Java LDAP - 确定给定组中的用户？

问题描述：

我们使用Java LDAP API通过LDAP将用户登录到Active Directory。我们希望增强我们的登录功能，以进一步检查用户是否在给定的AD组中。有谁知道如何做到这一点？Java LDAP - 确定给定组中的用户？

当前代码：

import javax.naming.*; 
import javax.naming.ldap.*; 

LdapContext ctx = null; 
Hashtable env = new Hashtable(); 
env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory"); 
env.put(Context.SECURITY_AUTHENTICATION,"simple"); 
env.put(Context.PROVIDER_URL, Config.get("ldap-url")); 

try { 
    Control[] connCtls = new Control[] {new FastBindConnectionControl()}; 
    ctx = new InitialLdapContext(env, connCtls); 
    ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, "DOMAIN\\" + username); 
    ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password); 
    ctx.reconnect(connCtls); 
    /* TODO: Only return true if user is in group "ABC" */ 
    return true; //User authenticated 
} catch (Exception e) { 
    return false; //User could NOT be authenticated 
} finally { 
    ... 
}

更新：请参见下面的解决方案。

答

我们用下面的类来解决这个问题。只需调用在认证方法：

import java.text.MessageFormat; 
import java.util.*;  
import javax.naming.*;  
import org.apache.log4j.Level; 

public class LdapGroupAuthenticator { 
    public static final String DISTINGUISHED_NAME = "distinguishedName"; 
    public static final String CN = "cn"; 
    public static final String MEMBER = "member"; 
    public static final String MEMBER_OF = "memberOf"; 
    public static final String SEARCH_BY_SAM_ACCOUNT_NAME = "(SAMAccountName={0})"; 
    public static final String SEARCH_GROUP_BY_GROUP_CN = "(&(objectCategory=group)(cn={0}))"; 

    /* 
    * Prepares and returns CN that can be used for AD query 
    * e.g. Converts "CN=**Dev - Test Group" to "**Dev - Test Group" 
    * Converts CN=**Dev - Test Group,OU=Distribution Lists,DC=DOMAIN,DC=com to "**Dev - Test Group" 
    */ 
    public static String getCN(String cnName) { 
     if (cnName != null && cnName.toUpperCase().startsWith("CN=")) { 
      cnName = cnName.substring(3); 
     } 
     int position = cnName.indexOf(','); 
     if (position == -1) { 
      return cnName; 
     } else { 
      return cnName.substring(0, position); 
     } 
    } 
    public static boolean isSame(String target, String candidate) { 
     if (target != null && target.equalsIgnoreCase(candidate)) { 
      return true; 
     } 
     return false; 
    } 

    public static boolean authenticate(String domain, String username, String password) { 
     Hashtable env = new Hashtable(); 
     env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory"); 
     env.put(Context.PROVIDER_URL, "ldap://1.2.3.4:389"); 
     env.put(Context.SECURITY_AUTHENTICATION, "simple"); 
     env.put(Context.SECURITY_PRINCIPAL, domain + "\\" + username); 
     env.put(Context.SECURITY_CREDENTIALS, password); 
     DirContext ctx = null; 
     String defaultSearchBase = "DC=DOMAIN,DC=com"; 
     String groupDistinguishedName = "DN=CN=DLS-APP-MyAdmin-C,OU=DLS File Permissions,DC=DOMAIN,DC=com"; 

     try { 
      ctx = new InitialDirContext(env); 

      // userName is SAMAccountName 
      SearchResult sr = executeSearchSingleResult(ctx, SearchControls.SUBTREE_SCOPE, defaultSearchBase, 
        MessageFormat.format(SEARCH_BY_SAM_ACCOUNT_NAME, new Object[] {username}), 
        new String[] {DISTINGUISHED_NAME, CN, MEMBER_OF} 
        ); 

      String groupCN = getCN(groupDistinguishedName); 
      HashMap processedUserGroups = new HashMap(); 
      HashMap unProcessedUserGroups = new HashMap(); 

      // Look for and process memberOf 
      Attribute memberOf = sr.getAttributes().get(MEMBER_OF); 
      if (memberOf != null) { 
       for (Enumeration e1 = memberOf.getAll() ; e1.hasMoreElements() ;) { 
        String unprocessedGroupDN = e1.nextElement().toString(); 
        String unprocessedGroupCN = getCN(unprocessedGroupDN); 
        // Quick check for direct membership 
        if (isSame (groupCN, unprocessedGroupCN) && isSame (groupDistinguishedName, unprocessedGroupDN)) { 
         Log.info(username + " is authorized."); 
         return true; 
        } else { 
         unProcessedUserGroups.put(unprocessedGroupDN, unprocessedGroupCN); 
        } 
       } 
       if (userMemberOf(ctx, defaultSearchBase, processedUserGroups, unProcessedUserGroups, groupCN, groupDistinguishedName)) { 
        Log.info(username + " is authorized."); 
        return true; 
       } 
      } 

      Log.info(username + " is NOT authorized."); 
      return false; 
     } catch (AuthenticationException e) { 
      Log.info(username + " is NOT authenticated"); 
      return false; 
     } catch (NamingException e) { 
      throw new SystemException(e); 
     } finally { 
      if (ctx != null) { 
       try { 
        ctx.close(); 
       } catch (NamingException e) { 
        throw new SystemException(e); 
       } 
      } 
     } 
    } 

    public static boolean userMemberOf(DirContext ctx, String searchBase, HashMap processedUserGroups, HashMap unProcessedUserGroups, String groupCN, String groupDistinguishedName) throws NamingException { 
     HashMap newUnProcessedGroups = new HashMap(); 
     for (Iterator entry = unProcessedUserGroups.keySet().iterator(); entry.hasNext();) { 
      String unprocessedGroupDistinguishedName = (String) entry.next(); 
      String unprocessedGroupCN = (String)unProcessedUserGroups.get(unprocessedGroupDistinguishedName); 
      if (processedUserGroups.get(unprocessedGroupDistinguishedName) != null) { 
       Log.info("Found : " + unprocessedGroupDistinguishedName +" in processedGroups. skipping further processing of it..."); 
       // We already traversed this. 
       continue; 
      } 
      if (isSame (groupCN, unprocessedGroupCN) && isSame (groupDistinguishedName, unprocessedGroupDistinguishedName)) { 
       Log.info("Found Match DistinguishedName : " + unprocessedGroupDistinguishedName +", CN : " + unprocessedGroupCN); 
       return true; 
      } 
     } 

     for (Iterator entry = unProcessedUserGroups.keySet().iterator(); entry.hasNext();) { 
      String unprocessedGroupDistinguishedName = (String) entry.next(); 
      String unprocessedGroupCN = (String)unProcessedUserGroups.get(unprocessedGroupDistinguishedName); 

      processedUserGroups.put(unprocessedGroupDistinguishedName, unprocessedGroupCN); 

      // Fetch Groups in unprocessedGroupCN and put them in newUnProcessedGroups 
      NamingEnumeration ns = executeSearch(ctx, SearchControls.SUBTREE_SCOPE, searchBase, 
        MessageFormat.format(SEARCH_GROUP_BY_GROUP_CN, new Object[] {unprocessedGroupCN}), 
        new String[] {CN, DISTINGUISHED_NAME, MEMBER_OF}); 

      // Loop through the search results 
      while (ns.hasMoreElements()) { 
       SearchResult sr = (SearchResult) ns.next(); 

       // Make sure we're looking at correct distinguishedName, because we're querying by CN 
       String userDistinguishedName = sr.getAttributes().get(DISTINGUISHED_NAME).get().toString(); 
       if (!isSame(unprocessedGroupDistinguishedName, userDistinguishedName)) { 
        Log.info("Processing CN : " + unprocessedGroupCN + ", DN : " + unprocessedGroupDistinguishedName +", Got DN : " + userDistinguishedName +", Ignoring..."); 
        continue; 
       } 

       Log.info("Processing for memberOf CN : " + unprocessedGroupCN + ", DN : " + unprocessedGroupDistinguishedName); 
       // Look for and process memberOf 
       Attribute memberOf = sr.getAttributes().get(MEMBER_OF); 
       if (memberOf != null) { 
        for (Enumeration e1 = memberOf.getAll() ; e1.hasMoreElements() ;) { 
         String unprocessedChildGroupDN = e1.nextElement().toString(); 
         String unprocessedChildGroupCN = getCN(unprocessedChildGroupDN); 
         Log.info("Adding to List of un-processed groups : " + unprocessedChildGroupDN +", CN : " + unprocessedChildGroupCN); 
         newUnProcessedGroups.put(unprocessedChildGroupDN, unprocessedChildGroupCN); 
        } 
       } 
      } 
     } 
     if (newUnProcessedGroups.size() == 0) { 
      Log.info("newUnProcessedGroups.size() is 0. returning false..."); 
      return false; 
     } 

     // process unProcessedUserGroups 
     return userMemberOf(ctx, searchBase, processedUserGroups, newUnProcessedGroups, groupCN, groupDistinguishedName); 
    } 

    private static NamingEnumeration executeSearch(DirContext ctx, int searchScope, String searchBase, String searchFilter, String[] attributes) throws NamingException { 
     // Create the search controls 
     SearchControls searchCtls = new SearchControls(); 

     // Specify the attributes to return 
     if (attributes != null) { 
      searchCtls.setReturningAttributes(attributes); 
     } 

     // Specify the search scope 
     searchCtls.setSearchScope(searchScope); 

     // Search for objects using the filter 
     NamingEnumeration result = ctx.search(searchBase, searchFilter,searchCtls); 
     return result; 
    } 

    private static SearchResult executeSearchSingleResult(DirContext ctx, int searchScope, String searchBase, String searchFilter, String[] attributes) throws NamingException { 
     NamingEnumeration result = executeSearch(ctx, searchScope, searchBase, searchFilter, attributes); 

     SearchResult sr = null; 
     // Loop through the search results 
     while (result.hasMoreElements()) { 
      sr = (SearchResult) result.next(); 
      break; 
     } 
     return sr; 
    } 
}

请注意，这并不完全，因为组可以嵌套在Active Directory中，所以您不会因为是另一个组的成员而获得作为组成员的用户。这样做的正确方法是将包含组的用户的tokenGroups属性作为SID列表，但这是需要解码的二进制属性。请参阅：http://blogs.msdn.com/alextch/archive/2007/06/18/sample-java-application-that-retrieves-group-membership-of-an-active-directory-user-account.aspx – 2010-04-08 13:08:25

答

不幸的是，答案因安装AD以及其他类型的LDAP服务器而异。我们不得不解决同样的问题。最后，我们允许系统管理员向我们提供一个LDAP查询模式，在这里我们用用户名（和组名称，如果需要变量的话）替换为模式。

谢谢。为什么答案会有所不同？似乎是一个非常标准的查询..你碰巧有一个代码示例，利用您的LDAP查询？ – 2009-02-20 19:59:24

我怀疑它由于AD如何处理memberOf而在AD的哪个版本中有所不同。它将组成员资格存储在组中，而不是存储在用户对象上。用户的memberOf属性并不存在，并且可以即时计算。更好的LDAP服务器将它存储在两个地方，正如您所期望的那样 – geoffc 2009-02-23 10:36:06

答

我不能给你一个使用java命名ldap的工作代码。我使用过Spring LDAP，你做的方式：获取用户对象，做用户名像sAMAccountName赋搜索= USERNAME

后你得到你retreive属性的memberOf对象 - >这将是一个列出并在Java中检查特定的一个。

这是我能想到的唯一方法。

答

不确定关于Java API的具体情况，但这样做的通用方法是在查询/绑定中添加组检查。

答

发现用户是否是一个组的成员的LDAP查找方法是不正确的，特别是如果你在谈论一个登录的用户。对于实际登录到组列表中的用户而定，取决于用户登录的计算机。该列表需要包括域信任组，嵌套组和本地组的组。

如果您正在寻找当前登录的用户的组成员资格或用Java用户名和密码登录的用户，请尝试Waffle。

IWindowsAuthProvider prov = new WindowsAuthProviderImpl(); 
IWindowsIdentity identity = prov.logonUser("username", "password"); 
System.out.println("User identity: " + identity.getFqn()); 
for(IWindowsAccount group : identity.getGroups()) { 
    System.out.println(" " + group.getFqn() + " (" + group.getSidString() + ")"); 
}

这看起来很有希望。但我在这里发现了一个问题。我创建了一个本地组“测试”。在此我手动添加当前用户。当我跑上面的代码时，它没有给我看“测试”组。任何指针都可以帮助我。 – 2015-02-12 07:50:51

确保它是一个安全组，https://technet.microsoft.com/en-us/library/cc781446%28v=ws.10%29.aspx。 – 2015-02-19 09:01:13

答

以上代码片段都不适用于我。在Google和tomcat源代码上花费1天后，以下代码可以很好地找到用户组。

import java.util.Hashtable; 

import javax.naming.CompositeName; 
import javax.naming.Context; 
import javax.naming.Name; 
import javax.naming.NameParser; 
import javax.naming.NamingEnumeration; 
import javax.naming.NamingException; 
import javax.naming.directory.Attribute; 
import javax.naming.directory.Attributes; 
import javax.naming.directory.InitialDirContext; 
import javax.naming.directory.SearchControls; 
import javax.naming.directory.SearchResult; 

public class MemberOfTest{ 
    private static final String contextFactory = "com.sun.jndi.ldap.LdapCtxFactory"; 
    private static final String connectionURL = "ldap://HOST:PORT"; 
    private static final String connectionName = "CN=Query,CN=Users,DC=XXX,DC=XX"; 
    private static final String connectionPassword = "XXX"; 

    // Optioanl 
    private static final String authentication = null; 
    private static final String protocol = null; 

    private static String username = "XXXX"; 

    private static final String MEMBER_OF = "memberOf"; 
    private static final String[] attrIdsToSearch = new String[] { MEMBER_OF }; 
    public static final String SEARCH_BY_SAM_ACCOUNT_NAME = "(sAMAccountName=%s)"; 
    public static final String SEARCH_GROUP_BY_GROUP_CN = "(&(objectCategory=group)(cn={0}))"; 
    private static String userBase = "DC=XXX,DC=XXX"; 

    public static void main(String[] args) throws NamingException { 
     Hashtable<String, String> env = new Hashtable<String, String>(); 

     // Configure our directory context environment. 

     env.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory); 
     env.put(Context.PROVIDER_URL, connectionURL); 
     env.put(Context.SECURITY_PRINCIPAL, connectionName); 
     env.put(Context.SECURITY_CREDENTIALS, connectionPassword); 
     if (authentication != null) 
      env.put(Context.SECURITY_AUTHENTICATION, authentication); 
     if (protocol != null) 
      env.put(Context.SECURITY_PROTOCOL, protocol); 

     InitialDirContext context = new InitialDirContext(env); 
     String    filter = String.format(SEARCH_BY_SAM_ACCOUNT_NAME, username); 
     SearchControls  constraints = new SearchControls(); 
     constraints.setSearchScope(SearchControls.SUBTREE_SCOPE); 
     constraints.setReturningAttributes(attrIdsToSearch); 
     NamingEnumeration results = context.search(userBase, filter,constraints); 
     // Fail if no entries found 
     if (results == null || !results.hasMore()) { 
      System.out.println("No result found"); 
      return; 
     } 

     // Get result for the first entry found 
     SearchResult result = (SearchResult) results.next(); 

     // Get the entry's distinguished name 
     NameParser parser = context.getNameParser(""); 
     Name contextName = parser.parse(context.getNameInNamespace()); 
     Name baseName = parser.parse(userBase); 

     Name entryName = parser.parse(new CompositeName(result.getName()) 
       .get(0)); 

     // Get the entry's attributes 
     Attributes attrs = result.getAttributes(); 
     Attribute attr = attrs.get(attrIdsToSearch[0]); 

     NamingEnumeration e = attr.getAll(); 
     System.out.println("Member of"); 
     while (e.hasMore()) { 
      String value = (String) e.next(); 
      System.out.println(value); 
     } 
    } 
}

答

最简单的方法是用 '查找'：（打开一个LDAP环境：看上面的例子）

/** 
    * Tests if an Active Directory user exists in an Active Directory group. 
    * @param ctx LDAP Context. 
    * @param dnADGroup distinguishedName of group. 
    * @param dnADUser distinguishedName of user. 
    * @return True if user is member of group. 
    */ 


public static boolean isMemberOfADGroup(LdapContext ctx, String dnADGroup, String dnADUser) { 
    try { 
    DirContext lookedContext = (DirContext) (ctx.lookup(dnADGroup)); 
    Attribute attrs = lookedContext.getAttributes("").get("member"); 
    for (int i = 0; i < attrs.size(); i++) { 
    String foundMember = (String) attrs.get(i); 
    if(foundMember.equals(dnADUser)) { 
    return true; 
    } 
    } 
    } catch (NamingException ex) { 
    String msg = "There has been an error trying to determin a group membership for AD user with distinguishedName: "+dnADUser; 
    System.out.println(msg); 
    ex.printStackTrace(); 
    } 
    return false; 
}

答

我发现这个有用：

retrieves-group-membership for Active Directory

我有这样的工作代码：

import java.util.Hashtable; 
import javax.naming.CompositeName; 
import javax.naming.Context; 
import javax.naming.Name; 
import javax.naming.NameParser; 
import javax.naming.NamingEnumeration; 
import javax.naming.NamingException; 
import javax.naming.directory.Attribute; 
import javax.naming.directory.Attributes; 
import javax.naming.directory.DirContext; 
import javax.naming.directory.InitialDirContext; 
import javax.naming.directory.SearchControls; 
import javax.naming.directory.SearchResult; 
import javax.naming.ldap.InitialLdapContext; 
import javax.naming.ldap.LdapContext; 

public class TestAD1 { 

    private static String userBase = "DC=SomeName,DC=SomeName,DC=SomeName,DC=SomeName,DC=COM,DC=US"; 

    public static void main(String[] args) { 
     TestAD1 tad = new TestAD1(); 
     try { 
      // Create a LDAP Context 
      Hashtable env = new Hashtable(); 
      env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); 
      env.put(Context.SECURITY_AUTHENTICATION, "simple"); 
      env.put(Context.SECURITY_PRINCIPAL, "[email protected]"); 
      env.put(Context.SECURITY_CREDENTIALS, "drowssap"); 
      env.put(Context.PROVIDER_URL, "ldap://fully.qualified.server.name:389"); 
      LdapContext ctx = new InitialLdapContext(env, null); 
      InitialDirContext inidircontext = new InitialDirContext(env); 
      DirContext dirctx = new InitialLdapContext(env, null); 
      System.out.println("Connection Successful."); 

      // Print all attributes of the name in namespace 
      SearchControls sctls = new SearchControls(); 
      String retatts[] = {"sn", "mail", "displayName", "sAMAccountName"}; 
      sctls.setReturningAttributes(retatts); 
      sctls.setSearchScope(SearchControls.SUBTREE_SCOPE); 
      String srchfilter = "(&(objectClass=user)(mail=*))"; 
      String srchbase = userBase; 
      int totalresults = 0; 

      NamingEnumeration answer = dirctx.search(srchbase, srchfilter, sctls); 
      while (answer.hasMoreElements()) { 
       SearchResult sr = (SearchResult) answer.next(); 
       totalresults++; 
       System.out.println(">>> " + sr.getName()); 

       Attributes attrs = sr.getAttributes(); 
       if (answer == null || !answer.hasMore()) { 
        System.out.println("No result found"); 
        return; 
       } 

       if (attrs != null) { 
        try { 
         System.out.println(" surname: " + attrs.get("sn").get()); 
         System.out.println(" Email - ID: " + attrs.get("mail").get()); 
         System.out.println(" User - ID: " + attrs.get("displayName").get()); 
         System.out.println(" Account Name: " + attrs.get("sAMAccountName").get()); 
         tad.GetGroups(inidircontext, attrs.get("sAMAccountName").get().toString()); 
        } catch (NullPointerException e) { 
         System.out.println("Error listing attributes..." + e); 

        } 
       } 
       System.out.println("Total Results : " + totalresults); 
       // close dir context 
       dirctx.close(); 
      } 

      ctx.close(); 
     } catch (NamingException e) { 
      System.out.println("Problem Search Active Directory..." + e); 
      //e.printStackTrace(); 
     } 

    } 

    // Get all the groups. 

    public void GetGroups(InitialDirContext context, String username) throws NamingException { 
     String[] attrIdsToSearch = new String[]{"memberOf"}; 
     String SEARCH_BY_SAM_ACCOUNT_NAME = "(sAMAccountName=%s)"; 
     String filter = String.format(SEARCH_BY_SAM_ACCOUNT_NAME, username); 
     SearchControls constraints = new SearchControls(); 
     constraints.setSearchScope(SearchControls.SUBTREE_SCOPE); 
     constraints.setReturningAttributes(attrIdsToSearch); 
     NamingEnumeration results = context.search(userBase, filter, constraints); 
     // Fail if no entries found 
     if (results == null || !results.hasMore()) { 
      System.out.println("No result found"); 
      return; 
     } 
     SearchResult result = (SearchResult) results.next(); 
     Attributes attrs = result.getAttributes(); 
     Attribute attr = attrs.get(attrIdsToSearch[0]); 

     NamingEnumeration e = attr.getAll(); 
     System.out.println(username + " is Member of the following groups : \n"); 
     while (e.hasMore()) { 
      String value = (String) e.next(); 
      System.out.println(value); 
     } 
    } 

}

Java LDAP - 确定给定组中的用户？

相关推荐