使用 Active Directory LDAP 进行多个 CN 组身份验证

Question

Using Active Directory with Spring for LDAP, If I specify the exact directory (base) of the search, for example String base="CN=Administrators" search/authentication finds the user, but if passed to the method .authenticate(String base="", filter, password) , where base is an empty string, then it does not find it and gives an error

ldapTemplate.authenticate("", MessageFormat.format("(SamAccountName={0})", login), "password")

//error
org.springframework.ldap.PartialResultException: Unprocessed Continuation Reference(s); 
nested exception is javax.naming.PartialResultException: Unprocessed Continuation Reference(s);
remaining name '/'

Moreover, if I connect to OpenLDAP and not to Active Directory, it allows me to specify an empty string LdapTemplate.authenticate(String base="", filter, password) and finds the user. As I understand it, OpenLDAP allows to search through all groups, which is what I need.

For example I have several CN Groups like CN=Administrators , CN=FreeUsers , CN=System etc with many CN users inside. How to allow Active Directory search through all of them on authenticate?

Answer 1

I solved this issue by adding configuration to LdapTemplate. Now template finds users in AD without specifying the base.

was

@Bean
public LdapTemplate ldapTemplate() {
    LdapTemplate ldapTemplate = new LdapTemplate(contextSource());
    return ldapTemplate;
}

now

@Bean
public LdapTemplate ldapTemplate() {
    LdapTemplate ldapTemplate = new LdapTemplate(contextSource());
    ldapTemplate.setIgnorePartialResultException(true);
    return ldapTemplate;
}

Answer 2

Active Directory doesn't like empty string unless the search scope is set to base to discover the RootDSE. Nevertheless Active Directory supports the LDAP_SERVER_SEARCH_OPTIONS_OID control , especially the control value SERVER_SEARCH_FLAG_PHANTOM_ROO:

This enables search bases such as the empty string, which would cause the server to search all of the NC replicas (except for application NCs on AD DS DCs) that it holds.

Using Spring for LDAP, you probably have to inherit from AbstractRequestControlDirContextProcessor.java . You may inspire from others controls already defined and include this new control in your search.