Question

我正在尝试对位于目录根目录的许多不同OU执行LDAP搜索。

上下文初始化：

Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_CREDENTIALS, "somePassword");
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.SECURITY_PRINCIPAL, "MYDOMAIN\\\\myUsername");
env.put(Context.PROVIDER_URL, "ldap://myLdapServer:389");
searchControls = new SearchControls();
searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
ctx = new InitialDirContext(env);

因此，为了搜索我打电话的用户

ctx.search("OU=OrgUnitOne,DC=mysite,DC=com", "(sAMAccountName=someUserName)", searchControls)

或

ctx.search("OU=OrgUnitTwo,DC=mysite,DC=com", "(sAMAccountName=someUserName)", searchControls)

并且要么正常。但由于我想搜索DA根目录中的所有OU，我必须使用另一个baseDN进行搜索，我找不到。我尝试了以下但似乎没有工作......

没有OU：

ctx.search("DC=mysite,DC=com", "(sAMAccountName=someUserName)", searchControls)
//output:
//javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'DC=mysite,DC=com'

空searchBase字符串：

ctx.search("", "(sAMAccountName=someUserName)", searchControls)
//output:
//javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031001E5, problem 2001 (NO_OBJECT), data 0, best match of:'']; remaining name ''

绝望的通配符*

ctx.search("OU=\*,DC=mysite,DC=com", "(sAMAccountName=someUserName)", searchControls)
//output:
//javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-0310020A, problem 2001 (NO_OBJECT), data 0, best match of:'DC=mysite,DC=com']; remaining name 'OU=*,DC=mysite,DC=com'

绝望的通配符％

ctx.search("OU=%,DC=mysite,DC=com", "(sAMAccountName=someUserName)", searchControls)
//output:
//javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-0310020A, problem 2001 (NO_OBJECT), data 0, best match of:'DC=mysite,DC=com']; remaining name 'OU=%,DC=mysite,DC=com'

绝望的OR运算符|

ctx.search("OU=OrgUnitOne|OrgUnitTwo,DC=mysite,DC=com", "(sAMAccountName=someUserName)", searchControls)
//output:
//javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-0310020A, problem 2001 (NO_OBJECT), data 0, best match of:'DC=mysite,DC=com'];

剩余名称'OU=OrgUnitOne|OrgUnitTwo,DC=mysite,DC=com'

有没有办法在所有根OU上实现此搜索？

Answer 1

这对我有用：

Hashtable<String, String> ldapEnv = new Hashtable<String, String>(11);
ldapEnv.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
ldapEnv.put(Context.PROVIDER_URL,  "ldap://ldapHost");
ldapEnv.put(Context.SECURITY_AUTHENTICATION, "simple");
ldapEnv.put(Context.SECURITY_PRINCIPAL, "CN=Administrator,CN=Users,DC=domain,DC=com");
ldapEnv.put(Context.SECURITY_CREDENTIALS, "secret");
ldapContext = new InitialDirContext(ldapEnv);
// Create the search controls         
SearchControls searchCtls = new SearchControls();
// Specify the attributes to return
String returnedAtts[]={"sn","givenName", "samAccountName"};
searchCtls.setReturningAttributes(returnedAtts);
// Specify the search scope
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
// specify the LDAP search filter
String searchFilter = "(&(samAccountName=userName))";
// Specify the Base for the search
String searchBase = "dc=domain,dc=com";
// initialize counter to total the results
int totalResults = 0;
// Search for objects using the filter
NamingEnumeration<SearchResult> answer = ldapContext.search(searchBase, searchFilter, searchCtls);
// Loop through the search results
while (answer.hasMoreElements()) {
    SearchResult sr = (SearchResult)answer.next();
    totalResults++;
    System.out.println(">>>" + sr.getName());
    Attributes attrs = sr.getAttributes();
    System.out.println(">>>>>>" + attrs.get("samAccountName"));       
}
System.out.println("Total results: " + totalResults);
ldapContext.close();

Answer 2

使用所需的基础对象构建搜索请求，搜索范围为sub，过滤器将返回的条目限制为仅需要的条目，以及请求的属性列表。使用UnboundID LDAP SDK：

SearchRequest req = new SearchRequest("dc=mysite,dc=com",
       SearchScope.SUB,"samAccountName=someUserName","1.1");
SearchResult searchResult = ldapConnection.search(req);

此搜索将返回所有条目（1.1表示不返回任何属性，将其替换为所需属性列表），其中samAccounName属性包含值“someUserName”（值的匹配使用匹配规则）如果服务器允许。在某些情况下，服务器管理员可能不允许此搜索，因为它遍历整个目录服务器数据库。此外，连接的授权状态必须允许检查samAccountName。请注意，搜索可以成功（结果代码SUCCESS，整数0），但不返回任何条目。

对于专有名称，不是“或”运算符。
尊贵名称中没有“通配符”运算符

LDAP搜索基础DN无法正常工作

2 个答案: