从Linux到2012r2 Active Directory的LDAPS Java查询的最低要求是什么

Question

So, we have a mixed system - Windows 2012r2 AD, with AD CA installed, a self signed cert, I can connect and search AD on 636 from ldp.exe, and now I can connect and search ldaps:636 from a Linux host (with a full .pem file imported into my ca trust store on the Linux side).

So, I know I am partially there - I think. With the Linux host with the java code, I have exported the public key into my javastore, and am trying the search with that...I get a 49 and 52e...every single time.

My question is this - do I absolutely have to use a full .pem to do an ldaps search? or is there a smaller set of required Certs and search mechanisms to do this?

Here's my code:

<jaas:module className="org.apache.karaf.jaas.modules.ldap.LDAPLoginModule"
             flags="required">

  initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory

  connection.username=uid=ddf

  connection.password=password!

  connection.url=ldaps://abc-ad1.house.thatguy.com:636

  user.base.dn=cn=users,cn=accounts,dc=house,dc=thatguy,dc=com

  user.filter=(uid=%u)

  user.search.subtree=true

  role.base.dn=CN=NPE,CN=Users,dc=house,dc=thatguy,dc=com

  role.name.attribute=cn

  role.filter=(member=uid=%u,cn=groups,cn=compat,dc=house,dc=thatguy,dc=com)

  role.search.subtree=true

  role.mapping=admin=group,admin,manager,viewer,webconsole

  authentication=simple

  ssl.protocol=SSL

  ssl.truststore=truststore

  ssl.algorithm=PKIX

</jaas:module>

What the heck am I missing?

Answer 1

So. My issue was in my script. The public key is needed to do the ldaps lookup, but the script requires specific ldaps features for Active Directory.

where I had UID - it MUST be CN. So, the LDAP search was CN=username,CN=ou,dc=blah,dc=blah,dc=blah. the ldaps search was cn=svcldaps,cn=users,dc=house,dc=thatguy,dc=com.

I changed the user.filter=(uid=%u) to user.filter=(cn=%u) and corrected the role.filter=(member=uid=%u,cn=users,dc=house,dc=thatguy,dc=com) to role.filter=(member=cn=%u,cn=users,dc=house,dc=thatguy,dc=com)

As soon as I made the change to the script, it was able to log in correctly.

Closing the question for myself is ever so sweet. Now my skull will go back to normal, and I can fill that dent in on the wall. And the table. and replace the keyboards and the monitors.