How to store password in ldap server using java

Question

我需要使用Java代码将密码存储在ldap服务器中。在存储密码时，我必须指定ldap可用的任何加密方法。

Answer 1

1) Store password in char[] instead of String Strings are immutable in Java and there is no way you can erase content of String because any modification in String will result in a new String. Also Strings are cached in String pool which pose a security risk of exposing password in clear text to anyone who has access to memory of java application. even an accident like core dump of java application, generating memory dump in /tmp can put passwords in real threat. by using char[] you can erase convents by setting it blank or any other character which reduces security risk of exposing password. See Why char array is better than String for storing password in Java for more detail

2) Always use encrypted password in Application This is one step further from earlier tip, instead of Storing password or sensitive information in clear text always store them in encrypted or hashed format. This reduces risk of exposing password to any stranger who some how has access of application memory while you are performing authentication.

Read more: http://javarevisited.blogspot.com/2012/05/best-practices-while-dealing-with.html#ixzz3KGjhHlps

new BasicAttribute("password", passValue)

i think we dont want to specify ..it automatically encrypt into ldap configuration

Answer 2

When you are inserting a new entry in LDAP through JNDI, you need to create the entry by giving all its object hierarchy. For inetOrgPerson, the password is in an attribute called userPassword (optional attribute in 'person' object in core schema.

You have to create a number of attributes (in BasicAttributes object), as according to the schemas (including meta attributes, like NAME, SUP, STRUCTURAL, etc., refer URLS for schema structure)in your case, core and inetOrgPerson schema:

http://www.zytrax.com/books/ldap/ape/inetorgperson.html http://www.zytrax.com/books/ldap/ape/core-schema.html#organizationalperson

Once you have the object prepared, user context.rebind

NOTE: All LDAP implementations are different and you may get some unexpected results for example, in the above method, you will get additional attributes (non-LDAP operational attributes) in the bound object in Apace DS. The workaround is to use Apache LDAP API (refer: http://directory.apache.org/api/ ). In MS ActiveDirectory, you may face other issues. JNDI is good to read entries but not very great to write/put-in entries