Spring LDAP 查询生成器 PartialResultException

Question

我正在尝试从我的 LDAP 服务器获取所有用户，从基础进行搜索，这是我的代码：

public LdapTemplate ldapTemplate() {
        LdapContextSource ctxSrc = new LdapContextSource();
        ctxSrc.setUrl("ldap://127.0.0.1:389/");
        ctxSrc.setBase("dc=test,dc=com");
        ctxSrc.setUserDn("admin");
        ctxSrc.setPassword("password");
        ctxSrc.afterPropertiesSet();
        LdapTemplate lt = new LdapTemplate(ctxSrc);
        return lt;
}
private LdapTemplate ldapTemplate = ldapTemplate();
public List<User> getAllUsers() {

        LdapQuery query= query().base("").where("objectclass").is("user");
        return ldapTemplate.search(query, new UserAttributesMapper());
}

这是错误：

10:07:09.406 [main] DEBUG o.s.l.c.s.AbstractContextSource - AuthenticationSource not set - using default implementation
10:07:09.413 [main] DEBUG o.s.l.c.s.AbstractContextSource - Not using LDAP pooling
10:07:09.416 [main] DEBUG o.s.l.c.s.AbstractContextSource - Trying provider Urls: ldap://127.0.0.1:389/dc=test,dc=com
10:07:09.548 [main] DEBUG o.s.l.c.s.AbstractContextSource - Got Ldap context on server 'ldap://127.0.0.1:389/dc=test,dc=com'
Exception in thread "main" org.springframework.ldap.PartialResultException: Unprocessed Continuation Reference(s); nested exception is javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name '/'
    at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:216)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:385)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:309)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:616)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:586)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:1651)
    at ldap.example.UserRepositoryImpl.getAllUsers(UserRepositoryImpl.java:81)
    at ldap.example.test.LdapApp.main(LdapApp.java:23)
Caused by: javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name '/'
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2914)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2888)
    at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.getNextBatch(AbstractLdapNamingEnumeration.java:148)
    at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(AbstractLdapNamingEnumeration.java:217)
    at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMore(AbstractLdapNamingEnumeration.java:189)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:365)
    ... 6 more

BUILD FAILED (total time: 1 second)

当我按 ou 过滤时它有效，但我需要从根过滤。

Answer 1

您在问题评论中写道，更改端口有帮助。但是改变端口并不能解决这个问题。端口 3268 指向 Active Directory 特殊位置 - 全局目录。有所有对象的集合 - 但每个对象只有一小部分属性（例如 distinguishedName、cn、sAMAccountName ...）。所以 - 它一直有效，直到您不需要更具体的属性。

问题分析

发生异常是因为 AD 作为您查询的结果 returns referral objects:

[Active Directory] (...) generate referrals in response to queries that request data about objects that exist in the forest, but not contained on the directory server handling the request. These are called internal cross references, because they refer to domains, schema, and configuration containers within the forest.

如果推荐追踪被禁用：

If referral chasing is not enabled and a subtree search is performed, the search will return all objects within the specified domain that meet the search criteria. The search will also return referrals to any subordinate domains that are direct descendants of the directory server domain. The client must resolve the referrals by binding to the path specified by the referral and submitting another query.

您可以启用推荐追逐，但它会产生成本 - 它会减慢应用程序 - 您可以阅读此内容 here。而且我认为在大多数情况下是没有必要的。

解决方案一：

有时，足够的解决方案是在您的问题中分配更具体的 baseDN - ctxSrc.setBase() 方法。也许您所有的用户都在内部路径中，例如 "ou=user,dc=department,dc=test,dc=com".

在 this answer 阅读更多内容。

方案二：

在Spring LdapTemplate中你也可以用方法setIgnorePartialResultException()忽略这个异常：

ldapTemplate.setIgnorePartialResultException(true);

在阅读更多内容。

Spring LDAP 查询生成器 PartialResultException

Spring LDAP querybuilder PartialResultException

spring

spring-ldap