Spring ldap 身份验证失败错误代码
我正在使用 Spring LDAP (1.3.1) 与 ADAM 和 Active Directory 进行交互。
当我尝试使用 ldapTemplate.authenticate() 对某人进行身份验证时，我通过错误回调返回错误，但它给出了一个非常通用的异常 AuthenticationException 并且我无法提取到底是什么问题：
- 帐户禁用
- 密码过期
- 时更改密码
- 必须在下次登录帐户 过期
- 等
我返回的只是一条详细信息，我认为这是 AD 发回的内容。像这样的东西：
org.springframework.ldap.AuthenticationException： [LDAP：错误代码 49 - 8009030C： LdapErr：DSID-0C0903A9，评论： AcceptSecurityContext 错误，数据 773， v1db0
我可以看到数据773，这意味着用户下次登录时必须更改密码。我不想手动解析这个。是否有我不知道的“适配器”？
有人遇到过这个问题吗？
多谢！
I'm using Spring LDAP (1.3.1) to talk to ADAM and Active Directory.
When I try to authenticate someone using ldapTemplate.authenticate() I get back errors via the error callback, but it gives a very generic exception AuthenticationException and I cannot extract what exactly is the problem:
- account disabled
- password expired
- must change password on next login
- account expired
- etc
All I get back is a detailMessage which I assume is what AD sends back. Something like:
org.springframework.ldap.AuthenticationException:
[LDAP: error code 49 - 8009030C:
LdapErr: DSID-0C0903A9, comment:
AcceptSecurityContext error, data 773,
v1db0
I can see data 773, which means the user must change the password at next login. I don't want to parse this manually. Are there any "adapters" I am not aware of?
Did anyone ever had this problem?
Thanks a lot!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
此链接列出了 ldap 错误代码如何映射到 JNDI 异常。查看 spring ldap 代码，似乎 spring 将每个 JNDI 异常映射到其自定义 LDAP 异常 (
LdapUtils.convertLdapException())现在，
773似乎特定于 Active Directory。因此，如果需要，这需要由用户明确处理。 此链接列出了一堆 Active Directory 错误。 Spring ldap 将在其错误详细信息中提供此文本，让用户根据需要使用它们。This link lists how ldap error codes map to JNDI Exceptions. Looking at spring ldap code, it appears that spring maps each JNDI exception to its custom LDAP exception (
LdapUtils.convertLdapException())Now,
773seems specfic to Active Directory. Hence this needs to be handled by user explicitly, if required. This link lists a bunch of Active Directory errors. Spring ldap would provide this text in its error details, leaving the user to use them as suitable.如果您的代码最终出现在PasswordPolicyAwareContextSource.getContext中
或者在类似的 spring 代码中，Spring 不能很好地处理它（bug）。
当帐户过期时，会引发异常。上面的类捕获了这个异常
然后，这是关键，它调用
PasswordPolicyResponseControl ctrl = PasswordPolicyControlExtractor.extractControl(ctx);
Spring 然后调用 ctrl.isLocked() 但无法检查任何其他条件。
您应该覆盖 Spring 的代码，并且您可以检查 ctrl.isExpired()、ctrl.isChangeAfterReset() 以及此时可用的许多其他信息获取器
if your code ends up in PasswordPolicyAwareContextSource.getContext
or in similar spring code, Spring does not handle it very well (bug).
When the account is expired an exception is thrown. the above class catches this exception
and then, and this is the key, it calls
PasswordPolicyResponseControl ctrl = PasswordPolicyControlExtractor.extractControl(ctx);
Spring then calls ctrl.isLocked() but fails to check for any of the other conditions.
You should override Spring's code, and you can check ctrl.isExpired(), ctrl.isChangeAfterReset(), and a bunch of other information getters are available there at that point