使用其他帐户绑定到LDAP，然后在LDAP服务器中使用密码搜索用户

Question

I have a service account by which i bind LDAP connection , i am using JAAS LdapLoginModule to authenticate the account. Once LDAP bind succeeds, I need to search or authenticate or search other normal user with its user name and password.

So how I am supposed to approach because i did not find any search query with password for user and LDAP bind permission is not allowed for this normal user. I am able to retrieve all the groups and users inside them but i could not find password.

Answer 1

LDAP directory in its "normal" way of using it as authentication provider do not allow any user to read the password attribute to avoid leaking it.

What it is normally done is to allow anybody to authenticate on this attribute only, ie : the attribute can be used by anybody to try a bind operation.

So 2 ways of dealing with your case :

1. [not recommended] : modify the access right to allow the user used to search to read the password attribute (=> create a possible security issue)
2. allow anonymous connection to only bind on the password attribute

EDIT : To answer question in comment :

As I stated previously, to compare and/or read (as in LDAP operation of the protocol) the password attribute of another user than your master account, you have to allow the master account to do it, but it is not recommended.

How to allow it, it depends of the LDAP implementation you use (ie. which directory : OpenLDAP, AD, ApacheDS, etc.)

Or you allow everyone to bind on the directory, which is the standart way of doing this :

• Bind with master password
• Search the DN of the user which try to bind
• Re-bind with the DN of the user and the password he provided :
  • Bind OK : correct password
  • Bind KO : invalid credential

Answer 2

You need to:

1. Bind to the directory as the admin user with permission to search.
2. Search for the user given whatever attribute you have that is unique, for example, screen name, email, etc.
3. Attempt to bind as that user with the password he supplied.

If all this succeeds, the user attribute and password were correct. If not, not.

Answer 3

If you want to authenticate only without any authorization using JAAS then do not use complete DN in security principle just pass the username like below. it will get authenticated but not authorized

Hashtable<String, Object> env = new Hashtable<String, Object>();
        env.put(Context.PROVIDER_URL, providerUrl);
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, "admin");
        env.put(Context.SECURITY_CREDENTIALS, "passWord");

Like this if you want authorization then there is some other way