Question

我正在努力使Spring Security遵循Active Directory的引用。所有配置似乎都正常，我使用dc=example,dc=local作为基础

https://github.com/spring-projects/spring-ldap/blob/master/core/src/main/java/org/springframework/ldap/core/support/AbstractContextSource.java#L305

但是当尝试登录引用的用户时，它似乎添加了两倍的基数：

o.s.s.l.a.BindAuthenticator              : Attempting to bind as cn=Euro Dude,cn=Users,dc=eu,dc=example,dc=local,dc=example,dc=local

它显然失败，因为它找不到用户。如果，使用调试器进行阻止，我会删除额外的dc=example,dc=local日志。

查看代码

https://github.com/spring-projects/spring-security/blob/master/ldap/src/main/java/org/springframework/security/ldap/authentication/BindAuthenticator.java#L115-L118

我看到它将基本LDAP路径附加到专有名称

DistinguishedName userDn = new DistinguishedName(userDnStr);
DistinguishedName fullDn = new DistinguishedName(userDn);
fullDn.prepend(ctxSource.getBaseLdapPath());`

我找到的阅读文档 https://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html

Windows Active Directory：因为Active Directory不支持管理引荐控制，本课程中的所有示例都不会针对Active Directory工作。

这是否意味着它根本不起作用？

为什么将基地添加到完整的专有名称？请注意，我不提供用户DN，但只有sAMAccountName并自动获取DN。

o.s.l.c.support.DefaultDirObjectFactory  : Received name 'ldap://eu.example.local:389/CN=Euro%20Dude,CN=Users,DC=eu,DC=example,DC=local' contains protocol delimiter; indicating a referral.Stripping protocol and address info to enable construction of a proper LdapName
o.s.l.c.support.DefaultDirObjectFactory  : Resulting name after removal of referral information: 'CN=Euro Dude,CN=Users,DC=eu,DC=example,DC=local'
o.s.s.ldap.SpringSecurityLdapTemplate    : Found DN: CN=Euro Dude,CN=Users,DC=eu,DC=example,DC=local
o.s.s.l.a.BindAuthenticator              : Attempting to bind as cn=Euro Dude,cn=Users,dc=eu,dc=example,dc=local,dc=example,dc=local
s.s.l.DefaultSpringSecurityContextSource : Removing pooling flag for user cn=Euro Dude,cn=Users,dc=eu,dc=example,dc=local,dc=example,dc=local
o.s.s.l.a.BindAuthenticator              : Failed to bind as CN=Euro Dude,CN=Users,DC=eu,DC=example,DC=local: org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580

LDAP推荐预先基础

0 个答案: