LDAP 与 Active Directory#

import javax.naming.Context;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import java.util.Hashtable;

public class LdapAuthentication {

    public boolean authenticate(String username, String password) {
        Hashtable<String, String> env = new Hashtable<>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://ldap.example.com:389");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        // 构造用户 DN
        String userDn = "uid=" + username + ",ou=users,dc=example,dc=com";
        env.put(Context.SECURITY_PRINCIPAL, userDn);
        env.put(Context.SECURITY_CREDENTIALS, password);

        try {
            DirContext ctx = new InitialDirContext(env);
            ctx.close();
            return true; // 认证成功
        } catch (javax.naming.AuthenticationException e) {
            return false; // 认证失败
        } catch (Exception e) {
            // 连接失败
            return false;
        }
    }
}

env.put(Context.SECURITY_AUTHENTICATION, "DIGEST-MD5");
// 或
env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI"); // Kerberos

public class LdapSearch {

    public List<String> searchUsers() {
        Hashtable<String, String> env = new Hashtable<>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://ldap.example.com:389");

        // 匿名绑定（如果服务器允许）
        env.put(Context.SECURITY_AUTHENTICATION, "none");

        try {
            DirContext ctx = new InitialDirContext(env);

            // 搜索配置
            SearchControls controls = new SearchControls();
            controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            controls.setReturningAttributes(new String[]{"uid", "cn", "mail"});

            // 执行搜索
            NamingEnumeration<SearchResult> results = ctx.search(
                "ou=users,dc=example,dc=com",
                "(objectClass=inetOrgPerson)",
                controls
            );

            List<String> users = new ArrayList<>();
            while (results.hasMore()) {
                SearchResult result = results.next();
                users.add(result.getNameInNamespace());
            }

            ctx.close();
            return users;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
}

import javax.naming.Context;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import java.util.Hashtable;

public class AdAuthentication {

    // 使用 LDAP 认证 AD 用户
    public boolean authenticateWithLdap(String username, String password) {
        Hashtable<String, String> env = new Hashtable<>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://ad.example.com:389");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");

        // AD 用户 DN 格式
        String userDn = username + "@example.com";
        env.put(Context.SECURITY_PRINCIPAL, userDn);
        env.put(Context.SECURITY_CREDENTIALS, password);

        try {
            DirContext ctx = new InitialDirContext(env);
            ctx.close();
            return true;
        } catch (Exception e) {
            return false;
        }
    }

    // 使用 Kerberos 认证（推荐）
    public boolean authenticateWithKerberos(String username, String password) {
        // 需要配置 krb5.conf 和 login.conf
        // 使用 GSSAPI 机制
        return false; // 示意
    }
}

// AD LDS 连接示例
env.put(Context.PROVIDER_URL, "ldap://adlds.example.com:50000");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put("java.naming.ldap.attributes.binary", "objectGUID");

@Service
public class LdapSyncService {

    @Autowired
    private UserRepository userRepository;

    @Autowired
    private LdapTemplate ldapTemplate;

    public void syncUsers() {
        // 从 LDAP 搜索所有用户
        List<User> ldapUsers = ldapTemplate.search(
            query()
                .base("ou=users,dc=example,dc=com")
                .where("objectClass").is("inetOrgPerson"),
            (ctx) -> {
                User user = new User();
                user.setUsername((String) ctx.getAttribute("uid").get());
                user.setEmail((String) ctx.getAttribute("mail").get());
                user.setFullName((String) ctx.getAttribute("cn").get());
                user.setEmployeeId((String) ctx.getAttribute("employeeNumber").get());
                return user;
            }
        );

        // 增量同步：只同步变更的用户
        for (User ldapUser : ldapUsers) {
            User existing = userRepository.findByUsername(ldapUser.getUsername());
            if (existing == null) {
                // 新用户：创建
                userRepository.save(ldapUser);
            } else if (hasChanges(existing, ldapUser)) {
                // 变更用户：更新
                existing.setEmail(ldapUser.getEmail());
                existing.setFullName(ldapUser.getFullName());
                userRepository.save(existing);
            }
        }
    }
}