我正在尝试在我们的项目中使用Apache Shiro进行Active Directory域的身份验证和授权。当我使用用户CN属性进行身份验证时,它工作正常,但是,我想使用另一个唯一属性进行登录。是否可以配置shiro这样做?
这是我的shiro.ini文件:
[main]
shiro.loginUrl = /login.jsp
activeDirectoryRealm = org.apache.shiro.realm.activedirectory.ActiveDirectoryRealm
activeDirectoryRealm.systemUsername = admin
activeDirectoryRealm.systemPassword = secret
activeDirectoryRealm.searchBase = DC=company,DC=private
activeDirectoryRealm.url = ldap://url:389
登录代码:
public void login(String uname, String pwd, boolean rememberMe) {
Factory<SecurityManager> ldapFactory = new IniSecurityManagerFactory("classpath:shiro.ini");
SecurityManager sManager = ldapFactory.getInstance();
SecurityUtils.setSecurityManager(sManager);
Subject currentUser = SecurityUtils.getSubject();
if (!currentUser.isAuthenticated()) {
uname = "CN=" + uname + ",OU=Users";
UsernamePasswordToken token = new UsernamePasswordToken(uname, pwd);
token.setRememberMe(rememberMe);
try {
currentUser.login(token);
} catch (UnknownAccountException ex) {
logger.info("Unknown user");
} catch (IncorrectCredentialsException ex) {
logger.info("Incorrect credentials");
} catch (LockedAccountException ex) {
logger.info("Account is locked");
} catch (AuthenticationException ex) {
ex.printStackTrace();
}
}
}
如果我改变了行
uname = "CN=" + uname + ",OU=Users";
以下
uname = "myCustomAttribute=" + uname + ",OU=Users";
并尝试使用它登录,我得到了
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1 ]
感谢您的回答。
答案 0 :(得分:2)
好的,我设法通过创建自定义MyJndiLdapRealm来扩展JndiLdapRealm和覆盖方法
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token){}
但如果您有更好的解决方案,我仍然欢迎您的回答。