验证用户名密码Java ldap jndi

Question

I'm trying to figure out a simple way to validate a username and password using Java (JNDI) , after I've already connected to the LDAP using a bind (bind DN and password). I've manually added a user in LDAP, and I want to use java to check validate the user's credentials (username and password).

Is this a simple, clear way to do this?

Below code I have so far used to connect to LDAP using a bind (which works).

package org.jacob.testing;
import java.util.Hashtable;
import javax.naming.AuthenticationException;
import javax.naming.Context;
import javax.naming.InitialContext;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.*;
import javax.naming.ldap.LdapContext;


public class jacobLdap {

    public static void main(String[] args) throws NamingException {

        Hashtable env = new Hashtable();

           env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://localhost:10389");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, "uid=admin,ou=system");
        env.put(Context.SECURITY_CREDENTIALS, "secret");


            DirContext ctx = new InitialDirContext(env);
            NamingEnumeration answer = ctx.search("ldap://localhost:10389/ou=users,ou=system","(sn=Herring)",null);

                // I've connected to LDAP, now how should I authenticate a user?

    }

}

Answer 1

The basic idea is that you bind to LDAP as an admin to find the user, then rebind as that user using the password supplied. If both succeed, the user exists and has that password.

Contrary to other answers you may read, you should not attempt to compare the password yourself. In a correctly set-up LDAP server the password will be hashed, so you would have to reproduce the hashing algorithm yourself etc etc etc. It's pointless and error-prone, and there can be different algorithms per password. Make the server do the comparison.

Answer 2

Conceptually you have two options:

• bind with "technical" user, then search for user and compare his stored password with the one supplied
• use user and password to actually bind to LDAP

In most cases the 2nd approach is preferable because it's simpler and requires less code. Often the user password isn't even available as an LDAP attribute (eg if you access MS Active Directory over LDAP).

As hinted by @EJP it may or may not be necessary to bind as admin first for the second approach. If you have small user base there's a fair chance they're all on the same branch of the LDAP tree (eg uid=<user>,ou=users,dc=company,dc=com ). This means you know exactly what DN to use for binding because you simply need to inject the respective user name at a consistent place. If you have a large user base, however, users may be distributed across multiple OUs. Then you need to bind as admin first and search for the user (ie search for his DN).