JNDI search not working after GSSAPI (Authenticate with Kerberos)

Question

I got below example from internet to test GSSAPI with JNDI.

public class GssExample {

    public static void main(String[] args) {

        System.setProperty("java.security.auth.login.config", "C:\\gssapi_jaas.conf");
        System.setProperty("java.security.krb5.conf", "C:\\krb5.conf");

        LoginContext lc = null;
        try {
            lc = new LoginContext(GssExample.class.getName(),
                    new LoginCallBackHandler());
            lc.login();

        } catch (LoginException le) {
        }

        Subject.doAs(lc.getSubject(), new JndiAction(args));
    }
}

class JndiAction implements java.security.PrivilegedAction {

    public Object run() {
        performJndiOperation(args);
        return null;
    }

    private static void performJndiOperation(String[] args) {
        Hashtable<String, String> env = new Hashtable<String, String>(11);

        env.put(Context.INITIAL_CONTEXT_FACTORY,
                "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL,
                "ldap://XXXX.domain.lab:389/OU=StackOverFlow,dc=domain,dc=lab");
        env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
        env.put("javax.security.sasl.server.authentication", "true");

        try {

            DirContext ctx = new InitialDirContext(env);
            // Fails here with exception as shown below
            NamingEnumeration<SearchResult> _result = ctx.search("DC=domain,DC=lab","(objectClass=User)", null);
            ctx.close();
        } catch (NamingException e) {
            e.printStackTrace();
        }
    }

I get the exception as

javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-03100241, problem 2001 (NO_OBJECT), data 0, best match of: 'OU=StackOverFlow,DC=domain,DC=lab'

Please note: The OU exists on AD system.

Code for LoginCallBackHandler is as under

class LoginCallBackHandler implements CallbackHandler {

    @Override
    public void handle(Callback[] callbacks) throws IOException,
            UnsupportedCallbackException {
        if(callbacks != null && callbacks.length > 0) {
            if(callbacks[0] instanceof NameCallback) {
                ((NameCallback)(callbacks[0])).setName("User@DOMAIN.LAB");
            }
            else if(callbacks[0] instanceof PasswordCallback) {
                ((PasswordCallback)(callbacks[0])).setPassword("Password".toCharArray());
            }
        }
    }
}

Am I missing something or am I doing something wrong ?

Answer 1

The error has nothing to do with authentication. You are incorrectly using LDAP searches. You have already limited your search base DN ldap://XXXX.domain.lab:389/OU=StackOverFlow,dc=domain,dc=lab . You then provided ctx.search("DC=domain,DC=lab",... , but there is no tree DC=domain,DC=lab,OU=StackOverFlow,dc=domain,dc=lab .

Either provide another LDAP URL with RootDSE only, or provide an emptry string to search() .