查询以检索用户在 LDAP 中所属的所有组

Question

At the same time of providing authentication to the user in LDAP within Microsoft Active Directory, I'm trying to get all groups that specific user belongs to. The following code is in Java. What I'm doing at the moment is the following:

public static List authenticate(String username, String password) throws Exception {

        String LDAPURL = MY_LDAP_URL;
        String userBase = MY_USERBASE; //format "dc=***,dc=com"
        ArrayList<String> groups = new ArrayList<String>();

        Hashtable<String, String> environment = new Hashtable<String, String>();
        environment.put(Context.INITIAL_CONTEXT_FACTORY,
                "com.sun.jndi.ldap.LdapCtxFactory");
        environment.put(Context.PROVIDER_URL, LDAPURL);
        environment.put(Context.SECURITY_AUTHENTICATION, "simple");

        environment.put(Context.SECURITY_PRINCIPAL, username);
        environment.put(Context.SECURITY_CREDENTIALS, password);

        DirContext ctx =
                    new InitialDirContext(environment);
        SearchControls ctls = new SearchControls();
        String[] attributes = {"cn", "memberOf"};
        ctls.setReturningAttributes(attributes);
        ctls.setSearchScope( SearchControls.SUBTREE_SCOPE );

       
        String searchFilters = "{sAMAccountName="+username+"}";
        NamingEnumeration<?> answer = ctx.search(userBase, searchFilters, ctls);
        if(answer == null || !answer.hasMore()) {
            logger.info("No result found");
        }

        else {
          SearchResult result = (SearchResult) answer.next();
          Attributes attrs = result.getAttributes();
          Attribute memberAttr = attrs.get("memberOf");
          NamingEnumeration e = memberAttr.getAll();
          while(e.hasMore()) {
              String group = (String) e.next();
              groups.add(group);
              logger.info(group);
           }
        }
        return groups;

     }

I have tried several ways of doing my query, for example:

String searchFilters = "(&(uid="+username+"),(ou=users),(memberOf=*))"

Or

String searchFilters = "(&(objectClass=groupOfNames)(member=cn=" + username + ")(memberOf=*))"

Or

String searchFilters = "(&(userPrincipalName=" + username + ")(memberOf=*))"

In none of the cases any groups were retrieved. In some of the cases the login itself failed as well (in some cases it worked but still no groups returned). What is the correct way to retrieve the groups?

Answer 1

Although you can bind with "username" and some other attributes, using ANR , ONLY when using Microsoft Active Directory, you will need to obtain the Fully Distinguished Name for the user to perform many LDAP Searches.

Assuming username is the samAccountName, which is always Unique within a AD Forrest, your Authentication should work.

After Authentication you can obtain the DN of the entry and then perform a search for Groups the user is a member. For all groups the user is a member, including nested groups this will usually work .

(member:1.2.840.113556.1.4.1941:=(CN=UserName,CN=Users,DC=YOURDOMAIN,DC=NET))

We have several JNDI Examples in a code repository .