Updates to ref docs

docs/src/reference/asciidoc/appendix.adoc

@@ -197,6 +197,15 @@ Entry for principal HTTP/neo.example.org@EXAMPLE.ORG with kvno 2, encryption typ
 
 This was tested using `Windows Server 2012 R2`
 
+[TIP]
+====
+Internet is full of good articles and videos how to setup Windows AD
+but these two are quite usefull
+http://www.rackspace.com/knowledge_center/article/installing-active-directory-on-windows-server-2012[Rackspace] and
+http://social.technet.microsoft.com/wiki/contents/articles/12370.windows-server-2012-set-up-your-first-domain-controller-step-by-step.aspx[Microsoft
+Technet].
+====
+
 - Normal domain controller and active directory setup was done.
 - Used dns domain `example.org` and windows domain `EXAMPLE`.
 - I created various domain users like `user1`, `user2`, `user3`,

docs/src/reference/asciidoc/samples.adoc

@@ -2,19 +2,14 @@
 = Spring Security Kerberos Samples
 
 This part of the reference documentation is introducing samples
-projects. Generally samples can be either compiled manually by
-building main distribution from
-https://github.com/spring-projects/spring-security-kerberos or using
-nightly snapshots or actual release builds.
-
-- http://repo.spring.io/libs-snapshot/org/springframework/security/kerberos/
-- http://repo.spring.io/libs-release/org/springframework/security/kerberos/
+projects. Samples can be compiled manually by building main
+distribution from
+https://github.com/spring-projects/spring-security-kerberos.
 
 [IMPORTANT]
 ====
-If you download and run sample from a maven repo it will not work
-until a correct configuration is applied. See notes below for specific
-samples.
+If you run sample as is it will not work until a correct configuration
+is applied. See notes below for specific samples.
 ====
 
 <<samples-sec-server-win-auth>> sample for Windows environment
@@ -49,6 +44,8 @@ server:
         ad-server: ldap://WIN-EKBO0EQ7TS7.example.org/
         service-principal: HTTP/neo.example.org@EXAMPLE.ORG
         keytab-location: /tmp/tomcat.keytab
+        ldap-search-base: dc=example,dc=org
+        ldap-search-filter: "(| (userPrincipalName={0}) (sAMAccountName={0}))"
 ----
 In above you can see the default configuration for this sample. You
 can override these settings using a normal Spring Boot tricks like

docs/src/reference/asciidoc/ssk.adoc

@@ -73,3 +73,26 @@ With keytab file.
 include::samples/KerberosRestTemplateConfig.java[tags=snippetB]
 ----
 
+[[ssk-kerberosldap]]
+== Authentication with LDAP Services
+
+With most of your samples we're using `DummyUserDetailsService`
+because there is not necessarily need to query a real user details
+once kerberos authentication is successful and we can use kerberos
+principal info to create that dummy user. However there is a way to
+access kerberized LDAP services in a say way and query user details
+from there.
+
+`KerberosLdapContextSource` can be used to bind into LDAP via kerberos
+which is at least proven to work well with Windows AD services.
+
+[source,java,indent=0]
+----
+include::samples/KerberosLdapContextSourceConfig.java[tags=snippetA]
+----
+
+[TIP]
+====
+Sample <<samples-sec-server-win-auth>> is currently configured to
+query user details from AD if authentication happen via kerberos.
+====

spring-security-kerberos-client/src/test/java/org/springframework/security/kerberos/client/docs/KerberosLdapContextSourceConfig.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.kerberos.client.docs;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.security.kerberos.client.KerberosLdapContextSource;
+import org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig;
+import org.springframework.security.ldap.search.FilterBasedLdapUserSearch;
+import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper;
+import org.springframework.security.ldap.userdetails.LdapUserDetailsService;
+
+public class KerberosLdapContextSourceConfig {
+
+//tag::snippetA[]
+	@Value("${app.ad-server}")
+	private String adServer;
+
+	@Value("${app.service-principal}")
+	private String servicePrincipal;
+
+	@Value("${app.keytab-location}")
+	private String keytabLocation;
+
+	@Value("${app.ldap-search-base}")
+	private String ldapSearchBase;
+
+	@Value("${app.ldap-search-filter}")
+	private String ldapSearchFilter;
+
+	@Bean
+	public KerberosLdapContextSource kerberosLdapContextSource() {
+		KerberosLdapContextSource contextSource = new KerberosLdapContextSource(adServer);
+		SunJaasKrb5LoginConfig loginConfig = new SunJaasKrb5LoginConfig();
+		loginConfig.setKeyTabLocation(new FileSystemResource(keytabLocation));
+		loginConfig.setServicePrincipal(servicePrincipal);
+		loginConfig.setDebug(true);
+		loginConfig.setIsInitiator(true);
+		contextSource.setLoginConfig(loginConfig);
+		return contextSource;
+	}
+
+	@Bean
+	public LdapUserDetailsService ldapUserDetailsService() {
+		FilterBasedLdapUserSearch userSearch =
+				new FilterBasedLdapUserSearch(ldapSearchBase, ldapSearchFilter, kerberosLdapContextSource());
+		LdapUserDetailsService service = new LdapUserDetailsService(userSearch);
+		service.setUserDetailsMapper(new LdapUserDetailsMapper());
+		return service;
+	}
+//end::snippetA[]
+
+}