Help! Search with no results

Question

The problem I'm having is that users are in different domains in the company I'm working in. If the searched user is in the same domain (e.g. DC=B, DC=A) of the administrator, it returns exact one record. However, if the user is under the sub-domain (i.e. DC=C, DC=B, DC=A), and I've set the search control to scope to sub-tree, the searching returns no records. Does anybody know how to solve this?
Here is the snippet of my code:
  public String getDN(String userid) {
    String dn = "CN=admin,OU=Sharing Account,DC=ABC,Dc=com,DC=tw";
    String ldap_url = "ldap://f1soa02.cmo.com.tw:389";
    String password = "xxxx";
    Hashtable env = new Hashtable();
    env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    env.put("java.naming.ldap.version", "3");
    env.put(Context.PROVIDER_URL, ldap_url);
    env.put(Context.SECURITY_AUTHENTICATION, "simple");
    env.put(Context.SECURITY_PRINCIPAL, dn);
    env.put(Context.SECURITY_CREDENTIALS, password);
    DirContext ctx;
    String[] attrs = { "cn" };
    try {
      ctx = new InitialDirContext(env);
      SearchControls ctls = new SearchControls();
      ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
      ctls.setReturningAttributes(attrs);
      String filter = "(CN=" + userid + ")";
      // Search for objects with these matching attributes
      NamingEnumeration results = ctx.search("DC=cmo,Dc=com,DC=tw",filter,ctls);
      if ( results != null && results.hasMoreElements()) {
        SearchResult sr = (SearchResult)results.nextElement();
        dn = sr.getName();
      } else dn = null;
      ctx.close();
    } catch (AuthenticationException e){
      System.out.println(" getDN() Authentication Exception: " + e);
      return null;
    } catch (NamingException e) {
      System.out.println(" getDN() Naming Exception: " + e);
      return null;
    return dn;
  public static void main(String[] args) {
    UserAuthenticate ua = new UserAuthenticate();
    //boolean valid = ua.ldapAuthenticate("joy_huang", "babula52395239");
    boolean valid = ua.ldapAuthenticate("karen_fang", "karenf12");
    if (valid)
      System.out.println("Valid User");
    else
      System.out.println("Invalid User");
  }

Answer 1

1). Can't get connected to Global Catalog port 3268. Does this mean that I have to get the permission from the administrator to connect to that port?
No.
Not all domain controllers host a global catalog. If a DC is not listening on port 3268 (or 3269 over SSL) then it is not hosting a GC.
You can find both GC's & DC's through DNS. For example if using the DnsContextFactory, you can find a GC using the DNS Query result:String strService = "_gc._tcp";
String strQuery[]={"SRV"};
Attributes dnsQueryresult = dnsContext.getAttributes(strService,strQuery);For completeness, the query should also take into consideration sites (IP subnets), so you return a DC or GC closest to your server. You may want to look at the Win32 API DSGetDCName and provide similar functionality in your app.
(Refer to http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/dsgetdcname.asp)
If you are able to connect to port 3268 (the GC) but do not return any results, then the ACL's may not give you permission to view the objects or their attributes.
2). How to find out the returning attributes? Our server seems do not have the attributes listed in the sample...
IIRC, the attributes I have listed are included in the Partial Attribute Set (PAS), which is the term used to describe which attributes are included in the GC.
Details on the default attributes contained in the GC can be found at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/adschema/attributes_global.asp
Note that the GC abides by the exact same security controls as a DC, so if your user does not have access to the objects and their attributes in a domain, it won't have access to them in a GC.
If you want to return all available attributes, just specify null for the returned attributes.SearchControls searchCtls = new SearchControls();
String returnedAttributes[] = null;
searchCtls.setReturningAttributes(returnedAttributes);
...and to list out a returned attribute's name, use the getID method.
3). Can't have empty base DN when searching? Why? Is that system limitation?
AFAIHI (As far as I have interpreted) the LDAP RFC states that an empty BaseDN is used when querying RootDSE. It is does not state what the behaviour should be otherwise. (In RFC 2251 the search base is defined as a LDAP Distinguished Name, which in turn is defined as a LDAP String, which is finally defined as an Octet String. Doesn't specify what should happen with a null value)
From an Active Directiory perspective, for an LDAP search, you must supply a valid base distinguished name. For a Global Catalog search, the base distinguished name can be any value, including the value "NULL" (" ").
If you use a NULL base distinguished name with a scope of one level or subtree and specify port 389 (the default LDAP port), the search fails, whereas if you use a NULL base distinguished name with a scope of object level and specify port 389, it will return the RootDSE.