ADS integration

Question

Hi!
I've just started working on ADS integration and unsurprisingly come across a couple of problems. I would really appreciate if anyone can help me.
1. First thing I realized that my user account didn't have enough privileges to work with ADS - "new InitialDirContext()" threw authentication exception. With administrator account this piece of code works fine.
I can't use administrator account in production environment, so I wonder what particular privileges user account has to have to browse ADS?
2. I'm totally confused with LDAP names. I'm just trying to get e-mail attribute for a particular user (different from the one I used in SECURITY_PRINCIPAL) and I always get "NameNotFoundException".
The ADS for this user account says that canonical name is "myorg.local/Head Office/Joe Smith - (H/O)". His username is "smithj"
So I've tried:
Attributes attrs = ctx.getAttributes("DN=smithj,OU=Head Office,DC=myorg,DC=local");
Attributes attrs = ctx.getAttributes("CN=Joe Smith - (H/O),OU=Head Office,DC=myorg,DC=local");
and many other combinations I could think of, all the same - "NameNotFoundException".
What do I do wrong?
3. What is the best way to authorize user against ADS? I'd like to create a login form which goes to ADS with username and password typed by a user and makes sure that such user does exist in the ADS and his/her account is active. Since connection to ADS requires some specific privileges I would prefer to connect to ADS first with the special account and then validate user's username/password somehow. Is this possible?
Thanks!
Regards,
Leo

Answer 1

Refer to the following for info on JNDI & Active Directory:
JNDI, Active Directory and Authentication (Part 1) (Kerberos)
http://forum.java.sun.com/thread.jspa?threadID=579829&tstart=300
JNDI, Active Directory & Authentication (part 2) (SSL)
http://forum.java.sun.com/thread.jspa?threadID=581425&tstart=50
JNDI, Active Directory & Authentication (part 3) (Digest-MD5
http://forum.java.sun.com/thread.jspa?threadID=581868&tstart=150
JNDI, Active Directory & Authentication (part 4) (SASL EXTERNAL)
http://forum.java.sun.com/thread.jspa?threadID=641047&tstart=0
JNDI, Active Directory, Paging and Range Retrieval
http://forum.java.sun.com/thread.jspa?threadID=578347&tstart=0
JNDI, Active Directory, Referrals and Global Catalog
http://forum.java.sun.com/thread.jspa?threadID=603815&tstart=15
JNDI, Active Directory (Creating new users & demystifying userAccountControl)
http://forum.java.sun.com/thread.jspa?threadID=582103&tstart=15
JNDI, Active Directory & Changing Passwords
http://forum.java.sun.com/thread.jspa?threadID=592611&tstart=50
JNDI, Active Directory and Group Memberships
http://forum.java.sun.com/thread.jspa?threadID=581444&tstart=150
JNDI, Active Directory and objectGUID's
http://forum.java.sun.com/thread.jspa?threadID=646111&tstart=0
JNDI, Active Directory and SID's (Security Identifiers)
http://forum.java.sun.com/thread.jspa?threadID=585031&tstart=150
JNDI, Active Directory and Error codes
http://forum.java.sun.com/thread.jspa?threadID=578674&tstart=200
JNDI, Active Directory and Server Side Sorting
http://forum.java.sun.com/thread.jspa?threadID=628857&tstart=0
JNDI, Active Directory & Persistent Searches (part 1)
http://forum.java.sun.com/thread.jspa?threadID=578338&tstart=200
JNDI, Active Directory and Persistent Searches (part 2)
http://forum.java.sun.com/thread.jspa?threadID=672007&tstart=90
To answer your specific questions:
1. What privileges are need to browse Active Directory ?
By default all authenticated users can search the Active Directory. However by default, in Windows Server 2003, anonymous users are not permitted to browse the directory.
2. Active Directory maintains the user name in three forms:
a. distinguished name (eg. cn=Albert Einstein,ou=Research,dc=antipodes,dc=com)
b. samAccountName, aka pre-Windows 2000 logon name, which when used as credentials is always coupled with the Windows domain name. (eg. ANTIPODES\alberte) and
c. userPrincipalName, aka Windows 2000 logon name (eg [email protected])
In the AD U&C interface, the canonical name is a form of the distinguished name. In my example it would be:
antipodes.com/research/albert einstein
In your example, I will assume that your user's distinguished name is:
CN=Joe Smith - (H/O),OU=Head Office,DC=myorg,DC=local
There could be reasons, why your search is not working, firstly make sure that your context is rooted correctly.env.put(Context.PROVIDER_URL,"ldap://mydcdc.antipodes.com:389");
Attributes attrs = ctx.getAttributes("cn=Albert Einsten,ou=Research,dc=antipodes,dc=com"); would work, whereas if your context is rooted elsewhere, your search would fail.env.put(Context.PROVIDER_URL,"ldap://mydcdc.antipodes.com/ou=Sales,dc=antipodes,dc=com:389");
Attributes attrs = ctx.getAttributes("cn=Albert Einsten,ou=Research,dc=antipodes,dc=com");would fail.
Secondly, beware of LDAP special characters that may need to be escaped.
3. If the user is entering their credentials on a form, just perform a successful bind using their credentials. As an alternative, assuming they have already authenticated against Active Directory (for example from an interactive logon from a Windows workstation), you could use their existing Kerberos ticket. Refer to the post JNDI, Active Directory and Authentication (Part 1) (Kerberos) listed above There are also third party solutions from either Centrify or Vintela that simplify this process.