Java LDAP

Question

I am currently planning on working on a small application (to help keep myself current) for my company.
I was hoping to have an Employee management application which would allow EMployees to go in and edit thier details/book holiday and the such.
But what I wanted was for there to be LDAP authentication to it, rather than creating the users on a seperate database somewhere.
And was wondering a few things
a] Does java come with a library that allows my to conenct to an LDAP server and talkt o it
b] Does LDAP give back information like "this person is an employee" or "this person is a company director" (or user/admin type thing)
For the LDAP libraries if the do exist but arent bundled into the main java framework, I am looking for one that isnt too hard to use, as I'm doing this outside of work and my personnal time is very precious to me.

Answer 1

My standard approach is very similar to what malcolmmc describes. First I create an InitialDirContext which tells me if the username and password is good (it throws an exception if it isn't). Then I tend to use one of the search methods in the InitialDirContext to look up individual entries and get attributes from it.
For your requirements you need to find something about the user which you can check to differentiate their type. It may be an attribute, or a group they are in. It will be of great benefit to look through your directory with an LDAP browser.
//Create an environment
Properties props = new Properties();
props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
props.put(Context.SECURITY_AUTHENTICATION, "simple");
props.put(Context.PROVIDER_URL, "ldap://anycorp.co.uk:389/");     //Port 389 is standard for LDAP
props.put(Context.SECURITY_PRINCIPAL, "myDomain\\username");
props.put(Context.SECURITY_CREDENTIALS, "password");
//Create a directory context, this will throw an exception if
//the logon is not valid
InitialDirContext ctx = new InitialDirContext(props);Notes:
1. For your provider URL you should be able to use just your company DNS suffix. Your company DNS should route your request to a directory server.
2. You may also want to look into using a higher security level than "simple", which is a clear text password. Googling should give some answers.
3. Your SECURITY_PRINCIPLE may vary depending on what type of directory server you have. MS Active Directory usually uses a email type format, Novell uses the format I give in my example. If you code on a Windows XP workstation, click Ctrl-Alt-Delete and have a look at what it says you are logged in as.