【发布时间】：2019-02-17 12:00:51
【问题描述】：
我可以使用提供的凭据创建 DirContext。因此，似乎我正在连接到 ldap 服务器并验证凭据，但后来我们对从这些凭据获得的上下文进行了 .search。在这里它失败了。除了显示我如何验证凭据正常工作的代码和似乎失败的代码之外，我还包括了我的 spring 安全配置。
spring-security 配置
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:p="http://www.springframework.org/schema/p"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<http pattern="/ui/login" security="none"></http>
<http pattern="/styles" security="none"/>
<http use-expressions="true">
<intercept-url pattern="/views/*" access="isAuthenticated()" />
<intercept-url pattern="/database/upload" access="isAuthenticated()" />
<intercept-url pattern="/database/save" access="isAuthenticated()" />
<intercept-url pattern="/database/list" access="isAuthenticated()" />
<intercept-url pattern="/database/delete" access="isAuthenticated()" />
<intercept-url pattern="/project/*" access="isAuthenticated()" />
<intercept-url pattern="/file/*" access="isAuthenticated()" />
<intercept-url pattern="/amazon/*" access="isAuthenticated()" />
<intercept-url pattern="/python/*" access="isAuthenticated()" />
<intercept-url pattern="/r/*" access="isAuthenticated()" />
<intercept-url pattern="/project/*" access="isAuthenticated()" />
<intercept-url pattern="/image/*" access="isAuthenticated()" />
<intercept-url pattern="/shell/*" access="isAuthenticated()" />
<intercept-url pattern="/register" access="hasRole('ROLE_ADMIN')" />
<intercept-url pattern="/user/save" access="hasRole('ROLE_ADMIN')" />
<intercept-url pattern="/user/userAdministrator" access="hasRole('ROLE_ADMIN')" />
<intercept-url pattern="/user/list" access="isAuthenticated()" />
<intercept-url pattern="/user/archive" access="isAuthenticated()" />
<form-login login-page="/login" default-target-url="/views/main"
authentication-failure-url="/loginfailed"/>
<logout logout-success-url="/login" />
</http>
<beans:bean id="ldapAuthProvider"
class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">
<beans:constructor-arg value="simplead.blazingdb.com" />
<beans:constructor-arg value="ldap://simplead.blazingdb.com/" />
</beans:bean>
<authentication-manager alias="authenticationManager" erase-credentials="true">
<authentication-provider ref="ldapAuthProvider">
</authentication-provider>
</authentication-manager>
</beans:beans>
来自 ActiveDirectoryLdapAuthenticationProvider
@Override
protected DirContextOperations doAuthentication(UsernamePasswordAuthenticationToken auth) {
String username = auth.getName();
String password = (String)auth.getCredentials();
DirContext ctx = bindAsUser(username, password);
try {
return searchForUser(ctx, username);
} catch (NamingException e) {
logger.error("Failed to locate directory entry for authenticated user: " + username, e);
throw badCredentials();
} finally {
LdapUtils.closeContext(ctx);
}
}
只要我传递了正确的凭据，它就会返回，如果我发送错误的凭据就会失败，所以我知道我们已经做到了。
问题出在 SpringSecurityLdapTemplate 内部
public static DirContextOperations searchForSingleEntryInternal(DirContext ctx, SearchControls searchControls,
String base, String filter, Object[] params) throws NamingException {
final DistinguishedName ctxBaseDn = new DistinguishedName(ctx.getNameInNamespace());
final DistinguishedName searchBaseDn = new DistinguishedName(base);
final NamingEnumeration<SearchResult> resultsEnum = ctx.search(searchBaseDn, filter, params, searchControls);
if (logger.isDebugEnabled()) {
logger.debug("Searching for entry under DN '" + ctxBaseDn
+ "', base = '" + searchBaseDn + "', filter = '" + filter + "'");
}
Set<DirContextOperations> results = new HashSet<DirContextOperations>();
try {
while (resultsEnum.hasMore()) {
SearchResult searchResult = resultsEnum.next();
// Work out the DN of the matched entry
DistinguishedName dn = new DistinguishedName(new CompositeName(searchResult.getName()));
if (base.length() > 0) {
dn.prepend(searchBaseDn);
}
if (logger.isDebugEnabled()) {
logger.debug("Found DN: " + dn);
}
results.add(new DirContextAdapter(searchResult.getAttributes(), dn, ctxBaseDn));
}
} catch (PartialResultException e) {
LdapUtils.closeEnumeration(resultsEnum);
logger.info("Ignoring PartialResultException");
}
if (results.size() == 0) {
throw new IncorrectResultSizeDataAccessException(1, 0);
}
if (results.size() > 1) {
throw new IncorrectResultSizeDataAccessException(1, results.size());
}
return results.iterator().next();
}
特别是我认为以下行是我看到问题的地方。当它期望 1 时，我们得到一个大小为 0 的返回，所以它抛出一个错误并且整个事情都失败了。
final NamingEnumeration<SearchResult> resultsEnum = ctx.search(searchBaseDn, filter, params, searchControls);
每当我们尝试执行 resultsEnum.hasMore() 时，我们都会捕获 PartialResultsException。
我试图弄清楚为什么会这样。我正在使用 Amazon Simple 目录服务（由 Samba 支持而不是 MSFT 版本的服务）。我对 LDAP 和 Active Directory 非常陌生，所以如果我的问题格式不正确，请告诉我需要添加哪些信息。
【问题讨论】：
标签： java spring-security spring-ldap