Question

我使用以下链接中提到的步骤在Windows 2008服务器中创建了LDAP AD服务器：

https://blogs.msdn.microsoft.com/robert_mcmurray/2011/09/16/ftp-and-ldap-part-2-how-to-set-up-an-active-directory-lightweight-directory-services-ad-lds-server/#01b

以下程序必须在LDAP AD中搜索用户。它已成功连接LDAP服务器，但用户搜索失败。我不确定为什么。

var current_timestamp = new Date();
console.log(current_timestamp.toISOString())
// 2019-01-14T06:13:47.757Z
current_timestamp.setHours(current_timestamp.getHours() + 11); 
console.log(current_timestamp.toISOString())
// 2019-01-14T17:13:47.757Z

pm.globals.set("current_timestamp", current_timestamp.toISOString())

}

LDAP server dir image

Answer 1

不确定代码中是否存在复制/粘贴错误或输入错误，但是返回的用户属性拼写错误。属性名称dintinguishedName应该为distinguishedName。我还希望看到与一个已知的良好用户的初始绑定（例如，为该应用程序专门创建的帐户），对该用户的搜索，对distinguishedName的检索，以及第二次尝试与返回的distinguishedName和用户提供的密码进行绑定。相反，我看到的是使用用户提供的密码的硬编码ID（ryan）。如果两个帐户碰巧使用相同的密码，这可能会起作用。在这篇文章的下面，我包含了用于对我的LDAP服务器（包括Active Directory）进行身份验证的代码。

我想要通用代码，大多数其他LDAP服务器都要求您在绑定操作中使用distinguishedName。但是，特别是对于Active Directory，您可以在不知道用户的专有名称的情况下进行绑定-可以使用sAMAccountName（domain \ user）和userPrincipalName（user@domain.TLD）执行LDAP与AD的绑定。如果您在单个林中只有一棵树（即您知道要附加到用户ID上以形成sAMAccountName或userPrincipalName的值），则可以以用户身份执行绑定操作。如果您需要除身份验证之外的其他人信息，请返回代码0（成功身份验证），搜索用户并检索信息。

 // Editable variables -- ensure you change these to your application's details
String strSysUID = "uid=YOURSYSTEMIDGOESHERE,ou=OrgUnitName,dc=Org,dc=Name";
String strSysPassword = "YourSystemPasswordGoesHere";
String strAuthorizationGroup = "LJL_Test";
String strTrustStorePassword = "YourTrustStorePassword"

String trustStoreFile = ".\\ADTrust";

String sLDAPServer = "ldaps://ldap.domain.gTLD:636";
String strUserBaseDN = "ou=UserOU,dc=Org,dc=Name";
String strGroupBaseDN = "ou=GroupOU,dc=Org,dc=Name";
String strUserIDSchemaAttribute = "sAMAccountName=";            // attribute that holds user logon name
String strGroupMembershipSchemaAttribute = "member";            // attribute that holds member list in group object
// End of editable variables

System.setProperty("javax.net.ssl.trustStore", trustStoreFile);
System.setProperty("javax.net.ssl.trustStorePassword", strTrustStorePassword);

// Obtain UID and PWD from user
String sUserUID = "";
String sUserPwd = "";

BufferedReader in = new BufferedReader(new InputStreamReader(System.in));

System.out.print("Please enter your username: ");

try{
    sUserUID = in.readLine();
}catch(Exception er) { er.printStackTrace(); }

System.out.print("Please enter your password: ");
try{
    sUserPwd = in.readLine();
}catch(Exception er) { er.printStackTrace(); }

// Initial context for system bind
Hashtable env = new Hashtable(11);
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, sLDAPServer);
env.put(Context.SECURITY_PROTOCOL, "ssl");

// Authenticate as system ID and password
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, strSysUID);
env.put(Context.SECURITY_CREDENTIALS, strSysPassword);

try {
    DirContext ctx = new InitialDirContext(env);

    // Using the system credentials, search for a user matching the logon ID provided by the user
    String sFilter = strUserIDSchemaAttribute + sUserUID;
    NamingEnumeration UserDNAnswer = ctx.search(strUserBaseDN, sFilter, null);

    String sReturnedFQDN = "";
    // If only one record should be returns, validate that exactly one record is located and throw an error otherwise
    while (UserDNAnswer.hasMore()) {
        SearchResult sr = (SearchResult) UserDNAnswer.next();
        // Store the DN of the user re have found
        sReturnedFQDN = sr.getNameInNamespace();
    }

    // Check group membership, can be done after the password is validated if you wish
    // Example LDAP filter is "(&(cn=NameOfGroupToCheck)(uniqueMember=FQDNOfUserBeingTested))"
    String sGroupFilter = "(&(cn=" + strAuthorizationGroup + ")(" + strGroupMembershipSchemaAttribute + "=" + sReturnedFQDN + "))";
    NamingEnumeration GroupMembershipAnswer = ctx.search(strGroupBaseDN, sGroupFilter, null);

    String sReturnedGroupDN = "";
    while (GroupMembershipAnswer.hasMore()) {
        SearchResult srGroup = (SearchResult) GroupMembershipAnswer.next();
        sReturnedGroupDN = srGroup.getNameInNamespace();
    }

    ctx.close();
    // If an entry was returned, then the user is a member of the group. We should validate the user's password
    if(sReturnedGroupDN.equals("cn=" + strAuthorizationGroup+ "," + strGroupBaseDN)){
        System.out.println(sReturnedFQDN + " is a member of " + sReturnedGroupDN + " and now we will validate the password.");

        // Now establish a new LDAP connection to validate the credentials supplied
        Hashtable envUser = new Hashtable(11);
        envUser.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        envUser.put(Context.PROVIDER_URL, sLDAPServer);

        // Authenticate using the searched FQDN for the user and the password provided by the user
        envUser.put(Context.SECURITY_AUTHENTICATION, "simple");
        envUser.put(Context.SECURITY_PRINCIPAL, sReturnedFQDN);
        envUser.put(Context.SECURITY_CREDENTIALS, sUserPwd);

        // Doing this so a login failure throws a code
        try{
            DirContext ctxUser = new InitialDirContext(envUser);
            System.out.println("Successfully authenticated as " + sUserUID);
            ctxUser .close;
        }
        // User credentials failure
        catch (NamingException e) {
            e.printStackTrace();
        }
    }
    // If no group matched the filter, the user is not a group member and an authorisation failure can be returned
    else{
        System.out.println(sReturnedFQDN + " is NOT a member of " + sReturnedGroupDN + " and there is no need to verify the password.");
    }
}
// System credentials failure
catch (NamingException e) {
    e.printStackTrace();
}

}

无法从LDAP AD服务器检索用户

1 个答案: