如何在 Java 中读取 LDAP 密码策略
我可以从 LDAP 读取用户密码策略，例如密码何时过期或密码强度（最小长度等）等更多详细信息？我需要这些信息，以便我可以对数据库中保存的用户使用相同的策略。我的java应用程序要求数据库中的用户必须与域同步。
Can i read user password policy from LDAP, like when it expires or more details like password strength (minimal length etc.) ? I need these information so I can use the same policy for users kept in my database. My java application require that users from the database have to be synchronized with domain.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果您想通过 LDAP 查询获取密码策略，请尝试
在当前域中不使用 PSO 策略
如果您使用 PSO 策略，请尝试此代码
If you want to get the password policy through LDAP queries try this
without PSO policy in your current domain
If you use a PSO policy try this code
通常，在这些情况下至少需要关注三个不同的事情。
帐户状态，包括帐户锁定、过期或禁用等信息。
帐户“状态”通常反映在 MMC 帐户选项卡上。
我们在 wiki 上放置了一些有关 LDAP 值的信息：
http://ldapwiki。 willeke.com/wiki/Active%20Directory%20Account%20Lockout
和
http://ldapwiki.willeke.com/wiki/MMC%20Account%20Tab
密码状态，是否密码已过期。
不幸的是，反映这些条件状态的属性并没有实时反映在AD中。有些仅在用户尝试进行身份验证时更新。 （成功或不成功）。
-吉姆
Usually, there are at least three different things that are of concern in these circumstances.
Account status, which includes such information as is the account locked, expired or disabled.
The account "status" is typically reflected on the MMC Account Tab.
We put some information on our wiki about the LDAP values at:
http://ldapwiki.willeke.com/wiki/Active%20Directory%20Account%20Lockout
and
http://ldapwiki.willeke.com/wiki/MMC%20Account%20Tab
Password status, is the password expired.
Unfortunately, the attributes that reflect the status of these conditions are not reflected in AD in real time. Some are only updated when a user attempts to authenticate. (either successfully or un-successfully).
-jim
是的，您可以使用 JNDI。您必须从用户的上下文中读取 pwdPolicySubentry 操作属性的值。这将为您提供 pwdPolicy 对象的 DN，然后您可以将其作为具有属性的上下文进行查找，并获取以“pwd”开头的所有属性。但是，如果用户具有默认密码策略，您将必须查看 LDAP 服务器配置才能找到其 DN。在 OpenLDAP 中，它位于 slapd.conf 中“overlay ppolicy”指令块的 ppolicy_default 行中。
Yes you can, with JNDI. You have to read the value of the pwdPolicySubentry operational attribute from the user's Context. This gives you the DN of the pwdPolicy object, which you then lookup as a Context with attributes, and get all the attributes starting with 'pwd'. However if the user has the default password policy you will have to look at your LDAP server configuration to find its DN. In OpenLDAP this is in slapd.conf in the ppolicy_default line in the 'overlay ppolicy' directives block.
这取决于底层 LDAP 服务器。
例如，如果您使用的是 Microsoft Active Directory，则用户条目将具有名为
accountExpires的属性，它是帐户到期的日期。Active Directory 还有一个名为
userAccountControl的用户属性，它是指定各种帐户相关状态的位掩码。例如，如果设置了第 24 位，则意味着密码已过期 (userAccountControl & 0x800000 != 0)。位 2 是“帐户已禁用”等。请访问 http://support.microsoft.com/kb/305144 了解更多信息。对于其他 LDAP 服务器（OpenLDAP、ApacheDS 等），您必须查看文档。
It depends the underlying LDAP server.
For instance, if you are using Microsoft Active Directory, a user entry will have an attribute called
accountExpireswhich is the date the account expires.Active Directory also have a user attribute called
userAccountControlwhich is a bit-mask specifying various account related states. For instance, if bit 24 is set, that means that the password has expired (userAccountControl & 0x800000 != 0). Bit 2 is "account disabled" etc. Read more at http://support.microsoft.com/kb/305144.For other LDAP servers (OpenLDAP, ApacheDS, etc, etc) you'll have to look into the documentation.