Bind UnboundIdContainer to loopback address

config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java

@@ -17,6 +17,7 @@
 package org.springframework.security.config.annotation.authentication.configurers.ldap;
 
 import java.io.IOException;
+import java.net.InetAddress;
 import java.net.ServerSocket;
 
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
@@ -590,7 +591,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 		}
 
 		private int getDefaultPort() {
-			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
+			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
 				return serverSocket.getLocalPort();
 			}
 			catch (IOException ex) {

config/src/main/java/org/springframework/security/config/ldap/LdapServerBeanDefinitionParser.java

@@ -17,6 +17,7 @@
 package org.springframework.security.config.ldap;
 
 import java.io.IOException;
+import java.net.InetAddress;
 import java.net.ServerSocket;
 
 import org.w3c.dom.Element;
@@ -188,7 +189,7 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 	}
 
 	private String getDefaultPort() {
-		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
+		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
 			return String.valueOf(serverSocket.getLocalPort());
 		}
 		catch (IOException ex) {

ldap/src/integration-test/java/org/springframework/security/ldap/server/UnboundIdContainerTests.java

@@ -21,9 +21,11 @@ import java.net.ServerSocket;
 import java.util.ArrayList;
 import java.util.List;
 
+import com.unboundid.ldap.listener.InMemoryDirectoryServer;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.context.support.GenericApplicationContext;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -48,6 +50,24 @@ public class UnboundIdContainerTests {
 		}
 	}
 
+	@Test
+	public void startLdapServerThenListenerBindsToLoopbackAddressOnly() throws Exception {
+		UnboundIdContainer server = new UnboundIdContainer("dc=springframework,dc=org", null);
+		server.setApplicationContext(new GenericApplicationContext());
+		List<Integer> ports = getDefaultPorts(1);
+		server.setPort(ports.get(0));
+
+		try {
+			server.afterPropertiesSet();
+			InMemoryDirectoryServer directoryServer = (InMemoryDirectoryServer) ReflectionTestUtils.getField(server,
+					"directoryServer");
+			assertThat(directoryServer.getListenAddress().isLoopbackAddress()).isTrue();
+		}
+		finally {
+			server.destroy();
+		}
+	}
+
 	@Test
 	public void afterPropertiesSetWhenPortIsZeroThenRandomPortIsSelected() throws Exception {
 		UnboundIdContainer server = new UnboundIdContainer("dc=springframework,dc=org", null);

ldap/src/main/java/org/springframework/security/ldap/server/UnboundIdContainer.java

@@ -17,6 +17,7 @@
 package org.springframework.security.ldap.server;
 
 import java.io.InputStream;
+import java.net.InetAddress;
 
 import com.unboundid.ldap.listener.InMemoryDirectoryServer;
 import com.unboundid.ldap.listener.InMemoryDirectoryServerConfig;
@@ -98,7 +99,8 @@ public class UnboundIdContainer
 		try {
 			InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(this.defaultPartitionSuffix);
 			config.addAdditionalBindCredentials("uid=admin,ou=system", "secret");
-			config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("LDAP", this.port));
+			config.setListenerConfigs(
+					InMemoryListenerConfig.createLDAPConfig("LDAP", InetAddress.getLoopbackAddress(), this.port, null));
 			config.setEnforceSingleStructuralObjectClass(false);
 			config.setEnforceAttributeSyntaxCompliance(true);
 			DN dn = new DN(this.defaultPartitionSuffix);