Introduction

Spring Security can authenticate users against LDAP and still provide "remember me" login persistence through a cookie. The important point is that these are different concerns: LDAP verifies the user's identity, while remember-me stores enough information to restore authentication on later requests.

LDAP And Remember-Me Solve Different Problems

LDAP answers:

• who is the user
• are the credentials valid
• what groups or roles should be loaded

Remember-me answers:

• should the browser stay signed in across sessions
• can Spring recreate authentication from a trusted cookie

That means enabling remember-me does not replace LDAP. It sits on top of the normal authentication process.

A Typical Spring Security Configuration

With modern Spring Security, the usual setup is a SecurityFilterChain bean.

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.Customizer;
4import org.springframework.security.config.annotation.web.builders.HttpSecurity;
5import org.springframework.security.core.userdetails.UserDetailsService;
6import org.springframework.security.web.SecurityFilterChain;
7
8@Configuration
9public class SecurityConfig {
10
11    @Bean
12    SecurityFilterChain securityFilterChain(
13        HttpSecurity http,
14        UserDetailsService userDetailsService
15    ) throws Exception {
16        http
17            .authorizeHttpRequests(auth -> auth
18                .requestMatchers("/login").permitAll()
19                .anyRequest().authenticated()
20            )
21            .formLogin(Customizer.withDefaults())
22            .rememberMe(remember -> remember
23                .key("a-strong-remember-me-key")
24                .tokenValiditySeconds(7 * 24 * 60 * 60)
25                .userDetailsService(userDetailsService)
26            );
27
28        return http.build();
29    }
30}

This shows the remember-me side. The LDAP part still needs an authentication setup that loads users and authorities from the directory.

Configure LDAP Authentication

One common approach is to use an LDAP authentication provider with a context source.

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.ldap.core.support.BaseLdapPathContextSource;
4import org.springframework.security.authentication.AuthenticationManager;
5import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
6import org.springframework.security.ldap.authentication.LdapBindAuthenticationManagerFactory;
7
8@Configuration
9public class LdapConfig {
10
11    @Bean
12    AuthenticationManager ldapAuthenticationManager(
13        BaseLdapPathContextSource contextSource
14    ) {
15        LdapBindAuthenticationManagerFactory factory =
16            new LdapBindAuthenticationManagerFactory(contextSource);
17
18        factory.setUserDnPatterns("uid={0},ou=people");
19        factory.setUserDetailsContextMapper(new org.springframework.security.ldap.userdetails.PersonContextMapper());
20
21        return factory.createAuthenticationManager();
22    }
23}

The exact LDAP setup varies with your directory structure, but the overall flow is stable:

1. user logs in with username and password
2. Spring Security validates against LDAP
3. Spring creates an authenticated session
4. remember-me optionally writes a cookie for future requests

How Remember-Me Works After LDAP Login

Once the user authenticates successfully with LDAP, Spring can write a remember-me cookie if the login form includes the remember-me parameter.

A simple login form field:

<input type="checkbox" name="remember-me" />

On a later visit, Spring reads the cookie and rebuilds the authentication without forcing a fresh username-password login every time.

For that to work correctly, Spring still needs a UserDetailsService or equivalent way to load the user when the remember-me token is presented. That is why remember-me configuration often points to a user-details service even when the initial sign-in came from LDAP.

Token Strategy Matters

Spring supports different remember-me strategies. The hash-based token is simple, but persistent tokens stored in a database are often better for revocation and auditing.

For example, a persistent token repository lets you invalidate tokens server-side rather than depending only on the cookie's integrity.

That matters in enterprise systems using LDAP because the directory may define identity, while the web application still needs its own control over browser persistence and logout behavior.

Security Considerations

Remember-me is a convenience feature, so it carries tradeoffs.

Use it carefully:

• always require HTTPS
• mark cookies secure and HTTP-only
• use a strong remember-me key
• keep the validity window reasonable
• understand that disabling the LDAP password alone may not invalidate a previously issued remember-me cookie unless your design rechecks account state appropriately

That last point is important. Authentication persistence should not silently outlive account policy changes.

Common Pitfalls

The biggest mistake is assuming remember-me authenticates against LDAP by itself. It does not. It only restores authentication after a previous successful login.

Another mistake is enabling remember-me without a reliable user-loading strategy. Spring still needs a way to reconstruct the authenticated principal from the token.

People also forget cookie security. A convenience cookie without HTTPS and proper flags weakens the whole login flow.

Finally, do not treat remember-me as equivalent to a long-lived session for sensitive admin systems without reviewing revocation and account-disable behavior carefully.

Summary

• LDAP handles identity verification, while remember-me handles browser login persistence.
• The two features work together but solve different problems.
• Configure LDAP authentication first, then add remember-me on top of the normal login flow.
• Remember-me still needs a dependable way to reload user details later.
• Use secure cookies, strong keys, and a reasonable token lifetime.