使用 Java 将 LDAP 用户关联到组 [英] Associate Ldap user to a group with Java

问题描述

我在查找如何将 #Ldap 用户关联到给定组时遇到问题.

I'm having problems to find how to associate a #Ldap user to a given group.

这就是我尝试过的:

    Attributes attrs = new BasicAttributes();

    BasicAttribute basicAttrs = new BasicAttribute("objectclass");
    basicAttrs.add("top");
    basicAttrs.add("person");

    BasicAttribute memberOf = new BasicAttribute("memberOf");
    memberOf.add("Managers"); // Tried with distinguished name too
    memberOf.add("Administrators"); // Tried with distinguished name too

    attrs.put(basicAttrs);
    attrs.put("cn", user.getLogin());
    attrs.put("name", user.getLogin());
    attrs.put("login", user.getLogin());
    attrs.put("mail", user.getMail());
    attrs.put("displayName", user.getDisplayName());
    attrs.put("memberOf", memberOf);

    try {
        ctx.bind("CN=" + user.getLogin() + "," + baseDn, null, attrs);
    } catch (NamingException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

我还尝试使用可分辨名称，例如:CN=Managers,OU=,OU=Users,OU=,DC=com"，但没有奏效.我认为应该在某个地方引用 LDAP 组.

I also tried to use the distinguished names like: "CN=Managers,OU=<system_name>,OU=Users,OU=<server>,DC=com", but didn't work. I think it should be somewhere to reference the Ldap group.

但是我收到了这个错误:

But I got this error:

javax.naming.directory.InvalidAttributeValueException: Malformed 'memberOf' attribute value; remaining name 'CN=lcarvalho,OU=<system_name>,OU=Users,OU=<server>,DC=com'
at com.sun.jndi.ldap.LdapClient.encodeAttribute(LdapClient.java:951)
at com.sun.jndi.ldap.LdapClient.add(LdapClient.java:999)
at com.sun.jndi.ldap.LdapCtx.c_bind(LdapCtx.java:396)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_bind(ComponentDirContext.java:277)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:197)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:186)
at javax.naming.directory.InitialDirContext.bind(InitialDirContext.java:158)
...

这是除了我的应用程序行之外的所有堆栈跟踪.

This is all the stack trace besides my application lines.

推荐答案

如果您使用 OpenLDAP，memberOf 属性由 memberOf 覆盖层自动维护，并且您的应用程序根本不应该写它.您应该做的是将用户的 DN 添加到他正在加入的组的 uniqueMember 或 roleOccupant 等属性中.然后它的 DN 会神奇地出现在他的 memberOf 属性中.

If you're using OpenLDAP the memberOf attribute is maintained automatically by the memberOf overlay, and your application shouldn't write it at all. What you should be doing is adding the DN of the user to the uniqueMember or roleOccupant etc. attribute of the group he is joining. Then its DN will magically appear in his memberOf attribute.

这篇关于使用 Java 将 LDAP 用户关联到组的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！