Index: app-config/src/main/java/org/duracloud/appconfig/domain/Application.java
===================================================================
--- app-config/src/main/java/org/duracloud/appconfig/domain/Application.java	(revision 831)
+++ app-config/src/main/java/org/duracloud/appconfig/domain/Application.java	(working copy)
@@ -17,6 +17,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Collection;
 
@@ -63,7 +64,9 @@
         String xml = config.asXml();
         String url = getInitUrl(config);
         try {
-            Map<String, String> headers = null;
+            Map<String, String> headers = new HashMap<String, String>();
+            headers.put("REMOTE_USER", new RootUserCredential().getUsername());
+//            headers.put("REMOTE_USER", "awoods");
             return getRestHelper().post(url, xml, headers);
 
         } catch (Exception e) {
@@ -83,7 +86,8 @@
     public RestHttpHelper.HttpResponse setSecurityUsers(Collection<SecurityUserBean> users) {
         String xml = SecurityUsersDocumentBinding.createDocumentFrom(users);
         try {
-            Map<String, String> headers = null;
+            Map<String, String> headers = new HashMap<String, String>();
+            headers.put("REMOTE_USER", new RootUserCredential().getUsername());
             return getRestHelper().post(getSecurityUrl(), xml, headers);
 
         } catch (Exception e) {
Index: duradmin/src/main/webapp/WEB-INF/config/security-config.xml
===================================================================
--- duradmin/src/main/webapp/WEB-INF/config/security-config.xml	(revision 831)
+++ duradmin/src/main/webapp/WEB-INF/config/security-config.xml	(working copy)
@@ -14,9 +14,10 @@
     <beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
   </beans:bean>
 
-  <http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint">
+  <http auto-config="false"  entry-point-ref="preAuthNEntryPoint">
+
     <intercept-url pattern="/init" method="GET" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
-    <intercept-url  pattern="/security" access="ROLE_ADMIN" />
+    <intercept-url pattern="/security" access="ROLE_ADMIN" />
     <intercept-url pattern="/login*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
     <intercept-url pattern="/style/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
     <intercept-url pattern="/images/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
@@ -25,31 +26,63 @@
     <intercept-url pattern="/favicon.ico" access="IS_AUTHENTICATED_ANONYMOUSLY" />
     <intercept-url pattern="/webstart/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
     <intercept-url pattern="/**" access="ROLE_USER"  />
-    <form-login login-page="/" always-use-default-target="false"  authentication-failure-url="" />
+    <!--<form-login login-page="/" always-use-default-target="false"  authentication-failure-url="" />-->
     <anonymous />
-    <http-basic />
-    <logout logout-url="/logout"/>
+    <!--<http-basic />-->
+    <logout invalidate-session="true" logout-url="/logout"/>
   </http>
 
   <!-- AuthN Manager -->
   <authentication-manager alias="authenticationManager"/>
-  <authentication-provider user-service-ref="userDetailsSvc">
-    <password-encoder ref="passwordEncoder"/>
-  </authentication-provider>
-  <authentication-provider user-service-ref="userDetailsSvc"/>
+  <!--<authentication-provider user-service-ref="userDetailsSvc">-->
+    <!--<password-encoder ref="passwordEncoder"/>-->
+  <!--</authentication-provider>-->
+  <!--<authentication-provider user-service-ref="userDetailsSvc"/>-->
 
+
+  <!--remove below-->
   <beans:bean id="userDetailsSvc" class="org.duracloud.security.impl.UserDetailsServiceImpl"/>
 
   <beans:bean id="passwordEncoder"
     class="org.springframework.security.providers.encoding.ShaPasswordEncoder" >
    <beans:constructor-arg value="256"/>
   </beans:bean>
+<!-- remove above -->
 
-  <beans:bean id="authenticationProcessingFilterEntryPoint"	class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
-		<beans:property name="loginFormUrl" value="/login" />
-		<beans:property name="serverSideRedirect" value="true" />
-	</beans:bean>
 
+  <beans:bean id="preAuthNEntryPoint" class="org.springframework.security.ui.preauth.PreAuthenticatedProcessingFilterEntryPoint"/>
+  
+  <beans:bean id="headerPreAuthNFilter" class="org.springframework.security.ui.preauth.header.RequestHeaderPreAuthenticatedProcessingFilter" >
+    <custom-filter position="PRE_AUTH_FILTER"></custom-filter>
+    <beans:property name="principalRequestHeader" value="REMOTE_USER"/>
+    <beans:property name="authenticationManager" ref="authenticationManager"/>
+  </beans:bean>
+
+  <beans:bean id="preAuthNProvider" class="org.springframework.security.providers.preauth.PreAuthenticatedAuthenticationProvider">
+    <custom-authentication-provider/>
+    <beans:property name="preAuthenticatedUserDetailsService">
+      <beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.userdetails.UserDetailsByNameServiceWrapper">
+        <beans:property name="userDetailsService" ref="ldapUserDetailsService"/>
+      </beans:bean>
+    </beans:property>
+  </beans:bean>
+
+  <ldap-server url="ldap://idp.duracloud.org:389" root="dc=idp,dc=duracloud,dc=org"/>
+
+    <ldap-user-service id="ldapUserDetailsService"
+                       user-search-base="ou=people,dc=idp,dc=duracloud,dc=org"
+                       user-search-filter="(uid={0})"
+                       group-search-base="ou=groups,dc=idp,dc=duracloud,dc=org"
+                       group-search-filter="(member={0})"/>
+  <!--<beans:bean id="ldapUserDetailsService" class="org.springframework.security.userdetails.ldap.LdapUserDetailsManager"/>-->
+
+  <!--<beans:bean id="authenticationProcessingFilterEntryPoint"	class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">-->
+		<!--<beans:property name="loginFormUrl" value="/login" />-->
+		<!--<beans:property name="serverSideRedirect" value="true" />-->
+	<!--</beans:bean>-->
+  <beans:bean id="authorisationLoggerListener" class="org.springframework.security.event.authorization.LoggerListener" />
+
+
   <!-- AOP to log(in/out) ContentStoreMgr and ServicesMgr -->
   <beans:bean id="securityContextUtil" class="org.duracloud.security.context.SecurityContextUtil"/>
 
Index: duradmin/pom.xml
===================================================================
--- duradmin/pom.xml	(revision 831)
+++ duradmin/pom.xml	(working copy)
@@ -317,6 +317,60 @@
       <scope>test</scope>
     </dependency>
 
+    <!-- for spring ldap -->
+    <!--<dependency>-->
+      <!--<groupId>org.apache.directory.server</groupId>-->
+      <!--<artifactId>apacheds-core</artifactId>-->
+      <!--<version>1.0.2</version>-->
+      <!--<scope>compile</scope>-->
+    <!--</dependency>-->
+    <!--<dependency>-->
+      <!--<groupId>org.apache.directory.server</groupId>-->
+      <!--<artifactId>apacheds-server-jndi</artifactId>-->
+      <!--<version>1.0.2</version>-->
+      <!--<scope>compile</scope>-->
+      <!--<exclusions>-->
+        <!--<exclusion>-->
+          <!--<groupId>org.apache.directory.server</groupId>-->
+          <!--<artifactId>apacheds-protocol-changepw</artifactId>-->
+        <!--</exclusion>-->
+        <!--<exclusion>-->
+          <!--<groupId>org.apache.directory.server</groupId>-->
+          <!--<artifactId>apacheds-protocol-ntp</artifactId>-->
+        <!--</exclusion>-->
+        <!--<exclusion>-->
+          <!--<groupId>org.apache.directory.server</groupId>-->
+          <!--<artifactId>apacheds-protocol-kerberos</artifactId>-->
+        <!--</exclusion>-->
+        <!--<exclusion>-->
+          <!--<groupId>org.apache.directory.server</groupId>-->
+          <!--<artifactId>apacheds-protocol-ldap</artifactId>-->
+        <!--</exclusion>-->
+      <!--</exclusions>-->
+    <!--</dependency>-->
+    <dependency>
+      <groupId>org.springframework.ldap</groupId>
+      <artifactId>spring-ldap</artifactId>
+      <version>1.2.1</version>
+      <exclusions>
+        <exclusion>
+          <groupId>commons-logging</groupId>
+          <artifactId>commons-logging</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <!--<dependency>-->
+      <!--<groupId>org.apache.mina</groupId>-->
+      <!--<artifactId>mina-core</artifactId>-->
+      <!--<version>1.0.2</version>-->
+    <!--</dependency>-->
+<!--<dependency>-->
+          <!--<groupId>org.apache.directory.server</groupId>-->
+          <!--<artifactId>apacheds-protocol-shared</artifactId>-->
+  <!--<version>1.0.2</version>-->
+    <!--</dependency>-->
+
+
     <!-- tiles -->
     <dependency>
       <groupId>org.apache.tiles</groupId>