如何知道用户在 Active Directory 中是活动的还是非活动的答案

【问题标题】：how to know user is active or inactive in Active Directory如何知道用户在 Active Directory 中是活动的还是非活动的
【发布时间】：2013-05-03 08:27:34
【问题描述】：

我已连接到 Active Directory，因此我正在验证用户名，但我如何知道用户在 AD 中处于活动状态还是非活动状态？

示例代码：

            private Properties properties;
            private DirContext dirContext;
            private SearchControls searchCtls;
            private String[] returnAttributes = { "sAMAccountName", "givenName", "cn", "mail"};
            private String domainBase;
            private String baseFilter = "(&((&(objectCategory=Person)(objectClass=User)))";
    public ActiveDirectory(String username, String password, String domainController,String url) {
            properties = new Properties();        

            properties.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
            properties.put(Context.PROVIDER_URL, url);
            properties.put(Context.SECURITY_AUTHENTICATION,"simple");
            properties.put(Context.SECURITY_PRINCIPAL,username+"@"+domainController);
            properties.put(Context.SECURITY_CREDENTIALS, password);

            //initializing active directory LDAP connection
            try {

                dirContext = new InitialDirContext(properties);
                System.out.println("dirContext: "+dirContext);
            } catch (NamingException e) {
                e.printStackTrace();
                log.severe(e.getMessage());
            } catch (Exception e) {
                e.printStackTrace();
            }
               domainBase = getDomainBase(domainController);

            //initializing search controls
            searchCtls = new SearchControls();
            searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            searchCtls.setReturningAttributes(returnAttributes);

        }



     public NamingEnumeration<SearchResult> searchUser(String searchValue, String searchBy, String searchBase) throws NamingException {
                System.out.println("search value :: "+searchValue);
                System.out.println("search base111 :: "+ ((null == searchBase) ? domainBase : getDomainBase(searchBase)));
                String filter = getFilter(searchValue, searchBy);       
                String base = (null == searchBase) ? domainBase : getDomainBase(searchBase); // for eg.: "DC=myjeeva,DC=com";
                System.out.println("this.dirContext : "+this.dirContext);



                return this.dirContext.search(base, filter, this.searchCtls);
            }
      private String getFilter(String searchValue, String searchBy) {
            String filter = this.baseFilter;        
            if(searchBy.equals("email")) {
                filter += "(mail=" + searchValue + "))";
            } else if(searchBy.equals("username")) {
                filter += "(samaccountname=" + searchValue + "))";
            }
            System.out.println("filter : "+filter);
            return filter;
        }

我已经使用这个this.dirContext.search(base, filter, this.searchCtls); 进行了搜索

我如何知道用户是活跃还是非活跃？

我发现谷歌得到active用户(!(useraccountcontrol:1.2.840.113556.1.4.803:=2))和deactive用户(useraccountcontrol:1.2.840.113556.1.4.803:=2)如何在JAVA代码中实现这两个。

【问题讨论】：

标签： java active-directory jndi active-directory-group

【解决方案1】：

1) 从 AD 中获取“userAccountControl”属性：

String s = (String) getAttribute(attrs, "userAccountControl");

2) 将其解析为长值：

// 0 means not disabled (any value where value & 2 == 0 will do)
userAccountControl = StringUtils.isEmpty(s) ? 0 : Long.parseLong(s);

3) 如果用户被禁用则返回：

public boolean isDisabled() {
    return ((userAccountControl & 2) != 0); 
}

【讨论】：

【解决方案2】：

谢谢你，你的提示奏效了，我设法读取了活跃和不活跃的用户。

我使用此过滤器成功地从 Active Directory 中读取了活动用户：

    (&(objectClass=user)(objectCategory=person)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))

以及所有使用此过滤器的非活动用户：

    (&(objectClass=user)(objectCategory=person)(useraccountcontrol:1.2.840.113556.1.4.803:=2))

【讨论】：