使用 Java 将 Ldap 用户与组关联

问题描述

我在查找如何将 #Ldap 用户与给定组关联时遇到问题.

I'm having problems to find how to associate a #Ldap user to a given group.

这是我尝试过的:

    Attributes attrs = new BasicAttributes();

    BasicAttribute basicAttrs = new BasicAttribute("objectclass");
    basicAttrs.add("top");
    basicAttrs.add("person");

    BasicAttribute memberOf = new BasicAttribute("memberOf");
    memberOf.add("Managers"); // Tried with distinguished name too
    memberOf.add("Administrators"); // Tried with distinguished name too

    attrs.put(basicAttrs);
    attrs.put("cn", user.getLogin());
    attrs.put("name", user.getLogin());
    attrs.put("login", user.getLogin());
    attrs.put("mail", user.getMail());
    attrs.put("displayName", user.getDisplayName());
    attrs.put("memberOf", memberOf);

    try {
        ctx.bind("CN=" + user.getLogin() + "," + baseDn, null, attrs);
    } catch (NamingException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

我还尝试使用专有名称，例如:CN=Managers,OU=,OU=Users,OU=,DC=com"，但没有奏效.我认为它应该在某个地方引用 Ldap 组.

I also tried to use the distinguished names like: "CN=Managers,OU=<system_name>,OU=Users,OU=<server>,DC=com", but didn't work. I think it should be somewhere to reference the Ldap group.

但是我收到了这个错误:

But I got this error:

javax.naming.directory.InvalidAttributeValueException: Malformed 'memberOf' attribute value; remaining name 'CN=lcarvalho,OU=<system_name>,OU=Users,OU=<server>,DC=com'
at com.sun.jndi.ldap.LdapClient.encodeAttribute(LdapClient.java:951)
at com.sun.jndi.ldap.LdapClient.add(LdapClient.java:999)
at com.sun.jndi.ldap.LdapCtx.c_bind(LdapCtx.java:396)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_bind(ComponentDirContext.java:277)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:197)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:186)
at javax.naming.directory.InitialDirContext.bind(InitialDirContext.java:158)
...

这是除了我的应用程序行之外的所有堆栈跟踪.

This is all the stack trace besides my application lines.

推荐答案

如果您使用 OpenLDAP，memberOf 属性由 memberOf 覆盖自动维护，您的应用程序根本不应该写它.您应该做的是将用户的 DN 添加到他加入的组的 uniqueMember 或 roleOccupant 等属性中.然后它的 DN 会神奇地出现在他的 memberOf 属性中.

If you're using OpenLDAP the memberOf attribute is maintained automatically by the memberOf overlay, and your application shouldn't write it at all. What you should be doing is adding the DN of the user to the uniqueMember or roleOccupant etc. attribute of the group he is joining. Then its DN will magically appear in his memberOf attribute.

这篇关于使用 Java 将 Ldap 用户与组关联的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！