[英]Spring Security & Active Directory LDAP Error 32 problem 2001 (NO_OBJECT)
I am trying to authenticate a user again AD LDS\\ADAM using the Spring framework and Spring Security 3.0. 我正在尝试使用Spring框架和Spring Security 3.0再次验证用户AD LDS \\ ADAM。 I keep getting the following error and hopefully someone from here can explain where the problem lies.
我一直收到以下错误,希望有来自这里的人可以解释问题所在。
[LDAP: error code 32 - 0000208D: NameErr: DSID-0315258B, problem 2001 (NO_OBJECT), data 0, best match of: 'CN=Users,DC=Domain,DC=local' ]; nested exception is javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-0315258B, problem 2001 (NO_OBJECT), data 0, best match of: 'CN=Users,DC=Domain,DC=local' ]; remaining name 'cn=Mo Logan,cn=Users,dc=Domain,dc=local'
Can anyone explain what the best match of and remaining name bits mean - this is really confusing me? 任何人都可以解释什么是最好的匹配和剩余的名称位意味着 - 这真的让我感到困惑? Is this type of search case sensitive?
这种搜索案例是否敏感? And would problems like time differences between the server and client make a difference?
服务器和客户端之间的时差会产生影响吗?
From what I have read online error code 32 means that object cant be found - very helpful I'm sure you'll agree. 从我在网上看到的错误代码32意味着找不到对象 - 非常有帮助我相信你会同意的。 Here is the configuration information which I am using:
这是我正在使用的配置信息:
<authentication-manager alias="ldapAuthenicationManager">
<ldap-authentication-provider
user-search-base="cn=Users,dc=Domain,dc=local"
user-search-filter="(uid={0})"
role-prefix="Users"
/>
</authentication-manager>
<ldap-server url="ldap://server:50006/" manager-dn="CN=Admin,CN=Users,DC=Domain,DC=local" manager-password="Password101" />
I am searching by uid (no SAMAccountName in LDS) and when I search by the same criteria using ldap.exe on the server I can find the user correctly eg: 我正在搜索uid(在LDS中没有SAMAccountName),当我使用服务器上的ldap.exe按相同条件搜索时,我可以正确找到用户,例如:
ldap_search_s(ld, "CN=Users,DC=Domain,DC=local", 2, "(uid=mologan)", attrList, 0, &msg)
***Searching...
ldap_search_s(ld, "CN=Users,DC=Domain,DC=local", 2, "(uid=mologan)", attrList, 0, &msg)
Getting 1 entries:
Dn: CN=Mo Logan,CN=Users,DC=Domain,DC=local
badPasswordTime: 9/20/2011 1:19:51 PM GMT Standard Time;
badPwdCount: 0;
cn: Mo Logan;
distinguishedName: CN=Mo Logan,CN=Users,DC=Domain,DC=local;
dSCorePropagationData: 0x0 = ( );
instanceType: 0x4 = ( WRITE );
lastLogonTimestamp: 9/20/2011 9:10:32 AM GMT Standard Time;
lockoutTime: 0;
memberOf (2): CN=DMSUsers,CN=Users,DC=Domain,DC=local; CN=Users,CN=Roles,CN=Users,DC=Domain,DC=local;
msDS-UserAccountDisabled: FALSE;
name: Mo Logan;
objectCategory: CN=Person,CN=Schema,CN=Configuration,CN={BD500A33-CE7C-492F-9007-BF1B17F972EE};
objectClass (4): top; person; organizationalPerson; user;
objectGUID: 40f74ed4-6cf3-495e-a28c-6aa080a0333b;
objectSid: S-1-514506224-2209559093-2723712157-1234827279-3369888698-2052446679;
pwdLastSet: 9/20/2011 8:19:06 AM GMT Standard Time;
uid: mologan;
uSNChanged: 13994;
uSNCreated: 13985;
whenChanged: 9/20/2011 9:10:32 AM GMT Standard Time;
whenCreated: 9/20/2011 8:16:54 AM GMT Standard Time;
I am binding to AD LDS as an administrator account which belongs to the reader group under roles. 我绑定到AD LDS作为管理员帐户,属于角色下的读者组。 This user sits at the same level as the username I am trying to verify.
此用户与我尝试验证的用户名处于同一级别。
As you can probably tell I am flat out of ideas as to why I am getting this error and hopefully someone will be able to help me out or point me in the right direction, 正如你可能会说我对于为什么我会收到这个错误的想法一无所知,希望有人能够帮助我或指出我正确的方向,
Cheers & thanks in advance 欢呼和感谢提前
I think I finally got to the bottom of this, hopefully this will help someone else. 我想我终于到底了,希望这会帮助别人。 Below is the configuration for my security:
以下是我的安全配置:
<authentication-manager alias="ldapAuthenicationManager">
<ldap-authentication-provider
user-search-filter="(uid={0})"
group-search-filter="(member=userGroup)"
>
</ldap-authentication-provider>
</authentication-manager>
<ldap-server url="ldap://server:50006/CN=Users,CN=Domain,CN=local" manager-dn="Cn=Admin,CN=Domain,CN=local" manager-password="Password101" />
I had to create a user in LDS called admin and allocated it to the reader role in LDS (if you dont have this, import it from the ldf files provided for LDS). 我必须在LDS中创建一个名为admin的用户,并将其分配给LDS中的reader角色(如果你没有这个,请从为LDS提供的ldf文件中导入它)。 Now create a user and then a group, adding the user to the group created in AD
现在创建一个用户,然后创建一个组,将用户添加到在AD中创建的组
At this point I was getting Ldap error 32. After a debugging through the spring security code and looking at the event logs of the server I guessed that the problem was with how AD LDS was set up. 此时我收到了Ldap错误32.在通过spring安全代码进行调试并查看服务器的事件日志之后,我猜测问题出在AD LDS的设置方式上。 After a lot of fiddling and guess work I stumbled upon the problem.
经过大量的摆弄和猜测工作,我偶然发现了问题。
To resolve this I ended up adding the user I wanted to log in with (not the manager-dn) to the reader group to allow a successful bind. 为了解决这个问题,我最终将我想要登录的用户(不是manager-dn)添加到阅读器组以允许成功绑定。 Doing that resolved the problem.
这样做解决了这个问题。
Hopefully this is of use? 希望这有用吗?
I notice a strange thing in your question. 我发现你的问题很奇怪。 your make a search :
你做了一个搜索:
ldap_search_s(ld, "CN=Users,DC=Domain,DC=local", 2, "(uid=mologan)", attrList, 0, &msg)
with (uid=mologan)
as a filter and the result return uid: chweeks
is it just a typo copy/past from result of another search ? 使用
(uid=mologan)
作为过滤器并且结果返回uid: chweeks
它只是一个错字复制/过去另一个搜索的结果?
another thing you wrote about LDAP.EXE
you mean LDP.EXE
你写的关于
LDAP.EXE
另一件事你的意思是LDP.EXE
----EDITED------ ---- ------ EDITED
Can you try this kind of configuration 你能试试这种配置吗?
<authentication-manager alias="ldapAuthenicationManager">
<ldap-authentication-provider
user-search-base="cn=Users"
user-search-filter="(uid={0})"
role-prefix="Users"
/>
</authentication-manager>
<ldap-server url="ldap://server:50006/dc=Domain,dc=local" manager-dn="CN=Admin,CN=Users,DC=Domain,DC=local" manager-password="Password101" />
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.