How do you authenticate against an Active Directory server using Spring Security?

<beans:bean id="ldapAuthProvider" class="org.springframework.security.providers.ldap.LdapAuthenticationProvider">
    <beans:constructor-arg>
      <beans:bean class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">
        <beans:constructor-arg ref="initialDirContextFactory" />
        <beans:property name="userDnPatterns">
          <beans:list>
            <beans:value>CN={0},OU=SBSUsers,OU=Users,OU=MyBusiness,DC=Acme,DC=com</beans:value>
          </beans:list>
        </beans:property>
      </beans:bean>
    </beans:constructor-arg>
  </beans:bean>

  <beans:bean id="userDetailsService" class="org.springframework.security.userdetails.ldap.LdapUserDetailsManager">
    <beans:constructor-arg ref="initialDirContextFactory" />
  </beans:bean>

  <beans:bean id="initialDirContextFactory" class="org.springframework.security.ldap.DefaultInitialDirContextFactory">
    <beans:constructor-arg value="ldap://192.168.123.456:389/DC=Acme,DC=com" />
  </beans:bean>

<beans:bean id="contextSource"
	class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
	<beans:constructor-arg value="ldap://hostname.queso.com:389/" />
</beans:bean>

<beans:bean id="ldapAuthenticationProvider"
	class="org.queso.ad.service.authentication.LdapAuthenticationProvider">
	<beans:property name="authenticator" ref="ldapAuthenticator" />
	<custom-authentication-provider />
</beans:bean>

<beans:bean id="ldapAuthenticator"
	class="org.queso.ad.service.authentication.LdapAuthenticatorImpl">
	<beans:property name="contextFactory" ref="contextSource" />
	<beans:property name="principalPrefix" value="QUESO" />
</beans:bean>

/**
 * Custom Spring Security authentication provider which tries to bind to an LDAP server with
 * the passed-in credentials; of note, when used with the custom {@link LdapAuthenticatorImpl},
 * does <strong>not</strong> require an LDAP username and password for initial binding.
 *
 * @author Jason
 */
public class LdapAuthenticationProvider implements AuthenticationProvider {

	private LdapAuthenticator authenticator;

	public Authentication authenticate(Authentication auth) throws AuthenticationException {

		// Authenticate, using the passed-in credentials.
		DirContextOperations authAdapter = authenticator.authenticate(auth);

		// Creating an LdapAuthenticationToken (rather than using the existing Authentication
		// object) allows us to add the already-created LDAP context for our app to use later.
		LdapAuthenticationToken ldapAuth = new LdapAuthenticationToken(auth, "ROLE_USER");
		InitialLdapContext ldapContext = (InitialLdapContext) authAdapter
				.getObjectAttribute("ldapContext");
		if (ldapContext != null) {
			ldapAuth.setContext(ldapContext);
		}

		return ldapAuth;
	}

	public boolean supports(Class clazz) {
		return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(clazz));
	}

	public LdapAuthenticator getAuthenticator() {
		return authenticator;
	}

	public void setAuthenticator(LdapAuthenticator authenticator) {
		this.authenticator = authenticator;
	}

}

/**
 * Custom Spring Security LDAP authenticator which tries to bind to an LDAP server using the
 * passed-in credentials; does <strong>not</strong> require "master" credentials for an
 * initial bind prior to searching for the passed-in username.
 *
 * @author Jason
 */
public class LdapAuthenticatorImpl implements LdapAuthenticator {

	private DefaultSpringSecurityContextSource contextFactory;
	private String principalPrefix = "";

	public DirContextOperations authenticate(Authentication authentication) {

		// Grab the username and password out of the authentication object.
		String principal = principalPrefix + authentication.getName();
		String password = "";
		if (authentication.getCredentials() != null) {
			password = authentication.getCredentials().toString();
		}

		// If we have a valid username and password, try to authenticate.
		if (!("".equals(principal.trim())) && !("".equals(password.trim()))) {
			InitialLdapContext ldapContext = (InitialLdapContext) contextFactory
					.getReadWriteContext(principal, password);

			// We need to pass the context back out, so that the auth provider can add it to the
			// Authentication object.
			DirContextOperations authAdapter = new DirContextAdapter();
			authAdapter.addAttributeValue("ldapContext", ldapContext);

			return authAdapter;
		} else {
			throw new BadCredentialsException("Blank username and/or password!");
		}
	}

	/**
	 * Since the InitialLdapContext that's stored as a property of an LdapAuthenticationToken is
	 * transient (because it isn't Serializable), we need some way to recreate the
	 * InitialLdapContext if it's null (e.g., if the LdapAuthenticationToken has been serialized
	 * and deserialized). This is that mechanism.
	 *
	 * @param authenticator
	 *          the LdapAuthenticator instance from your application's context
	 * @param auth
	 *          the LdapAuthenticationToken in which to recreate the InitialLdapContext
	 * @return
	 */
	static public InitialLdapContext recreateLdapContext(LdapAuthenticator authenticator,
			LdapAuthenticationToken auth) {
		DirContextOperations authAdapter = authenticator.authenticate(auth);
		InitialLdapContext context = (InitialLdapContext) authAdapter
				.getObjectAttribute("ldapContext");
		auth.setContext(context);
		return context;
	}

	public DefaultSpringSecurityContextSource getContextFactory() {
		return contextFactory;
	}

	/**
	 * Set the context factory to use for generating a new LDAP context.
	 *
	 * @param contextFactory
	 */
	public void setContextFactory(DefaultSpringSecurityContextSource contextFactory) {
		this.contextFactory = contextFactory;
	}

	public String getPrincipalPrefix() {
		return principalPrefix;
	}

	/**
	 * Set the string to be prepended to all principal names prior to attempting authentication
	 * against the LDAP server.  (For example, if the Active Directory wants the domain-name-plus
	 * backslash prepended, use this.)
	 *
	 * @param principalPrefix
	 */
	public void setPrincipalPrefix(String principalPrefix) {
		if (principalPrefix != null) {
			this.principalPrefix = principalPrefix;
		} else {
			this.principalPrefix = "";
		}
	}

}

/**
 * <p>
 * Authentication token to use when an app needs further access to the LDAP context used to
 * authenticate the user.
 * </p>
 *
 * <p>
 * When this is the Authentication object stored in the Spring Security context, an application
 * can retrieve the current LDAP context thusly:
 * </p>
 *
 * <pre>
 * LdapAuthenticationToken ldapAuth = (LdapAuthenticationToken) SecurityContextHolder
 * 		.getContext().getAuthentication();
 * InitialLdapContext ldapContext = ldapAuth.getContext();
 * </pre>
 *
 * @author Jason
 *
 */
public class LdapAuthenticationToken extends AbstractAuthenticationToken {

	private static final long serialVersionUID = -5040340622950665401L;

	private Authentication auth;
	transient private InitialLdapContext context;
	private List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

	/**
	 * Construct a new LdapAuthenticationToken, using an existing Authentication object and
	 * granting all users a default authority.
	 *
	 * @param auth
	 * @param defaultAuthority
	 */
	public LdapAuthenticationToken(Authentication auth, GrantedAuthority defaultAuthority) {
		this.auth = auth;
		if (auth.getAuthorities() != null) {
			this.authorities.addAll(Arrays.asList(auth.getAuthorities()));
		}
		if (defaultAuthority != null) {
			this.authorities.add(defaultAuthority);
		}
		super.setAuthenticated(true);
	}

	/**
	 * Construct a new LdapAuthenticationToken, using an existing Authentication object and
	 * granting all users a default authority.
	 *
	 * @param auth
	 * @param defaultAuthority
	 */
	public LdapAuthenticationToken(Authentication auth, String defaultAuthority) {
		this(auth, new GrantedAuthorityImpl(defaultAuthority));
	}

	public GrantedAuthority[] getAuthorities() {
		GrantedAuthority[] authoritiesArray = this.authorities.toArray(new GrantedAuthority[0]);
		return authoritiesArray;
	}

	public void addAuthority(GrantedAuthority authority) {
		this.authorities.add(authority);
	}

	public Object getCredentials() {
		return auth.getCredentials();
	}

	public Object getPrincipal() {
		return auth.getPrincipal();
	}

	/**
	 * Retrieve the LDAP context attached to this user's authentication object.
	 *
	 * @return the LDAP context
	 */
	public InitialLdapContext getContext() {
		return context;
	}

	/**
	 * Attach an LDAP context to this user's authentication object.
	 *
	 * @param context
	 *          the LDAP context
	 */
	public void setContext(InitialLdapContext context) {
		this.context = context;
	}

}