Ldap实现AD域认证

1、java Ldap基础类

package com.common;

import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.UnsupportedEncodingException;
import java.util.ArrayList;
import java.util.Hashtable;
import java.util.List;
import java.util.Properties;

import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;

import org.apache.log4j.LogManager;
import org.apache.log4j.Logger;

public class LdapLoadUserAD {
    private static final Logger logger = LogManager.getLogger(LdapLoadUserAD.class);
    private LdapContext ctx = null;
    private String adminName = "TEST\\Administrator";
    private String adminpassword = "admin";
    private String host = "10.24.7.252";
    private String port = "389";
    private String ldapURL = new String("ldap://" + host + ":" + port);
    private String searchBase = "OU=组织单位1,DC=test,DC=com";
    private String searchFilter = "(&(objectClass=group)(cn=" + "war3" + "))";
    private String returnedAtts[] = { "url", "whenChanged", "employeeID",
            "name", "userPrincipalName", "physicalDeliveryOfficeName",
            "departmentNumber", "telephoneNumber", "homePhone", "mobile",
            "department", "sAMAccountName", "whenChanged", "mail" };

    /**
     * 已管理员身份 初始ad域服务器 （后期改进配置文件）
     *
     * @return
     * @throws UnsupportedEncodingException
     */
    public boolean initial_Ldap() throws UnsupportedEncodingException {
        Hashtable env = new Hashtable();
        env.put(Context.INITIAL_CONTEXT_FACTORY,
                "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, adminName);
        env.put(Context.SECURITY_CREDENTIALS, adminpassword);
        env.put(Context.PROVIDER_URL, ldapURL);
        try {
            logger.info("Start InitialLdapContext");
            ctx = new InitialLdapContext(env, null);
            logger.info("InitialLdapContext succeed");
        } catch (NamingException e) {
            logger.error("Problem initial_Ldap NamingException: " + e);
            return false;
        }
        return true;
    }

    public boolean initial_Ldap(String administratorName,
            String administratorPwd, String url) throws UnsupportedEncodingException {
        Hashtable env = new Hashtable();
        env.put(Context.INITIAL_CONTEXT_FACTORY,
                "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, administratorName);
        env.put(Context.SECURITY_CREDENTIALS, administratorPwd);
        env.put(Context.PROVIDER_URL, url);
        try {
            logger.info("Start InitialLdapContext");
            ctx = new InitialLdapContext(env, null);
            logger.info("InitialLdapContext succeed");
        } catch (NamingException e) {
            logger.error("Problem initial_Ldap NamingException: " + e);
            return false;
        }

        return true;
    }

    public boolean initial_Ldap(String administratorName,
            String administratorPwd, String url, String keystore,
            String keyPassword) {
        Hashtable env = new Hashtable();
        System.setProperty("javax.net.ssl.trustStore", keystore);
        System.setProperty("javax.net.ssl.trustStorePassword", keyPassword);
        env.put(Context.INITIAL_CONTEXT_FACTORY,
                "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.SECURITY_AUTHENTICATION, "simple");
        env.put(Context.SECURITY_PRINCIPAL, administratorName);
        env.put(Context.SECURITY_CREDENTIALS, administratorPwd);
        env.put(Context.SECURITY_PROTOCOL, "ssl");
        env.put(Context.PROVIDER_URL, url);
        try {
            logger.info("Start InitialLdapContext");
            ctx = new InitialLdapContext(env, null);
            logger.info("InitialLdapContext succeed");
        } catch (NamingException e) {
            logger.error("Problem initial_Ldap NamingException: " + e);
            return false;
        }

        return true;
    }

    /**
     * 关闭Close Ldap
     *
     * @return
     */
    public boolean close_Ldap() {
        logger.info("Close Ldap");
        try {
            ctx.close();
        } catch (NamingException e) {
            logger.error("Problem close_Ldap NamingException: " + e);
            return false;
        }
        return true;
    }

    /**
     * 自定义返回ldap树节点内容
     *
     * @param username
     *            如果不为空返回指定节点内容
     * @return
     */
    public Hashtable<String, List> search_distinguishedName(String username) {
        if (!(username.equals(""))) {
            String searchFilter = "(&(objectClass=user)(cn=" + username + "))";
            this.setSearchFilter(searchFilter);
        }

        Hashtable<String, List> ls = new Hashtable<String, List>();
        try {
            logger.info("Start search " + username+ "'s distinguishedName");
            SearchControls searchCtls = new SearchControls();
            searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            searchCtls.setReturningAttributes(this.getReturnedAtts());
            NamingEnumeration answer = ctx.search(this.getSearchBase(),
                    this.getSearchFilter(), searchCtls);
            int totalResults = 0;// Specify the attributes to return
            int rows = 0;
            while (answer.hasMoreElements()) {// 遍历结果集
                SearchResult sr = (SearchResult) answer.next();// 得到符合搜索条件的DN

                String dn = sr.getName();

                String match = dn.split("CN=")[1].split(",")[0];// 返回格式一般是CN=test,OU=测试
                logger.info("match=" + match);

                Attributes Attrs = sr.getAttributes();// 得到符合条件的属性集
                if (Attrs != null) {
                    try {
                        for (NamingEnumeration ne = Attrs.getAll(); ne
                                .hasMore();) {
                            List nb = new ArrayList();
                            ;
                            Attribute Attr = (Attribute) ne.next();// 得到下一个属性
                            String valueid = Attr.getID().toString();
                            logger.info(" AttributeID=属性名：" + valueid);

                            // 读取属性值
                            for (NamingEnumeration e = Attr.getAll(); e
                                    .hasMore(); totalResults++) {

                                String value = e.next().toString();
                                logger.info("    AttributeValues=属性值："+ value);
                                nb.add(value);
                            }
                            ls.put(valueid, nb);
                            logger.info("    ---------------");

                        }
                    } catch (NamingException e) {
                        logger.error("Throw Exception : " + e);
                    }
                }// if

            }
        } catch (NamingException e) {
            logger.error("Problem search_distinguishedName NamingException: "
                            + e);

        }
        return ls;
    }

    public boolean searchAD(String username, String pwd, String domain) {

        try {
            Properties env = new Properties();
            //String account = username + "@" + domain;
            String ldapURL = "LDAP://" + this.host + ":" + this.port;

            env.put(Context.PROVIDER_URL, ldapURL);
            env.put(Context.SECURITY_PRINCIPAL, username);
            env.put(Context.SECURITY_CREDENTIALS, pwd);
            //获取配置
            //env = this.getAdProperties(env);
            env.put(Context.SECURITY_AUTHENTICATION, "simple");
            env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
            // 批量处理
            env.put(Context.BATCHSIZE, "50");
            // 连接超时设置
            env.put("com.sun.jndi.ldap.connect.timeout","300000");
            // LDAP连接池
            env.put("com.sun.jndi.ldap.connect.pool", "true");
            // LDAP连接池最大数
            env.put("com.sun.jndi.ldap.connect.pool.maxsize", "30");
            // LDAP连接池优先数
            env.put("com.sun.jndi.ldap.connect.pool.prefsize", "10");
            // LDAP连接池超时
            env.put("com.sun.jndi.ldap.connect.pool.timeout", "3000");
            // LDAP连接池初始化数
            env.put("com.sun.jndi.ldap.connect.pool.initsize", "10");
            // LDAP连接池的认证方式
            env.put("com.sun.jndi.ldap.connect.pool.authentication", "simple");

            DirContext dc = new InitialLdapContext(env, null);
            logger.info("认证成功");

            SearchControls searchCtls = new SearchControls();
            searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            String searchFilter = "(&(objectCategory=person)(objectClass=user)(name=*))";
            String searchBase = "DC=test,DC=com";
            String returnedAtts[] = {"memberOf","uSNCreated"};
            searchCtls.setReturningAttributes(returnedAtts);
            NamingEnumeration<SearchResult> answer = dc.search(searchBase, searchFilter,searchCtls);
            while (answer.hasMoreElements()) {
                SearchResult sr = (SearchResult) answer.next();
                logger.info("<<<::[" + sr.getName()+",uSNCreated="+sr.getAttributes().get("uSNCreated")+"]::>>>>");
            }
            dc.close();

            return true;
        } catch (Exception e) {
            logger.error("认证失败:"+e.getMessage());
            return false;
        }

    }
    /**
     * 验证AD域用户登录
     *
     * @param username
     *            用户名
     * @param pwd
     *            密码
     * @param domain
     *            域名称
     * @return
     */
    public boolean login(String username, String pwd, String url,String domain) {
        try {
            //String account = username + "@" + domain;
            //String ldapURL = "LDAP://" + this.host + ":" + this.port;
            //username = "test\\"+username;
            username = domain+"\\"+username;
            Properties env = new Properties();
            String ldapURL = "LDAP://" + url;
            env.put(Context.PROVIDER_URL, ldapURL);
            env.put(Context.SECURITY_PRINCIPAL, username);
            env.put(Context.SECURITY_CREDENTIALS, pwd);
            logger.info("------------ LdapLoadUserAD ---- login 1------------------ ldapURL="+ldapURL+"---username="+username+"---pwd="+pwd);
            //获取配置
            env = this.getAdProperties(env);
            //认证
            DirContext dc = new InitialLdapContext(env, null);
            logger.debug("AD域认证登录成功LDAP接口" + " - username：[" + username +"] pwd：["+ pwd +"]");
            dc.close();
            return true;
        } catch (Exception e) {
            logger.error("AD域认证登陆失败LDAP接口：【"+ e.getMessage() + "】 - username：[" + username +"] pwd：["+ pwd +"]");
            return false;
        }

    }
    /**
     * 读取配置文件 配置AD域
     */
    public Properties getAdProperties (Properties env) throws IOException{
        InputStream is =null;
        Properties props = new Properties();
        try{
            String f0 = Common.getClassPath() + "ad.properties";
            is = new FileInputStream(f0);
            props.load(is);
        }catch(Exception e){
            e.printStackTrace();
        }finally{
            if(null != is){
                is.close();
                is = null;
            }
        }
        env.put(Context.SECURITY_AUTHENTICATION, props.getProperty("context.security.authentication"));
        env.put(Context.INITIAL_CONTEXT_FACTORY, props.getProperty("context.initial.context.factory"));
        // 批量处理
        env.put(Context.BATCHSIZE, props.getProperty("context.batchsize"));
        // 连接超时设置
        env.put("com.sun.jndi.ldap.connect.timeout", props.getProperty("ldap.connect.pool.timeout"));
        // LDAP连接池
        env.put("com.sun.jndi.ldap.connect.pool", props.getProperty("ldap.connect.pool"));
        // LDAP连接池最大数
        env.put("com.sun.jndi.ldap.connect.pool.maxsize", props.getProperty("ldap.connect.pool.maxsize"));
        // LDAP连接池优先数
        env.put("com.sun.jndi.ldap.connect.pool.prefsize", props.getProperty("ldap.connect.pool.prefsize"));
        // LDAP连接池超时
        env.put("com.sun.jndi.ldap.connect.pool.timeout", props.getProperty("ldap.connect.pool.timeout"));
        // LDAP连接池初始化数
        env.put("com.sun.jndi.ldap.connect.pool.initsize", props.getProperty("ldap.connect.pool.initsize"));
        // LDAP连接池的认证方式
        env.put("com.sun.jndi.ldap.connect.pool.authentication", props.getProperty("ldap.connect.pool.authentication"));
        return env;
    }

    /**
     * 返回登录域用户
     *
     * @return
     */
    public String getAdminName() {
        return adminName;
    }

    /**
     * 返回搜索域节点
     *
     * @return
     */
    public String getSearchBase() {
        return searchBase;
    }

    /**
     * 设置 ad域 （ldapURL）中 搜索域节点
     *
     * @param searchBase
     */
    public void setSearchBase(String searchBase) {
        this.searchBase = searchBase;
    }

    /**
     * 返回搜索过滤器
     *
     * @return
     */
    public String getSearchFilter() {
        return searchFilter;
    }

    /**
     * 设置 LDAP搜索过滤器
     *
     * @param searchFilter
     */
    public void setSearchFilter(String searchFilter) {
        this.searchFilter = searchFilter;
    }

    /**
     * 返回 域节点、过滤器类和搜索控制器搜索LDAP得到结果
     *
     * @return
     */
    public String[] getReturnedAtts() {
        return returnedAtts;
    }

    /**
     * 设置的域节点、过滤器类和搜索控制器搜索LDAP得到结果
     *
     * @param returnedAtts
     */
    public void setReturnedAtts(String[] returnedAtts) {
        this.returnedAtts = returnedAtts;
    }

    /**
     * 设置登录域用户
     *
     * @param adminName
     */
    public void setAdminName(String adminName) {
        this.adminName = adminName;
    }

    public String getAdminpassword() {
        return adminpassword;
    }

    public void setAdminpassword(String adminpassword) {
        this.adminpassword = adminpassword;
    }

    public String getHost() {
        return host;
    }

    public void setHost(String host) {
        this.host = host;
    }

    public String getPort() {
        return port;
    }

    public void setPort(String port) {
        this.port = port;
    }

    public String getLdapURL() {
        return ldapURL;
    }

    public void setLdapURL(String ldapURL) {
        this.ldapURL = ldapURL;
    }

}

2、java业务逻辑调用基层方法即可  这个是验证用户名 密码的调用

//连接AD域 验证登录用户名、密码是否正确
            LdapLoadUserAD inst = new LdapLoadUserAD();
            String url = this.userService.getParams("ad_ip")+":"+this.userService.getParams("ad_port");//AD域地址
            String domain = this.userService.getParams("ad_domain");//AD域域名
            succ = inst.login(username,password,url,domain);

3、写一个配置AD域库 相关参数配置的文件ad.properties 方便读取 修改

#AD域库 相关参数配置

#连接超时设置
ldap.connect.timeout=300000
#LDAP连接池
ldap.connect.pool=true
#LDAP连接池最大数
ldap.connect.pool.maxsize=30
#LDAP连接池优先数
ldap.connect.pool.prefsize=10
#LDAP连接池超时
ldap.connect.pool.timeout=3000
#LDAP连接池初始化数
ldap.connect.pool.initsize=10
#LDAP连接池的认证方式
ldap.connect.pool.authentication=simple
#批量处理
context.batchsize=50
#认证类型
context.security.authentication=simple
#初始上下文工厂
context.initial.context.factory=com.sun.jndi.ldap.LdapCtxFactory

4、代码部分大致是这个意思了，测试调试的时候，需要配置微软的AD域库，具体配置方案网上还是很多的。