LDAP. Java Application without Authentication

问题

This application will be run on clients that are already authenticated in Active Directory.

Problem: the LDAP protocol (or Active Directory settings) seem to require username and password.

Goal: query Active Directory using LDAP in Java without having to authenticate (ask for username and password).

Gist: all clients who run this application have already logged in. Thus, they are already authenticated (into)/ by Active Directory.

Now that they are logged in and have access to AD outside the application, isn't it possible to "mooch" off of the fact that they are already authenticated and run my LDAP queries in my application?

Errors: while trying to maneuver past authentication; I have become accustomed to binding errors, log4j errors; and almost everything recommended on Stack Overflow, Oracle and Apache.

Methods tried: I have tried anonymous binding, Ldap api's, nada!!

Questions:

Is it possible to query Active Directory without authentication?
Is it possible to query Active Directory by telling the server that "hey, I am already logged into AD, proceed with my queries?" without prompting the user for Username and password?

回答1:

Is it possible to query active directory without authentication?

I think no, you cannot as this will violate security. Another way might be to use Single sign on utilities that lets you sign in and then they will provide you the details.

Is it possible to query active directory by telling the server that "hey, I am already logged into AD, proceed with my queries?" without prompting the user for Username and password?

You can try http://spnego.sourceforge.net/ or http://jcifs.samba.org/src/docs/ntlmhttpauth.html to use NTLM

回答2:

The following solution (or at least a very similar one) was used to solve this question:

import com4j.Variant;
import com4j.typelibs.ado20.ClassFactory;
import com4j.typelibs.ado20._Command;
import com4j.typelibs.ado20._Connection;
import com4j.typelibs.ado20._Recordset;

public static void queryADForComputers() throws Exception {

    String query            = "cn,sn,givenName,department";
    String filter           = "(&(objectclass=user)(objectcategory=person))";
    String namingContext    = "OU=Desktops,OU=Workstations,OU=HO,DC=win";
    _Connection conn        = ClassFactory.createConnection();

    conn.provider("ADsDSOObject");
    conn.open("Active Directory Provider","","",-1);

    _Command cmd            = ClassFactory.createCommand();
    cmd.activeConnection(conn);
    cmd.commandText("<LDAP://" + namingContext + ">;" + filter + ";" + query + ";subTree");
    _Recordset rs = cmd.execute(null, Variant.getMissing(), -1);
    System.out.println("Found " + rs.recordCount() + " users/computers/whatever i was looking for");

    //Then here you can use a while loop while(!rs.eof())
    //in which you can get each value as rs.fields().item(i).value();
    //in my case, i did rs.fields().item(i).value().toString()
    //or you can check for its type and go from there. 
}

I worked on this a while ago and don't currently have an active directory to test and verify. but this should get you started.

来源：https://stackoverflow.com/questions/38580474/ldap-java-application-without-authentication

标签

java

authentication

active-directory

ldap