Active Directory LDAP 问题让我抓狂

Question

我编写了一个 Java 应用程序来检索选定的 AD 用户帐户属性，以尝试将公司的 HR 员工记录与 AD 匹配。除了属性“accountExpires”在我的代码中总是返回 null 之外，一切都运行良好。当我使用 Apache LDAP 查看器（Eclipse 插件）检查相同用户帐户的样本时，我可以看到日期/时间和长值。

这是我的代码，它适用于除检索“accountExpires”属性之外的所有内容。 包 com.acne.LDAPRealmTest;

import java.io.BufferedWriter;
import java.io.File;
import java.io.FileWriter;
import java.util.Hashtable;
import java.util.Calendar;
import java.util.Date;
import java.util.concurrent.TimeUnit;
import javax.naming.NameClassPair;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.BasicAttributes;
import javax.naming.directory.Attributes;
import javax.naming.directory.Attribute;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;

public class LDAPCtxTest {
    DirContext ctx = null;
    StringBuffer sb = new StringBuffer();
    int counter=0;
    SearchControls controls;
    private final static long DIFF_NET_JAVA_FOR_DATE_AND_TIMES = 11644473600000L;

    public LDAPCtxTest() {
        try {
            System.out.println("Active Directory search test"); 
            Hashtable<String, String> env = new Hashtable<String, String>();

        /*  Begin by defining the environment properties and getting the InitialDirContext class object initialized.
          */ 

        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "connection_string"); 
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, "CN=LDAP_USER,OU=Service Accounts,OU=System Administration,DC=acne,DC=com,DC=au");
        env.put(Context.SECURITY_CREDENTIALS, "test01");
        env.put(Context.REFERRAL, "follow");

        ctx = new InitialDirContext(env);
          // Create the search controls          
          controls = new SearchControls(); 

          //Specify the attributes to return 
          String returnedAtts[]={"sn","name", "accountExpires", "sAMAccountName", "department","telephoneNumber","userAccountControl","cn","pwdLastSet","accountExpires","objectcategory"}; 
          controls.setReturningAttributes(returnedAtts); 

          //Specify the search scope 
          controls.setSearchScope(SearchControls.SUBTREE_SCOPE); 

          //String searchFilter = "(&(objectClass=user)(userAccountControl=512))";
          String searchFilter = "(&(objectCategory=person)(objectClass=user)(userAccountControl=512))";
          //Specify the Base for the search 
          String searchBase = "DC=acne,DC=com,DC=xx"; //this doesn't seem to work so replaced with empty string which is ok
          //initialize counter to total the results 
          //controls.setCountLimit(100); // limits the search result to 200

          File outFile = new File("C:\\temp\\", "ldaptest.txt");
          BufferedWriter bw = new BufferedWriter(new FileWriter(outFile));
          bw.write("Counter,sAMAccountName,userAccountControl,name,AccountExpiry\n");
          NamingEnumeration<SearchResult> answer = ctx.search("", searchFilter, controls); 
          //Loop through the search results
            while (answer.hasMoreElements()) 
            {
                SearchResult sr = (SearchResult)answer.next();
                Attributes attrs = sr.getAttributes();
                Attribute attrAccountControl = attrs.get("userAccountControl");
                Attribute attrName = attrs.get("name");
                Attribute attrAccountExpire = attrs.get("accountExpires");
                Attribute attrSAMAccount = attrs.get("sAMAccountName");

                counter++;
                sb.append(counter+","+attrSAMAccount.get(0)+","+attrAccountControl.get(0)+","+attrName.get(0)+ ","+attrAccountExpire+"\n");
                System.out.println(counter + " " + attrSAMAccount.get(0) + "..." + attrAccountControl.get(0));
            } 
          bw.write(sb.toString());
          bw.close();
          System.out.println("The End");
          ctx.close();
          System.out.println("LDAP connected ok");
    } catch (NamingException ne) {
        System.out.println("LDAP connect FAILED");

    } catch (Exception e) {
        e.printStackTrace(); 
    }       
}

private Date getDateTimeFrom(String adDateTimeStr) {
    long adDateTime = Long.parseLong(adDateTimeStr);
    long milliseconds = (adDateTime / 10000) - DIFF_NET_JAVA_FOR_DATE_AND_TIMES;
    //long milliseconds = (adDateTime / 10000) - DIFF_NET_JAVA_FOR_DATE_AND_TIMES;
    Date dateVal = new Date(milliseconds);
    return dateVal;
} 


public static void main(String[] args) {
    new LDAPCtxTest();
}

}

我查看了与 LDAP 查询相关的各种线程，尤其是与 accountExpires 相关的线程，并查看了列出 LDAP 属性的 Microsoft 站点。看来我上面指定的属性名称没有任何问题，我还没有发现其他人有类似问题。我不确定还有什么问题。

Answer 1

回答：一旦我从 LDAPS 切换到 LDAP，就可以访问属性“accountExpires”。理想情况下，出于安全原因，我更喜欢通过 LDAPS 进行连接，但 Active Directory 管理不是我的领域，我会让 AD 专家做出决定。

另请注意，我能够访问此（操作）属性，而无需将其附加到返回的Attrs“+”。