ldap学习总结

chilongxph

浏览: 138438 次
性别:
来自: 深圳

最近访客更多访客>>

juluren

weisijun918612

fcoffee

8210

博主相关

博客

微博

相册

留言

关于我

文章分类

社区版块

存档分类

博客分类：

LDAP技术类

Security SUN 应用服务器

一． LDAPContext
它提供了一种用来建立经过鉴别的或匿名的连接LDAP服务器的方法，和一些用于用于在目录中进行查询，比较，修改，删除条目的方法。
获取连接：
static final String adminName = "uid=root,o=HGC";
static final String adminPassword = "secret";
static final String ldapURL = "LDAP://210.0.144.136:389";
注：世纪应用中，上述属性一般要通过配置文件来获取。

public static LdapContext getLdapDirContext () throws NamingException {
LdapContext ctx = null;
try {
//properties extends Hashtable，所以其为一个map集合，另一种方式采用的则是set集合
Properties env = new Properties ( );
env.put ( Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory" );
env.put ( Context.SECURITY_AUTHENTICATION, "simple" );
env.put ( Context.SECURITY_PRINCIPAL, adminName );
env.put ( Context.SECURITY_CREDENTIALS, adminPassword );
// connect to my domain controller
env.put ( Context.PROVIDER_URL, ldapURL ); // Create the initial directory context
ctx = new InitialLdapContext ( env , null ); if ( ctx == null ) {
    System.out.println("获取连接失败");
throw new NamingException ( "Connect LDAP failed, Please contact administration!" );

}else{
    System.out.println("获取连接成功");
}
} catch ( NamingException ne ) {

throw ne;
}
return ctx;
}
获取经过鉴别的连接：
public boolean loginUserCheck(String dn, String password)
     {
     boolean flag = false;

     LdapContext ctx = null;
     try
     {
     Properties env = new Properties();
     env.put ( Context.INITIAL_CONTEXT_FACTORY,
     "com.sun.jndi.ldap.LdapCtxFactory" );
     env.put(Context.SECURITY_AUTHENTICATION, "simple");
     env.put(Context.SECURITY_PRINCIPAL,dn);
     env.put(Context.SECURITY_CREDENTIALS, password);
     // connect to my domain controller
     env.put(Context.PROVIDER_URL, "LDAP://210.0.144.136:389");
     // Create the initial directory context
     ctx = new InitialLdapContext(env, null);
     if(ctx!=null){
     flag = true;
     }
     } catch (Exception e)
     {
     e.printStackTrace();

     } finally
     {
     LDAPManager.closeLdapContext(ctx);
     }
     return flag;
     }
二．添加条目
添加一个条目需要四步：
1. 创建条目属性，并把它们添加到属性集。
2. 指定将要创建的条目的DN。（dn：指定一条记录的位置）。
3. 通过dn和属性集合，创建一个ldap条目对象。
4. 调用LDAPContext的createSubcontext()方法把它加到目录中。
Eg: public boolean addEmail(Account account, LdapContext ctx)
            throws DaoException
    {
        boolean flag = false;
        //实现了attributes接口，attributes接口实现了cloneable接口
        BasicAttributes attrs = new BasicAttributes();
        String baseDN = "uid=" + account.getUid() + ",ou=" + account.getOu()
                + ",o=HGC";

        try
        {
//实现了attribute接口，attribute接口实现了cloneable接口
            BasicAttribute objclassSet = new BasicAttribute("objectclass");
            objclassSet.add("top");
            objclassSet.add("person");
            objclassSet.add("organizationalPerson");
            objclassSet.add("qmailUser");
            objclassSet.add("iPassRoamingUser");
            objclassSet.add("HGCBBUser");
            objclassSet.add("SpamUser");
            // objclassSet.add ( "WiFiUser" );
            attrs.put(objclassSet);

            attrs.put(Account.CN, account.getCn().trim());
            attrs.put(Account.SN, account.getSn().trim());
            attrs.put(Account.UID, account.getUid().trim());
            attrs.put(Account.CIRCUIT_ID, account.getCircuitID().trim());
            attrs.put(Account.OU, account.getOu().trim());
            attrs.put(Account.MAIL, account.getMail().trim());
            attrs.put(Account.USER_PASSWORD, account.getUserPassword().trim());
            attrs.put(Account.ACCOUNT_NUM, account.getAccountNum().trim());
            attrs.put(Account.MAIL_MESSAGE_STORE, account.getMailMessageStore()
                    .trim());
            attrs.put(Account.I_PASS_USERNAME, account.getIPassUsername()
                    .trim());

            attrs.put(Account.DELIVERY_MODE, account.getDeliveryMode().trim());
            attrs
                    .put(Account.ACCOUNT_STATUS, account.getAccountStatus()
                            .trim());
            attrs
                    .put(Account.ROAMING_STATUS, account.getRoamingStatus()
                            .trim());
            attrs.put(Account.ROAMING_ADMIN, account.getRoamingAdmin().trim());
            attrs.put(Account.ADMIN, account.getAdmin().trim());
            attrs.put(Account.DIALUP, account.getDialup().trim());
            attrs.put(Account.MAIL_HOST, account.getMailHost().trim());
            attrs.put(Account.MAIL_QUOTA, account.getMailQuota().trim());

            // new add attributes
            attrs.put(Account.XCHG_MAILBOX_TYPE, account.getXchgMailboxType()
                    .trim());
            attrs.put(Account.SPAM_STATUS, account.getSpamStatus().trim());
            attrs.put(Account.VIRUS_SCAN, account.getVirusScan().trim());
            attrs.put(Account.QUOTA_ALLOW_EXCEED, account.getQuotaAllowExceed()
                    .trim());
            attrs.put(Account.XCHG_MAILBOX_VAS, account.getXchgMailboxVas()
                    .trim());

            ctx.createSubcontext(baseDN, attrs);

            flag = true;
        } catch (Exception ex)
        {
            UtilTool.print(ex);
            throw new DaoException(ex);
        }

        return flag;
    }
三.删除条目
删除一个节点：分为两步：
1. 指定将要删除的条目的DN。
2. 调用LDAPContext. destroySubcontext（）方法
Eg：public boolean dropCircuit ( Circuit modcir, LdapContext ctx ) throws DaoException {
boolean success = false;
try {
String BaseDN = "circuitID=" + modcir.getCircuitID ( ) + ",ou=circuitInfo," + Constant.BASE_DN;
ctx.destroySubcontext ( BaseDN );
success = true;
} catch ( Exception ex ) {
UtilTool.print ( ex.toString ( ) );
throw new DaoException ( ex );
}
return success;
}
四．修改条目信息
更新操作，需要三步走：
1. 获取要更新的条目的dn。
2. 获取要更新的条目的条目数组：ModificationItem对象。
3. 调用LDAPContext. modifyAttributes（）方法
Eg：public boolean updateEmail(List<ModificationItem> modifyList,
            String modifyUid, String modifyOu, LdapContext ctx)
            throws DaoException
    {
        boolean flag = false;
        ModificationItem modificationItems[] = null;
        String baseDN = "uid=" + modifyUid + ",ou=" + modifyOu + ",o=HGC";
        int i = 0;

        try
        {
            modificationItems = new ModificationItem[modifyList.size()];
            for (Iterator<ModificationItem> it = modifyList.iterator(); it
                    .hasNext();)
            {
                modificationItems[i++] = it.next();
            }

            ctx.modifyAttributes(baseDN, modificationItems);

            flag = true;
        } catch (Exception ex)
        {
            UtilTool.print(ex);
            throw new DaoException(ex);
        }
        return flag;
}
五．查询条目信息

查询操作是ldap最重要，也是使用最多的操作。
查询要使用LDAPContext.search，当你执行一个Ldap查询方法时，你需要制定以下五种基本参数：
1. Search Base：它指定了你要从那条条目开始查询。例如：ou=hgcbroadband.com,o=HGC;空字符串表示从根目录开始查。
2. Search Scope：它指定你想查询的深度。
3. Search Filter：定义那些条目将被返回。不可为空！
4．Attribute List：用来指定你想从查询获取的条目中返回的属性，默认情况下，返回所有属性。
5. types Only：指定你希望返回属性还是返回属性和值来指示属性集合。

Eg：public Account getAccountInfoByUid(String uid, String domain,
            String[] returnedAtts, boolean activeAccountOnly, LdapContext ctx)
            throws DaoException
    {
        Account account = null;
        // Create the search controls
        SearchControls searchCtls = new SearchControls();
        // initialize counter to total the group members
        // specify the LDAP search filter
        String searchFilter = "";
        if (activeAccountOnly)
        {
            searchFilter = "(&(mail=" + (uid + "@" + domain)+ ")(accountStatus=active)(objectClass=qmailUser))";
        } else
        {
            searchFilter = "(&(mail=" + (uid + "@" + domain)+ ")(objectClass=qmailUser))";
        }

        // Specify the Base for the search
        String searchBase = "ou=" + domain + "," + Constant.BASE_DN;

        try
        {
            // Specify the search scope
            searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);

            // set return attributes
            if (returnedAtts != null && returnedAtts.length > 0)
            {
                searchCtls.setReturningAttributes(returnedAtts);
            }

            // Search for objects using the filter
            NamingEnumeration<SearchResult> result = ctx.search(searchBase,searchFilter, searchCtls);

            // Loop through the search results
            if (result != null && result.hasMoreElements())
            {
                account = new Account();
                account.seachResultToInfo(result.next());
            }
        } catch (NamingException ex)
        {
            UtilTool.print(ex);
            throw new DaoException(ex);
        }
        return account;
    }

分享到：