Secure AD Bind

Question

Hi,
Struggling a bit with a module. I'm trying to do a secure bind to AD with not much success. I can do a simple bind just fine but not secure. I have used this module before in other environments and it has worked flawlessly. In this new environment however I'm stuck and asking for your help. Take a look and tell me if you see something wrong with this bind method:
      * <p>Basic bind for doing AD queries against domain simple bind assumes no
      * context </p> @param domain the Domain controller you're authenticating
      * against @return DirContext
     public DirContext ldapBind(String domain, String username, String password,
               boolean secure) throws NamingException, IOException {
          Object retVal;
          DirContext ctx = null;
          Hashtable env = new Hashtable(8);
          String authType = null;
          authType = secure ? "DIGEST-MD5" : "simple";
          // Set the context & provider
          env.put(Context.INITIAL_CONTEXT_FACTORY,
                    "com.sun.jndi.ldap.LdapCtxFactory");
          env.put(Context.PROVIDER_URL, domain);
          env.put(Context.SECURITY_AUTHENTICATION, authType);
          // Request medium-strength cryptographic protection
          env.put("javax.security.sasl.qop", "auth");
          if (secure) {
               env.put("javax.security.sasl.strength", "high, medium");
          // provide a username/password
          byte[] pass = password.getBytes();
          Object pword = secure ? pass : password;
          env.put("java.naming.security.principal", username);
          env.put(Context.SECURITY_CREDENTIALS, pword);
          env.put(Context.REFERRAL, "follow");
          if (ADUtil.debug) {
               // env.put("com.sun.jndi.ldap.trace.ber", System.out);
          // Create the initial directory context
          ctx = new InitialDirContext(env);
          return ctx;
     }Thanks in advance,
-Stumped

Answer 1

adler_steven wrote:
What do you mean "it doesn't work" ?
Are you getting authentication exceptions ? perhaps LDAP Error 49 with an Active Directory error code of 52e ?Yes of course. How silly of me not to include the error:.
javax.naming.AuthenticationException: [LDAP: error code 49 - 8009030C: LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece>
If the same code worked in one environment & not the other, then one has to assume the problem lies with teh different environments.
Are user's using the same format for authentication ? Remember that you cannot use LDAP Distinguished names (CN=Albert Einstein,OU=Research,DC=Antipodes,DC=Com") to authenticate using Digest-MD5, you can only use NTLM style domain names (ANTIPODES\AlbertE) or User Principal Names ([email protected])
Yes I was aware with *simple* the expected format for username is the distinguishedName and with *DIGEST-MD5* it is userPrincipalName. I have verified both using ADSI from the domain controller.
The username and password are definitely correct as they are the ones I use to remote desktop to the domain controller.
>
Also, each user account needs to have their password stored using reversible encryption. (The setting is exposed in the Active DIrectory Users & Computers snap-in under the Account Tab for each user)This I was not aware of, good to know. I looked and this was not checked. I checked it and re-ran the test and still getting the same error from above. I'm in agreement with you that the problem does lie with the different environments. I just wish I had a way to have more a more meaningful error to pass off to my System Admin's to take corrective action.