使用LDAP和Windows Active Directory的用户身份验证（Windows Server 2016）

Question

Platform : Windows 10 x64 Development Environment : MSVC 2017

Active Directory Platform : Windows Server 2016 (Evaluation)

I am trying to authenticate windows users located on remote server maintained using Windows Active Directory. My service running on local PC is giving Invalid Credentials error message (even after passing proper authenticated user name, password and domain).

#include "pch.h"
#include <iostream>
#include <Windows.h>
#include <Winldap.h>
#include <plog/Log.h>
#include <string>

#ifdef UNICODE
typedef std::wstring        string_type;
#define CONSOLE_OUT         std::wcout
#define CONSOLE_IN          std::wcin
#define CONSOLE_ERR         std::wcerr
#else
typedef std::string         string_type;
#define CONSOLE_OUT         std::cout
#define CONSOLE_IN          std::cin
#define CONSOLE_ERR         std::cerr
#endif

int main()
{
    SEC_WINNT_AUTH_IDENTITY sec;
    string_type hostName = TEXT("192.168.1.49");
    string_type domain = TEXT("WIN-49MT1TDDGOC.darksorrow.com");
    string_type userName = TEXT("darksorrow\\ds");
    string_type password = TEXT("darksorrow@1234567890");
    PLDAP ld = nullptr;
    int ldapReturnCode;
    CONSOLE_OUT << TEXT("Hello World!\n");
    plog::init(plog::error, "error.dat", 1048576, 3); //1 M.B.
    ld = ldap_init(const_cast<PWSTR>(hostName.c_str()), LDAP_PORT);

    if (ld == nullptr)
    {
        LOG_ERROR << ldap_err2string(LdapGetLastError());
        CONSOLE_OUT << ldap_err2string(LdapGetLastError());
    }
    const int version = LDAP_VERSION3;
    ldapReturnCode = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, std::addressof(version));
    if (ldapReturnCode not_eq LDAP_SUCCESS)
    {
        LOG_ERROR << ldap_err2string(ldapReturnCode);
        CONSOLE_OUT << ldap_err2string(ldapReturnCode);
    }
    ldapReturnCode = ldap_connect(ld, NULL);
    if (ldapReturnCode not_eq LDAP_SUCCESS)
    {
        LOG_ERROR << ldap_err2string(ldapReturnCode);
        CONSOLE_OUT << ldap_err2string(ldapReturnCode);
    }
    PWSTR   dn = nullptr;

    sec.Domain          = (unsigned short *) domain.data();
    sec.DomainLength    = domain.length();
    sec.User            = (unsigned short *) userName.data();
    sec.UserLength      = userName.length();
    sec.Password        = (unsigned short *) password.data();
    sec.PasswordLength  = password.length();
    sec.Flags           = SEC_WINNT_AUTH_IDENTITY_UNICODE;

    CONSOLE_OUT << domain << std::endl;
    CONSOLE_OUT << userName << std::endl;
    CONSOLE_OUT << password << std::endl;

    ldapReturnCode = ldap_bind_s(ld, dn, (PWCHAR)std::addressof(sec), LDAP_AUTH_NEGOTIATE);
    if (ldapReturnCode not_eq LDAP_SUCCESS)
    {
        LOG_ERROR << ldap_err2string(ldapReturnCode);
        CONSOLE_OUT << ldap_err2string(ldapReturnCode);
    }
    else
        CONSOLE_OUT << "Authentication Success\n";
    ldap_unbind(ld);
    return EXIT_SUCCESS;
}

Where am I going wrong?

Answer 1

I decided to give this a try myself. Turns out the solution is simple. Your username should not contain the domain name. So change this:

string_type userName = TEXT("darksorrow\\ds");

to this:

string_type userName = TEXT("ds");

You are already specifying the domain as a separate parameter, so it's not needed as part of the username.

You should be able to still use LDAP_AUTH_NEGOTIATE .