java 通過LDAP 驗證、添加、修改、刪除

1. 域服務器（dc=dctest,dc=com）,安裝證書服務，創建企業根證書，名稱爲dctest.com

   則：cn=dctest.com,dc=dctest,dc=com

2. 申請證書類型域控制器的證書

3. 將企業根證書和域控制器證書導入到應用服務器cacerts

4. 在應用程序中，編寫代碼引用cacerts認證。

 

 

keytool

 

package bof.usermanager.auth.impl;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import java.util.Properties;
import javax.naming.AuthenticationException;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.BasicAttributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.ModificationItem;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.Control;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;
import com.report.service.PropertyItem;
import com.report.vo.OrganizationalUnitDomain;
import com.report.vo.UserDomain;
/**
 * 功能：本操作類提供AD域用戶的增、刪、查、改功能
 * 作者：陳藝武
 * 日期：2010-4-13
 */
public class LdapADManager {

    protected DataSourceConnectLDAPVO transientInstance = null;

    /** 用戶的objectClass*/
    private String default_objectclass = "user";
    /**用戶的默認根DN*/
    private String default_base = "CN=Users,DC=all,DC=com";
    /** 用戶默認主鍵*/
    private String key_index = "CN";
    /** 用戶默認密碼屬性.*/
    private String pwd_index = "unicodePwd";
    private Control[] connCtls = null;

    private static LdapADManager LdapADManager = null;

    private LdapADManager(){}
    public static LdapADManager getInstance(){
        if(LdapADManager==null)
            LdapADManager = new LdapADManager();
        return LdapADManager;
    }




    /**
     * 從連接池中獲取一個連接.
     *
     * @return LdapContext
     * @throws NamingException
     */
    public LdapContext getConnectionFromFool() throws NamingException {
        PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
        String keystore = "c:/Java/jdk1.6.0_10/jre/lib/security/cacerts";
        System.setProperty("javax.net.ssl.trustStore", keystore);

        Properties env = new Properties();
        env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
        env.put("com.sun.jndi.ldap.connect.pool", "true");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PROTOCOL, "ssl");
        //env.put("java.naming.referral", "follow");

        env.put(Context.PROVIDER_URL, ldapProperty.getLdapURL());
        connCtls = new Control[] { new LdapADManagerControl() };
        return new InitialLdapContext(env, connCtls);
    }



    /**
     * 功能：校驗用戶登錄.
     * @param userName
     * @param password
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 13, 2010
     */
    public boolean authenticate(String userName, String password) {
        PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
        String userDn = userName + "@" + ldapProperty.getDomain();
        LdapContext ctx = null;
        try {
            ctx = getConnectionFromFool();
            ctx.getRequestControls();
            ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDn);
            ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);
            ctx.reconnect(connCtls);
            return true;
        } catch (AuthenticationException e) {
            e.printStackTrace();
            return false;
        } catch (NamingException e) {
            e.printStackTrace();
            return false;
        } finally {
                try {
                    ctx.close();
                } catch (Exception e){
                    e.printStackTrace();
                }
         }
     }



    /**
     * 功能：獲取AD用戶列表
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 12, 2010
     */
    public List listUser(){
        PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
        List list = new ArrayList();
        LdapContext ctx = null;
        UserDomain user=null;

        String base = "OU=" + ldapProperty.getBase() + "," + ldapProperty.getDomainDC();
        try{
            ctx = this.getConnectionFromFool();
            ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, ldapProperty.getUserName() + "@" + ldapProperty.getDomain());
            ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, ldapProperty.getPassWord());

            //base = "OU=北京華融綜合投資公司,DC=bjhr,DC=com,DC=cn";
            String filter = "(&(objectCategory=person)(objectClass=USER)(name=*))";
            SearchControls controls = new SearchControls();
            controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            //controls.setReturningAttributes(new String[] {"sAMAccountName", "displayName", "department"});
            controls.setReturningAttributes(new String[] {"sAMAccountName", "cn"});

            NamingEnumeration<SearchResult> answer = ctx.search(base, filter, controls);
            while (answer.hasMore()) {
                user=new UserDomain();
                SearchResult result = answer.next();
                NamingEnumeration<? extends Attribute> attrs = result.getAttributes().getAll();
                int count=0;

                while (attrs.hasMore()) {
                    Attribute attr = attrs.next();
                    if(count==0){
                        user.setUserName(attr.get().toString());
                    }else{
                        user.setUserAliasName(attr.get().toString());
                    }
                    count++;
                }

                user.setNameSpace(ldapProperty.getDomain());
                list.add(user);
            }
        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                ctx.close();
            } catch (Exception e){
                e.printStackTrace();
            }
        }
        return list;
    }



    /**
     * 功能：查詢組織單位列表
     * @param ouName
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 13, 2010
     * 說明：base格式如："OU=北京華融綜合投資公司,DC=bjhr,DC=com,DC=cn";
     */
    public List listOrganizztionalUnit(String ouName){
        PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
        List list = new ArrayList();
        LdapContext ctx = null;
        OrganizationalUnitDomain ouDomain = null;

        String base = "OU=" + ldapProperty.getBase() + "," + ldapProperty.getDomainDC();
        try{
            ctx = this.getConnectionFromFool();
            ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, ldapProperty.getUserName() + "@" + ldapProperty.getDomain());
            ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, ldapProperty.getPassWord());

            String filter = "(&(objectClass=organizationalUnit)";
            if(ouName!=null&&!ouName.equals(""))
                filter = filter + "(name=*" + ouName + "*)";
            filter = filter + ")";

            SearchControls controls = new SearchControls();
            controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            controls.setReturningAttributes(new String[] {"name"});

            NamingEnumeration<SearchResult> answer = ctx.search(base, filter, controls);
            while (answer.hasMore()) {
                ouDomain = new OrganizationalUnitDomain();
                SearchResult result = answer.next();
                NamingEnumeration<? extends Attribute> attrs = result.getAttributes().getAll();
                int count=0;

                while (attrs.hasMore()) {
                    Attribute attr = attrs.next();
                    if(count==0){
                        ouDomain.setOuName(attr.get().toString());
                    }
                    count++;
                }

                list.add(ouDomain);
            }
        }catch(Exception e){
            e.printStackTrace();
        } finally {
            try {
                ctx.close();
            } catch (Exception e){
                e.printStackTrace();
            }
        }
        return list;
    }


    /**
     * 功能：添加用戶
     * @param ou    組織單位：中投證券,銷售部門
     * @param department
     * @param realName  真實姓名，如：李偉
     * @param userName  用戶名，如：administrator
     * @param userPwd
     * @param adminUser
     * @param adminPwd
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 12, 2010
     */
    public boolean addUser(String ou,String department,String realName, String userName, String adminUser,String adminPwd) {
        PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
        LdapContext ctx = null;
        try {
            ctx = getConnectionFromFool();

            Attributes attrs = new BasicAttributes(true);
            Attribute objclass = new BasicAttribute("objectclass");
            setObjectclassToAttribute(objclass);
            attrs.put(objclass);
            attrs.put("sAMAccountName", userName);
            attrs.put("cn", realName);

            int UF_ACCOUNTDISABLE = 0x0002;
            int UF_PASSWD_NOTREQD = 0x0020;
            int UF_NORMAL_ACCOUNT = 0x0200;
            int UF_PASSWORD_EXPIRED = 0x800000;
            attrs.put("userAccountControl", Integer.toString(UF_NORMAL_ACCOUNT + UF_PASSWD_NOTREQD + UF_PASSWORD_EXPIRED + UF_ACCOUNTDISABLE));


            ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, adminUser + "@" + ldapProperty.getDomain());
            ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, adminPwd);
            //String newUser = "CN="+realName+"," + cvtOuString(ou) + "," + ldapProperty.getDomainDC();
            String newUser = "CN="+realName+"," + this.getFullOu(ctx, ou) + "," + ldapProperty.getDomainDC();
            ctx.createSubcontext(newUser, attrs);

            ModificationItem[] mods = new ModificationItem[2];
            String newQuotedPassword = "/"" + userName + "/"";
            byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");
            mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,new BasicAttribute("unicodePwd", newUnicodePassword));
            mods[1] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,new BasicAttribute("userAccountControl", Integer.toString(UF_NORMAL_ACCOUNT + UF_PASSWORD_EXPIRED)));
            ctx.modifyAttributes(newUser, mods);
            mods = null;
            return true;
        } catch (NamingException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }finally{
            if(ctx != null){
                try{
                    ctx.close();
                }catch(NamingException e){
                    e.printStackTrace();
                }
                ctx = null;
            }
        }
        return false;
    }



     /**
     * 功能：管理員用戶初始化用戶密碼
     * @param sUserName
     * @param sNewPassword
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 13, 2010
     */
    public boolean adminChangePassword(String adminUser,String adminPwd,String sUserName){
         PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
         LdapContext ctx = null;

        //不能從應用中修改超級管理員密碼
         if(sUserName!=null&&sUserName.equalsIgnoreCase("administrator"))
             return false;
         try {
             ctx = getConnectionFromFool();
             ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, adminUser + "@" + ldapProperty.getDomain());
             ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, adminPwd);

             ModificationItem[] mods = new ModificationItem[1];
             String newQuotedPassword = "/"" + sUserName + "/"";
             byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");
             mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,new BasicAttribute("unicodePwd", newUnicodePassword));
             String cnUser = getUser(ctx,sUserName) + "," + ldapProperty.getDomainDC();
             ctx.modifyAttributes(cnUser, mods);
             return true;
         }catch(Exception e){
             e.printStackTrace();
        } finally {
            try {
                ctx.close();
            } catch (Exception e){
                e.printStackTrace();
            }
        }
         return false;
     }



     /**
     * 功能：用戶修改密碼
     * @param sUserName
     * @param sOldPassword
     * @param sNewPassword
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 9, 2010
     */
    public boolean userChangePassword(String sUserName, String sOldPassword, String sNewPassword){
         PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
         LdapContext ctx = null;
         String userNameAndDomain = sUserName + "@" + ldapProperty.getDomain();

         //不能從應用中修改超級管理員密碼
         if(sUserName!=null&&sUserName.equalsIgnoreCase("administrator"))
             return false;
         try {
             ctx = getConnectionFromFool();
             ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userNameAndDomain);
             ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, sOldPassword);

             ModificationItem[] mods = new ModificationItem[2];
             String oldQuotedPassword = "/"" + sOldPassword + "/"";
             byte[] oldUnicodePassword = oldQuotedPassword.getBytes("UTF-16LE");
             String newQuotedPassword = "/"" + sNewPassword + "/"";
             byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");
             mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE,new BasicAttribute("unicodePwd", oldUnicodePassword));
             mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE,new BasicAttribute("unicodePwd", newUnicodePassword));

             String cnUser = getUser(ctx,sUserName) + "," + ldapProperty.getDomainDC();
             ctx.modifyAttributes(cnUser, mods);
             return true;
         }catch( Exception e){
             e.printStackTrace();
         }finally{
             try{
                 ctx.close();
             }catch(Exception e){
                 e.printStackTrace();
             }
         }
         return false;
   }




    /**
     * 功能：修改用戶信息
     * @param attrs
     * @param userDN
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 12, 2010
     */
    public boolean modify(Attributes attrs, String userDN) {
        LdapContext ctx = null;
        try {
            ctx = getConnectionFromFool();
            attrs.remove(key_index);
            ctx.modifyAttributes(userDN, DirContext.REPLACE_ATTRIBUTE, attrs);
            return true;
        } catch (NamingException e) {
            System.err.println("Problem changing password: " + e);
        } catch (Exception e) {
            System.err.println("Problem: " + e);
        } finally {
                try {
                    ctx.close();
                } catch (Exception e) {
                    e.printStackTrace();
                }

        }
        return false;
    }


    /**
     * 功能：刪除用戶
     * @param adminUser
     * @param adminPwd
     * @param userDN        用戶登陸名
     * @return
     *
     * 作者：陳藝武
     * 日期：Apr 12, 2010
     */
    public boolean del(String adminUser,String adminPwd,String userName) {
        PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
        LdapContext ctx = null;

        try {
            ctx = getConnectionFromFool();
            ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, adminUser + "@" + ldapProperty.getDomain());
            ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, adminPwd);
            String adUser = getUser(ctx,userName) + "," + ldapProperty.getDomainDC();

            ctx.destroySubcontext(adUser);
            return true;
        } catch (NamingException e) {
            System.err.println("Problem changing password: " + e);
        } catch (Exception e) {
            System.err.println("Problem: " + e);
        } finally {
                try {
                    ctx.close();
                } catch (Exception e) {
                    e.printStackTrace();
                }

        }
        return false;
    }





    private void setObjectclassToAttribute(Attribute objclass){
        objclass.add("top");
        objclass.add("person");
        objclass.add("organizationalPerson");
        objclass.add("inetorgperson");
    }


    private String getUser(LdapContext ctx,String usr){
        String userName = "";
        String filter = "sAMAccountName="+usr;
        SearchResult si = getSearchResult(ctx,filter);
        if(si!=null)
            userName = si.getName();
        return userName;
    }


    private String getFullOu(LdapContext ctx,String ou){
        String userName = "";
        String filter = "(&(objectClass=organizationalUnit)(name=" + ou + "))";
        SearchResult si = getSearchResult(ctx,filter);
        if(si!=null)
            userName = si.getName();
        return userName;
    }


    private SearchResult getSearchResult(LdapContext ctx,String filter){
        SearchResult si = null;
        PropertyItem ldapProperty  = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0);
        try {
            SearchControls constraints = new SearchControls();
            co<mce:script type="text/javascript" src="http://hi.images.csdn.net/js/blog/tiny_mce/themes/advanced/langs/zh.js" mce_src="http://hi.images.csdn.net/js/blog/tiny_mce/themes/advanced/langs/zh.js"></mce:script><mce:script type="text/javascript" src="http://hi.images.csdn.net/js/blog/tiny_mce/plugins/syntaxhl/langs/zh.js" mce_src="http://hi.images.csdn.net/js/blog/tiny_mce/plugins/syntaxhl/langs/zh.js"></mce:script>nstraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
            NamingEnumeration en = ctx.search(ldapProperty.getDomainDC(), filter , constraints); // 查詢所有用戶

            while(en!= null&&en.hasMoreElements()){
                Object obj = en.nextElement();
                if (obj instanceof SearchResult) {
                    si = (SearchResult)obj;
                    break;
                }
            }
        }catch (NamingException ex) {
            ex.printStackTrace();
        }
        return si;
    }
}
class LdapADManagerControl implements Control {
    public byte[] getEncodedValue() {
        return null;
    }
    public String getID() {
        return "1.2.840.113556.1.4.1781";
    }
    public boolean isCritical() {
        return true;
    }
}