如何使用 java 命名接口 (JNDI) 使用 Active Directory 验证用户凭据

Question

我已完成以下代码，但无法获取或验证用户凭据。

public static void main(String a[]) {

        // set the LDAP authentication method
        String auth_method  = "simple";
        // set the LDAP client Version
        String ldap_version = "3";
        // This is our LDAP Server's IP
        String ldap_host    = "19.16.1.1";
        // This is our LDAP Server's Port
        String ldap_port    = "389";
        // This is our access ID
        String ldap_dn      = "test1";
        // This is our access PW
        String ldap_pw      = "New@123";
        // This is our base DN
        String base_dn      = "DC=example,DC=com";

        DirContext ctx      = null;
        Hashtable env       = new Hashtable();

        // Here we store the returned LDAP object data
        String dn           = "";
        String password           = "";
        // This will hold the returned attribute list
        Attributes attrs;

        env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL,"ldap://" + ldap_host + ":" + ldap_port);
        env.put(Context.SECURITY_AUTHENTICATION, auth_method);
        env.put(Context.SECURITY_PRINCIPAL, ldap_dn);
        env.put(Context.SECURITY_CREDENTIALS, ldap_pw);
        env.put("java.naming.ldap.version", ldap_version);

        try{
            System.out.println("Connecting to host " + ldap_host + " at port " + ldap_port + "...");
            System.out.println();

            ctx = new InitialDirContext(env);
            System.out.println("LDAP authentication successful!");

            // Specify the attribute list to be returned
             **String MY_ATTRS[] = {"cn", "uid", "sn", "unicodepwd"};**
            SearchControls ctls = new SearchControls();
            ctls.setReturningAttributes(MY_ATTRS);
            ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);

            // Specify the search filter to match
            String filter = "(&(objectClass=user)(sAMAccountName=satya))";

            // Search the subtree for objects using the given filter
            NamingEnumeration answer = ctx.search(base_dn, filter, ctls);

            System.out.println(answer.getClass().getName());

            // Print the answer
            //Search.printSearchEnumeration(answer);

            while (answer.hasMoreElements()) {
                SearchResult sr = (SearchResult)answer.next();
                dn = sr.getName();
                attrs = sr.getAttributes();
    
                System.out.println("Found Object: " + dn + "," + base_dn);
                if (attrs != null) {
                    // we have some attributes for this object
                    NamingEnumeration ae = attrs.getAll();
                    while (ae.hasMoreElements()) {
                        Attribute attr = (Attribute)ae.next();
                        String attrId = attr.getID();
                        
                         Attribute passwd = attrs.get("unicodepwd");
                         **System.out.println("----"+passwd);
                        System.out.println("Found Attribute: " + attrId);**
                        Enumeration vals = attr.getAll();
                        
                        while (vals.hasMoreElements()) {
                            String attr_val = (String)vals.nextElement();
                            System.out.println(attrId + ": " + attr_val);
                        }
                    }
                }
            }

            // Close the context when we're done
            ctx.close();
        } catch (AuthenticationException authEx) {
            authEx.printStackTrace();
            System.out.println("LDAP authentication failed!");
        } catch (NamingException namEx) {
            System.out.println("LDAP connection failed!");
            namEx.printStackTrace();
        } catch (Exception e) {
            e.printStackTrace();
        }
    } //

我正在尝试使用上述代码，但无法获取用户密码或 unicodepwd。

• 输出：

Connecting to host 192.168.1.15 at port 389...

LDAP authentication successful!
com.sun.jndi.ldap.LdapSearchEnumeration
Found Object: CN=satya priya,OU=Test,DC=example,DC=com
----null
Found Attribute: sn
sn: priya
----null
Found Attribute: cn
cn: satya priya

Answer 1

按预期工作。

3.1.1.3.1.5.1 unicodePwd

LDAP 搜索永远不会返回 unicodePwd 属性。

这是有道理的，您不应该转储所有用户的密码。

要验证特定用户的密码，您需要使用用户提供的密码和搜索返回的 DN 执行 BIND。

这里详细介绍了answer 如何验证凭据。