LDAP Java 开发
我有三个与 LDAP 和 Java 相关的问题。
有没有办法使用Java在Windows活动目录中找到新创建的用户？现在我从活动目录中获取所有用户，循环遍历它们，并使用
whencreated属性来识别新用户。与上一个相同，有什么方法可以使用 Java 查找最近在 Active Directory 上修改的用户属性（例如名字更改或电子邮件更改等）？目前，我使用
whenchanged属性进行识别。有什么方法可以识别有关用户的信息已锁定/解锁或他处于活动/停用状态吗？
I have three questions related to LDAP and Java.
is there any way to find the newly created users on the windows active directory using Java? Now I am get the all users from active directory loop through them and using the
whencreatedattribute for identify the new users.same like previous one is there any way to find the users attributes that recently modified on active directory (like firstname changed or email changed like that) using Java? Currently I am identify using
whenchangedattribute.is there any way to identify the info about the user is locked/unlocked or he is in active/de-active like that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
LDAP 搜索 过滤器 应该给你什么你需要。
(&(objectClass=user)(whenCreated>=20110701000000.0Z))获取 2011 年 7 月 1 日或之后创建的用户帐户。(&(objectClass=user)( whenChanged>=20110701000000.0Z))以在 7 月或之后更改用户帐户2011 年 1 月 1 日。(&(objectClass=user)(whenChanged>=20110701000000.0Z)(userAccountControl:1.2.840.113556.1.4.803:=2))在 7 月或之后更改帐户2011 年 1 月 1 日起，该功能已被禁用。使用按位过滤器 匹配规则标识符来检查特定的userAccountControl标志。如果经常执行这些查询，您可能需要 索引
whenCreated和whenChanged属性。LDAP search filters should give you what you need.
(&(objectClass=user)(whenCreated>=20110701000000.0Z))to get user accounts created on or after July 1, 2011.(&(objectClass=user)(whenChanged>=20110701000000.0Z))to get user accounts changed on or after July 1, 2011.(&(objectClass=user)(whenChanged>=20110701000000.0Z)(userAccountControl:1.2.840.113556.1.4.803:=2))to get accounts changed on or after July 1, 2011 and that are disabled. Use a bitwise filter matching rule identifier to check for specificuserAccountControlflags.If these queries will be executed often, you might want to index the
whenCreatedandwhenChangedattributes.Active Directory 支持在更改时通知 LDAP 客户端 通过持续搜索（但请注意，每个连接最多可进行 5 次搜索）。我个人没有使用过这个，但是这里有一些例子, 此处和此处 (特别要注意的是，Active Directory 显然对这些搜索使用了不同的 OID。请注意，对 ADD 的监视非常简单，但修改需要 Java 应用程序进行一些工作，如下所示。 Active Directory 发送修改通知对于任何修改操作，无论属性如何，
@raddeman 对于锁定/解锁和启用/禁用都是完全正确的。对
userAccountControl进行简单的按位操作将帮助您提取这些值（例如userAccountControl 2 == 2表示用户被禁用。Active Directory does support notifying LDAP clients on change through persistent searches (note, however, the limit of 5 searches per connection). I haven't personally ever used this, but there are examples here, here, and here (in particular, notice that Active Directory apparently uses a different OID for these searches. Note that monitoring for
ADDs is pretty straight-forward, but modifications will require some work on the part of your Java app, as Active Directory sends modify notifications on any modification operation, regardless of attribute.@raddeman is exactly right regarding locks/unlocks and enabled/disabled. Simple bitwise operations on
userAccountControlwill help you get extract these values (e.g.userAccountControl & 2 == 2indicates a user is disabled.1）
LDAP 是一种协议，如果不手动执行（在您的情况下，在 Java 中），您就无法（据我所知）对结果进行排序。您可能会发现的另一件事是您搜索的值存储在其自己的字段中，如 Active Directory 中的 msSFU30MaxUidNumber，以获取 AD 中最大的 UNIX UID。
编辑： 正如 @EJP 所指出的，如果 LDAP 服务器支持的话，您可以指定排序。在 Java 中，请查看
javax .naming.ldap.SortControl2）我认为这与1相同
。3）是的，查看userAccountControl字段。它包含可在此处找到的值：http://support.microsoft.com/kb/305144 例如 ACCOUNTDISABLE (2)。
1)
LDAP is a protocol where you can not (what i know of) sort the result without doing it manually (in your case, in Java). Another thing that you might find is the value you searched for stored in its own field, as msSFU30MaxUidNumber in Active Directory to get the largest UNIX UID in the AD.
EDIT: As noted by @EJP, you can specify sorting if the LDAP-server supports it. In Java, look at
javax.naming.ldap.SortControl2) I think this is the same as 1.
3) Yes, look at the userAccountControl field. It contains values that could be found here: http://support.microsoft.com/kb/305144 such as ACCOUNTDISABLE (2).