将Ldap用户与使用Java的组关联 [英] Associate Ldap user to a group with Java

问题描述

我在找到如何将#Ldap用户与给定群组相关联时遇到问题。

I'm having problems to find how to associate a #Ldap user to a given group.

这就是我尝试过的：

    Attributes attrs = new BasicAttributes();

    BasicAttribute basicAttrs = new BasicAttribute("objectclass");
    basicAttrs.add("top");
    basicAttrs.add("person");

    BasicAttribute memberOf = new BasicAttribute("memberOf");
    memberOf.add("Managers"); // Tried with distinguished name too
    memberOf.add("Administrators"); // Tried with distinguished name too

    attrs.put(basicAttrs);
    attrs.put("cn", user.getLogin());
    attrs.put("name", user.getLogin());
    attrs.put("login", user.getLogin());
    attrs.put("mail", user.getMail());
    attrs.put("displayName", user.getDisplayName());
    attrs.put("memberOf", memberOf);

    try {
        ctx.bind("CN=" + user.getLogin() + "," + baseDn, null, attrs);
    } catch (NamingException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

我还尝试使用以下专有名称：CN = Managers，OU =< system_name>，OU = Users，OU =< server>，DC = com，但不起作用。
我认为应该在某处引用Ldap组。

I also tried to use the distinguished names like: "CN=Managers,OU=<system_name>,OU=Users,OU=<server>,DC=com", but didn't work. I think it should be somewhere to reference the Ldap group.

但是我收到了这个错误：

But I got this error:

javax.naming.directory.InvalidAttributeValueException: Malformed 'memberOf' attribute value; remaining name 'CN=lcarvalho,OU=<system_name>,OU=Users,OU=<server>,DC=com'
at com.sun.jndi.ldap.LdapClient.encodeAttribute(LdapClient.java:951)
at com.sun.jndi.ldap.LdapClient.add(LdapClient.java:999)
at com.sun.jndi.ldap.LdapCtx.c_bind(LdapCtx.java:396)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_bind(ComponentDirContext.java:277)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:197)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:186)
at javax.naming.directory.InitialDirContext.bind(InitialDirContext.java:158)
...

这是除了我的应用程序行之外的所有堆栈跟踪。

This is all the stack trace besides my application lines.

推荐答案

如果您正在使用OpenLDAP，memberOf覆盖会自动维护memberOf属性，您的应用程序根本不应该写它。您应该做的是将用户的DN添加到他正在加入的组的uniqueMember或roleOccupant等属性中。然后它的DN将神奇地出现在他的memberOf属性中。

If you're using OpenLDAP the memberOf attribute is maintained automatically by the memberOf overlay, and your application shouldn't write it at all. What you should be doing is adding the DN of the user to the uniqueMember or roleOccupant etc attribute of the group he is joining. Then its DN will magically appear in his memberOf attribute.

这篇关于将Ldap用户与使用Java的组关联的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！