpl" /&gt;
      &lt;b:bean id="casAuthProvider"
          class="org.springframework.security.cas.authentication.CasAuthenticationProvider"
          p:serviceProperties-ref="serviceProperties" p:key="casAuthProviderKey"&gt;
          &lt;b:property name="authenticationUserDetailsService"&gt;
              &lt;b:bean
                  class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"&gt;
                  &lt;b:constructor-arg ref="userService" /&gt;
              &lt;/b:bean&gt;
          &lt;/b:property&gt;
          &lt;b:property name="ticketValidator"&gt;
              &lt;b:bean class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator"
                  p:acceptAnyProxy="true"
                  p:proxyCallbackUrl="https://${cas.service.host}/MemberInquiry/j_spring_cas_security_proxyreceptor"
                  p:proxyGrantingTicketStorage-ref="pgtStorage"&gt;
                  &lt;b:constructor-arg value="https://${cas.server.host}/cas-server-webapp" /&gt;
              &lt;/b:bean&gt;
          &lt;/b:property&gt;
          &lt;b:property name="statelessTicketCache"&gt;
              &lt;b:bean
                  class="org.springframework.security.cas.authentication.EhCacheBasedTicketCache"&gt;
                  &lt;b:property name="cache"&gt;
                      &lt;b:bean class="net.sf.ehcache.Cache" init-method="initialise"
                          destroy-method="dispose"&gt;
                          &lt;b:constructor-arg value="casTickets" /&gt;
                          &lt;b:constructor-arg value="50" /&gt;
                          &lt;b:constructor-arg value="true" /&gt;
                          &lt;b:constructor-arg value="false" /&gt;
                          &lt;b:constructor-arg value="3600" /&gt;
                          &lt;b:constructor-arg value="900" /&gt;
                      &lt;/b:bean&gt;
                  &lt;/b:property&gt;
              &lt;/b:bean&gt;
          &lt;/b:property&gt;
      &lt;/b:bean&gt;
  
      &lt;!-- Configuration for the environment can be overriden by system properties --&gt;
      &lt;context:property-placeholder
          system-properties-mode="OVERRIDE" properties-ref="environment" /&gt;
  
      &lt;util:properties id="environment"&gt;
          &lt;b:prop key="cas.service.host"&gt;wcmisdlin07.uftmasterad.org:8443&lt;/b:prop&gt;
          &lt;b:prop key="cas.server.host"&gt;wcmisdlin07.uftmasterad.org:8443&lt;/b:prop&gt;
      &lt;/util:properties&gt;
  
  
      &lt;b:bean id="contextSource"
          class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"&gt;
  
          &lt;b:constructor-arg
              value="ldaps://dvldap01.uftwf.dev:636/dc=uftwf,dc=dev" /&gt;
  
          &lt;b:property name="userDn" value="cn=Manager,dc=uftwf,dc=dev" /&gt;
  
          &lt;b:property name="password" value="uftwf" /&gt;
      &lt;/b:bean&gt;
  
          &lt;b:bean id="ldapAuthProvider"
          class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider"&gt;
  
          &lt;b:constructor-arg&gt;
  
              &lt;b:bean
                  class="org.springframework.security.ldap.authentication.BindAuthenticator"&gt;
                  &lt;b:constructor-arg ref="contextSource" /&gt;
                  &lt;b:property name="userDnPatterns"&gt;
                      &lt;b:list&gt;
                          &lt;b:value&gt;
                              uid={0},ou=webusers
                          &lt;/b:value&gt;
                      &lt;/b:list&gt;
                  &lt;/b:property&gt;
              &lt;/b:bean&gt;
          &lt;/b:constructor-arg&gt;
          &lt;b:constructor-arg&gt;
              &lt;b:bean
                  class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"&gt;
                  &lt;b:constructor-arg ref="contextSource" /&gt;
                  &lt;b:constructor-arg value="ou=groups" /&gt;
                  &lt;b:property name="groupRoleAttribute" value="ou" /&gt;
              &lt;/b:bean&gt;
          &lt;/b:constructor-arg&gt;
      &lt;/b:bean&gt;
      &lt;ldap-server url="ldaps://dvldap01.uftwf.dev:636/dc=uftwf,dc=dev" /&gt;
  
  
  
  
  &lt;/b:beans&gt;
  </code></pre>