使用 Java 将 Ldap 用户与组关联
我在查找如何将 #Ldap 用户与给定组关联时遇到问题.
I'm having problems to find how to associate a #Ldap user to a given group.
这是我尝试过的:
Attributes attrs = new BasicAttributes();
BasicAttribute basicAttrs = new BasicAttribute("objectclass");
basicAttrs.add("top");
basicAttrs.add("person");
BasicAttribute memberOf = new BasicAttribute("memberOf");
memberOf.add("Managers"); // Tried with distinguished name too
memberOf.add("Administrators"); // Tried with distinguished name too
attrs.put(basicAttrs);
attrs.put("cn", user.getLogin());
attrs.put("name", user.getLogin());
attrs.put("login", user.getLogin());
attrs.put("mail", user.getMail());
attrs.put("displayName", user.getDisplayName());
attrs.put("memberOf", memberOf);
try {
ctx.bind("CN=" + user.getLogin() + "," + baseDn, null, attrs);
} catch (NamingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
我还尝试使用专有名称,例如:CN=Managers,OU=
I also tried to use the distinguished names like: "CN=Managers,OU=<system_name>,OU=Users,OU=<server>,DC=com", but didn't work. I think it should be somewhere to reference the Ldap group.
但是我收到了这个错误:
But I got this error:
javax.naming.directory.InvalidAttributeValueException: Malformed 'memberOf' attribute value; remaining name 'CN=lcarvalho,OU=<system_name>,OU=Users,OU=<server>,DC=com'
at com.sun.jndi.ldap.LdapClient.encodeAttribute(LdapClient.java:951)
at com.sun.jndi.ldap.LdapClient.add(LdapClient.java:999)
at com.sun.jndi.ldap.LdapCtx.c_bind(LdapCtx.java:396)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_bind(ComponentDirContext.java:277)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:197)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.bind(PartialCompositeDirContext.java:186)
at javax.naming.directory.InitialDirContext.bind(InitialDirContext.java:158)
...
这是除了我的应用程序行之外的所有堆栈跟踪.
This is all the stack trace besides my application lines.
推荐答案
如果您使用 OpenLDAP,memberOf
属性由 memberOf
覆盖自动维护,您的应用程序根本不应该写它.您应该做的是将用户的 DN 添加到他加入的组的 uniqueMember
或 roleOccupant
等属性中.然后它的 DN 会神奇地出现在他的 memberOf
属性中.
If you're using OpenLDAP the memberOf
attribute is maintained automatically by the memberOf
overlay, and your application shouldn't write it at all. What you should be doing is adding the DN of the user to the uniqueMember
or roleOccupant
etc. attribute of the group he is joining. Then its DN will magically appear in his memberOf
attribute.
相关文章