[英]com.unboundid.ldap.sdk.controls.PasswordExpiredControl is not detecting expired password (Java)
public Boolean checkExpiration(String user, String pass) throws LDAPException {
SSLSocketFactory socketFactory = null;
try {
socketFactory = createFactory();
} catch (Exception e) {
// CreateFactory Exception
e.printStackTrace();
}
// Create a secure connection to the Active Directory server.
final LDAPConnection connection = new LDAPConnection(socketFactory, myHost, (Integer.parseInt(portLdap)),
bindDN, passDN);
// Send a simple bind request to the directory server.
BindRequest bindRequest = new SimpleBindRequest("uid=example1,ou=Corporate Users,dc=example,dc=com", pass);
BindResult bindResult;
boolean passwordExpired;
try {
bindResult = connection.bind(bindRequest);
// If we got here, the bind was successful and we know the password was
// not expired. However, we shouldn't ignore the result because the
// password might be about to expire. To determine whether that is the
// case, we should see if the bind result included a password expiring
// control. I'm not interested on this.
passwordExpired = false;
return passwordExpired;
} catch (LDAPException le) {
// If we got here, then the bind failed. The failure may or may not have
// been due to an expired password. To determine that, we should see if
// the bind result included a password expired control.
bindResult = new BindResult(le.toLDAPResult());
ResultCode resultCode = le.getResultCode();
String errorMessageFromServer = le.getDiagnosticMessage();
PasswordExpiredControl expiredControl = PasswordExpiredControl.get(le);
passwordExpired = expiredControl != null;
return passwordExpired;
} finally {
connection.close();
}
}
現在,我已經使用此命令檢查了用戶在 openldap 主機中的密碼是否已過期
# ldapwhoami -H ldaps://localhost:636 -W -D "uid=example1,ou=Corporate Users,dc=example,dc=com" -e ppolicy -v
響應是
ldap_initialize( ldaps://localhost:636/??base )
Enter LDAP Password:
ldap_bind: Invalid credentials (49); Password expired
所以問題是發生了什么? 為什么沒有檢測到密碼過期?
PD:我調試了 expiringControl 值,它返回null
並且 le(LDAPException) 值為LDAPException(resultCode=49 (invalid credentials), errorMessage='invalid credentials', ldapSDKVersion=5.1.0, revision=89705d759f7c1ab3bccb2870f8c2e7d529ed231b)
最后,我已經結束在 UnboundID 論壇( https://sourceforge.net/p/ldap-sdk/discussion/1001257/thread/e95d52b047/#210f )上發布問題,他們回答得非常快。
所以這是解決方案。 由於我的 OpenLDAP 不支持 PasswordExpiredControl,我添加了新元素,因此我添加了DraftBeheraLDAPPasswordPolicy10ResponseControl
並將綁定從new SimpleBindRequest(dn, password)
更改為new SimpleBindRequest(dn, password, new DraftBeheraLDAPPasswordPolicy10RequestControl())
。 最終腳本如下。
public Boolean checkExpiration(String user, String pass) throws LDAPException {
String cn = getCNFromUser(user);
SSLSocketFactory socketFactory = null;
try {
socketFactory = createFactory();
} catch (Exception e) {
// CreateFactory Exception
e.printStackTrace();
}
// Create a secure connection to the Active Directory server.
final LDAPConnection connection = new LDAPConnection(socketFactory, myHost, (Integer.parseInt(portLdap)),
bindDN, passDN);
// Send a simple bind request to the directory server.
BindRequest bindRequest = new SimpleBindRequest("cn=" + cn + ",dc=test,dc=com", pass,
new DraftBeheraLDAPPasswordPolicy10RequestControl());
BindResult bindResult;
boolean passwordExpired;
try {
bindResult = connection.bind(bindRequest);
// If we got here, the bind was successful and we know the password was
// not expired. However, we shouldn't ignore the result because the
// password might be about to expire. To determine whether that is the
// case, we should see if the bind result included a password expiring
// control.
passwordExpired = false;
return passwordExpired;
} catch (LDAPException le) {
// If we got here, then the bind failed. The failure may or may not have
// been due to an expired password. To determine that, we should see if
// the bind result included a password expired control.
bindResult = new BindResult(le.toLDAPResult());
PasswordExpiredControl expiredControl = PasswordExpiredControl.get(le);
// Checking if the expiredControl is not null, then it has an expired password
passwordExpired = expiredControl != null;
if (passwordExpired) {
return passwordExpired;
}
// Obtaining control for password policy, this in case there's no support for
// PasswordExpiredControl in LDAP server
DraftBeheraLDAPPasswordPolicy10ResponseControl pwpResponse = DraftBeheraLDAPPasswordPolicy10ResponseControl
.get(bindResult);
if (pwpResponse != null) {
// Getting error type
DraftBeheraLDAPPasswordPolicy10ErrorType errorType = pwpResponse.getErrorType();
if (errorType != null) {
// There was a password policy error.
passwordExpired = errorType.name().matches("PASSWORD_EXPIRED");
if (!passwordExpired) {
System.out.print("There was other error: " + errorType.name());
}
}
}
return passwordExpired;
}
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.