How do I get info from Active Directory and use it in my web-applications?

Question

I borrowed a nice piece of code for JNDI hits against Active Directory from this website: http://www.sbfsbo.com/mike/JndiTutorial/
I have altered it and am trying to use it to retrieve info from our Active Directory Server.
I altered it to point to my domain, and I want to retrieve a person's full name(CN), e-mail address and their work location.
I've looked at lots of examples, I've tried lots of things, but I'm really missing something. I'm new to Java, new to JNDI, new to LDAP, new to AD and new to Tomcat. Any help would be so appreciated.
Thanks,
To show you the code, and the error message, I've changed the actual names I used for connection.
What am I not coding right? I get an error message like this:
javax.naming.NameNotFoundException[LDAP error code 32 - 0000208D: nameErr DSID:03101c9 problem 2001 (no Object), data 0,best match of DC=mycomp, DC=isd, remaining name dc=mycomp, dc=isd
[code]
import java.util.Hashtable;
import java.util.Enumeration;
import javax.naming.*;
import javax.naming.directory.*;
public class JNDISearch2 {
// initial context implementation
public static String INITCTX = "com.sun.jndi.ldap.LdapCtxFactory";
public static String MY_HOST = "ldap://99.999.9.9:389/dc=mycomp,dc=isd";
public static String MGR_DN = "CN=connectionID,OU=CO,dc=mycomp,dc=isd";
public static String MGR_PW = "connectionPassword";
public static String MY_SEARCHBASE = "dc=mycomp,dc=isd";
public static String MY_FILTER =
"(&(objectClass=user)(sAMAccountName=usersignonname))";
// Specify which attributes we are looking for
public static String MY_ATTRS[] =
{ "cn", "telephoneNumber", "postalAddress", "mail" };
public static void main(String args[]) {
try { //----------------------------------------------------------        
// Binding
// Hashtable for environmental information
Hashtable env = new Hashtable();
// Specify which class to use for our JNDI Provider
env.put(Context.INITIAL_CONTEXT_FACTORY, INITCTX);
// Specify the host and port to use for directory service
env.put(Context.PROVIDER_URL, MY_HOST);
// Security Information
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, MGR_DN);
env.put(Context.SECURITY_CREDENTIALS, MGR_PW);
// Get a reference toa directory context
DirContext ctx = new InitialDirContext(env);
// Begin search
// Specify the scope of the search
SearchControls constraints = new SearchControls();
constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
// Perform the actual search
// We give it a searchbase, a filter and the constraints
// containing the scope of the search
NamingEnumeration results = ctx.search(MY_SEARCHBASE, MY_FILTER, constraints);
// Now step through the search results
while (results != null && results.hasMore()) {
SearchResult sr = (SearchResult) results.next();
String dn = sr.getName() + ", " + MY_SEARCHBASE;
System.out.println("Distinguished Name is " + dn);
// Code for displaying attribute list
Attributes ar = ctx.getAttributes(dn, MY_ATTRS);
if (ar == null)
// Has no attributes
System.out.println("Entry " + dn);
System.out.println(" has none of the specified attributes\n");
else // Has some attributes
// Determine the attributes in this record.
for (int i = 0; i < MY_ATTRS.length; i++) {
Attribute attr = ar.get(MY_ATTRS);
if (attr != null) {
System.out.println(MY_ATTRS[i] + ":");
// Gather all values for the specified attribute.
for (Enumeration vals = attr.getAll(); vals.hasMoreElements();) {
System.out.println("\t" + vals.nextElement());
// System.out.println ("\n");
// End search
} // end try
catch (Exception e) {
e.printStackTrace();
System.exit(1);
My JNDIRealm in Tomcat which actually does the initial authentication looks like this:(again, for security purposes, I've changed the access names and passwords, etc.)
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
connectionURL="ldap://99.999.9.9:389"
connectionName="CN=connectionId,OU=CO,dc=mycomp,dc=isd"
connectionPassword="connectionPassword"
referrals="follow"
userBase="dc=mycomp,dc=isd"
userSearch="(&(sAMAccountName={0})(objectClass=user))"
userSubtree="true"
roleBase="dc=mycomp, dc=isd"
roleSearch="(uniqueMember={0})"
rolename="cn"
/>
I'd be so grateful for any help.
Any suggestions about using the data from Active directory in web-application.
Thanks.
R.Vaughn

Answer 1

By this time you probably have already solved this, but I think the problem is that the Search Base is relative to the attachment point specified with the PROVIDER_URL. Since you already specified "DC=mycomp,DC=isd" in that location, you merely want to set the search base to "". The error message is trying to tell you that it could only find half of the "DC=mycomp, DC=isd, DC=mycomp, DC=isd" that you specified for the search base.
Hope that helps someone.
Ken Gartner
Quadrasis, Inc (We Unify Security, www -dot- quadrasis -dot- com)