使用#字符进行LDAP搜索

Question

我试图在Active Directory上搜索组织单元(Window Server 2003).这是我的代码

package com.test;

import java.io.IOException;
import java.util.Properties;

import javax.naming.CompositeName;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.Control;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;
import javax.naming.ldap.PagedResultsControl;

public class Main {
    Properties ENV = new Properties();
    private DirContext CTX;
    private static final String BIN_ENV = "java.naming.ldap.attributes.binary";
    private static final String CTX_CLASS = "com.sun.jndi.ldap.LdapCtxFactory";

    String host = "127.0.0.1";
    String port = "389";

    String OU = "OU=b#,DC=domain,DC=local";

    public int getConnection() {
        int result = 0;
        ENV.clear();
        String username = "Administrator@domain.local";
        String password = "admin-123";

        if ((username != null) && (password != null)) {
            ENV.put(Context.SECURITY_AUTHENTICATION, "simple");
            ENV.put(Context.SECURITY_PRINCIPAL, username);
            ENV.put(Context.SECURITY_CREDENTIALS, password);
        }

        ENV.put(Context.INITIAL_CONTEXT_FACTORY, CTX_CLASS);

    ENV.put(Context.PROVIDER_URL, "ldap://" + host + ":" + port);       

        // some attributes must be retrieved in binary format
        ENV.put(BIN_ENV, "userCertificate");
        ENV.put(BIN_ENV, "objectGUID");
        try {
            CTX = new InitialLdapContext(ENV, null);
        } catch (NamingException ex) {
            ENV.clear();
            result = -4;
            if (ex.toString().indexOf("AuthenticationException") > 0) {
                result = -1;
            } else if (ex.toString().indexOf("ConnectException") > 0) {
                result = -2;
            } else if (ex.toString().indexOf("UnknownHostException") > 0) {
                result = -3;
            }
        }
        return result;
    }

    public static void main(String args[]) {
        Main a = new Main();

        String filter = "(&(objectClass=user)(!(objectCategory=computer)))";
        String[] availAttrs = { "objectGUID", "name", "sAMAccountName",
                "distinguishedName", "userCertificate", "userPrincipalName" };

        SearchControls cons = new SearchControls();
        cons.setSearchScope(SearchControls.ONELEVEL_SCOPE);
        cons.setReturningAttributes(availAttrs);

        int result = a.getConnection();

        if (result != 0)
            System.exit(-1);
        try {
            ((LdapContext) a.CTX)
                    .setRequestControls(new Control[] { new PagedResultsControl(
                            1000, Control.CRITICAL) });

            String jndi_dn = new CompositeName().add(a.OU).toString();
            NamingEnumeration<SearchResult> ne = (NamingEnumeration<SearchResult>) a.CTX
                    .search(jndi_dn, filter, cons);

            if ((ne != null) && ne.hasMoreElements()) {

                SearchResult sr = (SearchResult) ne.next();
                String name = sr.getAttributes().get(availAttrs[1]).get(0)
                        .toString();

                System.out.println(name);
            }

        } catch (NamingException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }

    }
}

如果AD上的组织单位是"b#",那么它可以运行良好.但如果OU是"#b",那么我将有javax.naming.InvalidNameException:problem 2006(BAD_NAME).我可以通过将OU值用作"\\ #b"来解决这个问题,但我仍然不知道为什么我需要双重反向启动.我怎么能逃脱所有这些特殊的特征呢？对此有一般的解决方案吗？

Answer 1

这种情况是由JNDI中的软件缺陷引起的,并且是JNDI中的许多缺陷之一.一般来说,JNDI不应该用于新代码.JNDI无法支持所有LDAP标准,使用不推荐的配置并且存在许多软件缺陷.

请改用UnboundID LDAP SDK.

也可以看看

• LDAP:编程实践