[#2841] Fix Active Directory DN authentication

[abhiramaab]

Description

Fixes Active Directory authentication when the supplied username is already a distinguished name (DN) and no suffix is configured.

The authentication path now preserves valid LDAP DNs instead of escaping them and appending the configured principal suffix, only if suffix is not configured.

Normal usernames continue to use the existing Rdn.escapeValue() handling.

Tests

Added regression tests covering:

• authentication with an existing LDAP DN
• authentication with a regular username requiring LDAP escaping
• LDAP authentication using the resolved username

All tests pass.

Fixes #2841

Checklist

Following this checklist to help us incorporate your contribution quickly and easily:

• Make sure there is a GitHub issue filed
  for the change (usually before you start working on it). Trivial changes like typos do not
  require a GitHub issue. Your pull request should address just this issue, without pulling in other changes.
• Format the pull request title like [#XXX] - Fixes bug in SessionManager,
  where you replace #XXX with the appropriate GitHub issue. Best practice
  is to use the GitHub issue title in the pull request title and in the first line of the commit message.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• add fixes #XXX if merging the PR should close a related issue.
• Run mvn verify to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
• Committers: Make sure a milestone is set on the PR
• Committers: Use "Squash and Merge" to combine all commits into one when merging a PR when appropriate.

Trivial changes like typos do not require a GitHub issue (javadoc, comments...).
In this case, just format the pull request title like [DOC] - Add javadoc in SessionManager.

If this is your first contribution, you have to read the Contribution Guidelines

If your pull request is about ~20 lines of code you don't need to sign an Individual Contributor License Agreement
if you are unsure please ask on the developers list.

To make clear that you license your contribution under the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

• I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004
• In any other case, please file an Apache Individual Contributor License Agreement.

[Copilot]

Pull request overview

This PR adjusts ActiveDirectoryRealm to support authenticating against Active Directory when the supplied username is already an LDAP distinguished name (DN), ensuring valid DNs are preserved for LDAP bind while non-DN usernames continue to use the existing escaping/suffix behavior.

Changes:

• Updated the LDAP bind path to use a new DN-aware resolver (getUsernameForAuthentication) instead of always applying getUsernameWithSuffix.
• Introduced getUsernameForAuthentication(String) that detects LDAP DNs via LdapName parsing and preserves them for authentication.
• Added regression tests covering DN input, regular username escaping, and verifying the bind uses the DN.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
core/src/main/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealm.java	Adds DN-aware username resolution and uses it during LDAP bind for authentication.
core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java	Adds tests for DN preservation and username escaping, plus a bind regression test.

Suppressed comments (1)

core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java:182

• ldapContext is created as an EasyMock mock but never transitioned to replay state. That means calls like ctx.close() during queryForAuthenticationInfo can be silently recorded instead of exercised in replay mode, which can hide real failures in this test.

        replay(factory);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[steinarb]

@lprimak In as far as I understood it LGTM.

Mostly looked at style and tests.

[lprimak]

Can you please restore the PR template. PRs cannot be accepted without it, and copyright / license attribution

[lprimak]

Looks good. I have pushed an additional commit into your branch to add some comments / renamed methods and fixed tests. I also made full-DN passthrough more strict and made it contingent of null principalSuffix configuration.

Please check the appropriate box in the description checklist to attribute license and copyright to Apache.

Thank you for your contribution.