LDAP:清空 binddn"" 并且身份验证类型从 none 变得简单
LDAP: Empty binddn"" and Authentication type becomes simple from none
正在 Spring MVC 和 JPA 中开发具有 Spring 安全性的应用程序。现在通过 LDAP 集成 OUD(Oracle 统一目录)。用户身份验证时,OUD 日志文件中来自 LDAP 的响应是
CONNECT conn=909681 从 ******* 到 *******:1636 协议=LDAPS
绑定请求 conn=909681 op=0 msgID=1 type=SIMPLE dn="" version=3
BindRES conn=909681 op=0 msgID=1 result=1 message="The directory server could not find a network group for the bind dn "” 因为客户端连接不符合任何网络组的连接条件."
DISCONNECT conn=909681 原因="Client Disconnect"
security.xml 文件
中应用程序和 LDAP 之间的映射
<bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<constructor-arg value="ldaps://192.168.0.182:1636/o=company"/>
<property name="userDn" value="cn=userid,o=company,ou=groups"/>
<property name="password" value="password"/>
</bean>
<bean id="ldapAuthProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider" >
<constructor-arg>
<bean class="in.web.service.impl.CustomLdapBindAuthenticator">
<constructor-arg ref="contextSource"/>
<property name="userDnPatterns">
<list>
<value>cn={0},ou=groups</value>
</list>
</property>
</bean>
</constructor-arg>
<constructor-arg>
<bean class="in.web.service.impl.CustomLdapUserAuthoritiesPopulator">
</bean>
</constructor-arg>
</bean>
CustomLdapBindAuthenticator 中的代码
public LdapUserDetails search(String cn) throws Exception {
Hashtable env = new Hashtable();
String sp = "com.sun.jndi.ldap.LdapCtxFactory";
env.put(Context.INITIAL_CONTEXT_FACTORY, sp);
String [] urls = contextSource.getUrls();
for(String url: urls){
System.out.println("ldapurls="+url);
}
env.put(Context.PROVIDER_URL, urls[0]);
DirContext dctx = new InitialDirContext(env);
String base = "ou=groups,o=company";
System.out.println("BASE DN="+base);
SearchControls sc = new SearchControls();
String[] attributeFilter = {"cn", "fullName", "mail", "l", "mobile"};
sc.setReturningAttributes(attributeFilter);
sc.setSearchScope(SearchControls.SUBTREE_SCOPE);
String filter = "(&(cn="+cn+")(objectClass=*))";
NamingEnumeration results = dctx.search(base, filter, sc);
LdapUserDetails user = new LdapUserDetails();
while (results.hasMore()) {
SearchResult sr = (SearchResult) results.next();
Attributes attrs = sr.getAttributes();
user.setCn(getAttribute(attrs, "cn"));
user.setFullName(getAttribute(attrs, "fullName"));
user.setMail(getAttribute(attrs, "mail"));
user.setMobile(getAttribute(attrs, "mobile"));
user.setLocation(getAttribute(attrs, "l"));
}
dctx.close();
return user;
}
Pl。帮我解决问题
- 我没有提到身份验证这么简单。从我在日志文件
中得到type=simple的地方
- 为什么我得到 dn=""
提前致谢
默认身份验证是 "simple Bind",这意味着 DN 和密码。
您没有在环境 env
中设置任何凭据,因此 JNDI 默认尝试执行匿名绑定,即空 DN 和密码。
正在 Spring MVC 和 JPA 中开发具有 Spring 安全性的应用程序。现在通过 LDAP 集成 OUD(Oracle 统一目录)。用户身份验证时,OUD 日志文件中来自 LDAP 的响应是
CONNECT conn=909681 从 ******* 到 *******:1636 协议=LDAPS
绑定请求 conn=909681 op=0 msgID=1 type=SIMPLE dn="" version=3
BindRES conn=909681 op=0 msgID=1 result=1 message="The directory server could not find a network group for the bind dn "” 因为客户端连接不符合任何网络组的连接条件."
DISCONNECT conn=909681 原因="Client Disconnect"
security.xml 文件
中应用程序和 LDAP 之间的映射<bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<constructor-arg value="ldaps://192.168.0.182:1636/o=company"/>
<property name="userDn" value="cn=userid,o=company,ou=groups"/>
<property name="password" value="password"/>
</bean>
<bean id="ldapAuthProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider" >
<constructor-arg>
<bean class="in.web.service.impl.CustomLdapBindAuthenticator">
<constructor-arg ref="contextSource"/>
<property name="userDnPatterns">
<list>
<value>cn={0},ou=groups</value>
</list>
</property>
</bean>
</constructor-arg>
<constructor-arg>
<bean class="in.web.service.impl.CustomLdapUserAuthoritiesPopulator">
</bean>
</constructor-arg>
</bean>
CustomLdapBindAuthenticator 中的代码
public LdapUserDetails search(String cn) throws Exception {
Hashtable env = new Hashtable();
String sp = "com.sun.jndi.ldap.LdapCtxFactory";
env.put(Context.INITIAL_CONTEXT_FACTORY, sp);
String [] urls = contextSource.getUrls();
for(String url: urls){
System.out.println("ldapurls="+url);
}
env.put(Context.PROVIDER_URL, urls[0]);
DirContext dctx = new InitialDirContext(env);
String base = "ou=groups,o=company";
System.out.println("BASE DN="+base);
SearchControls sc = new SearchControls();
String[] attributeFilter = {"cn", "fullName", "mail", "l", "mobile"};
sc.setReturningAttributes(attributeFilter);
sc.setSearchScope(SearchControls.SUBTREE_SCOPE);
String filter = "(&(cn="+cn+")(objectClass=*))";
NamingEnumeration results = dctx.search(base, filter, sc);
LdapUserDetails user = new LdapUserDetails();
while (results.hasMore()) {
SearchResult sr = (SearchResult) results.next();
Attributes attrs = sr.getAttributes();
user.setCn(getAttribute(attrs, "cn"));
user.setFullName(getAttribute(attrs, "fullName"));
user.setMail(getAttribute(attrs, "mail"));
user.setMobile(getAttribute(attrs, "mobile"));
user.setLocation(getAttribute(attrs, "l"));
}
dctx.close();
return user;
}
Pl。帮我解决问题
- 我没有提到身份验证这么简单。从我在日志文件 中得到type=simple的地方
- 为什么我得到 dn=""
提前致谢
默认身份验证是 "simple Bind",这意味着 DN 和密码。
您没有在环境 env
中设置任何凭据,因此 JNDI 默认尝试执行匿名绑定,即空 DN 和密码。