在LDAP服務器中查詢「ACTIVE」用戶不起作用

Question

我需要通過使用LDAP服務器查詢活動目錄來獲取活動目錄中定義的ACTIVE用戶列表。

我試圖通過成功連接到我的ldap服務器來做到這一點。在下面的java代碼中，當使用accountExpires屬性時，我只返回1條記錄。我應該找回記錄列表，每條記錄都顯示來自ldap服務器的DISPLAY NAME和MAIL屬性。

這裏是我的代碼：

public static void main(String[] args) { 
    ADUserAttributes adUserAttributes = new ADUserAttributes(); 
    adUserAttributes.getLdapContext()); 
    adUserAttributes.getActiveEmpRecordsList("0", adUserAttributes.getLdapContext()); 
} 

public LdapContext getLdapContext(){ 
    LdapContext ctx = null; 
    try{ 
     Hashtable env = new Hashtable(); 
     env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); 
     env.put(Context.SECURITY_AUTHENTICATION, "Simple"); 
     env.put(Context.SECURITY_PRINCIPAL, "e~inventory"); 
     env.put(Context.SECURITY_CREDENTIALS, "password"); 
     env.put(Context.PROVIDER_URL, "ldap://xxxdc01.txh.org"); 
     ctx = new InitialLdapContext(env, null); 
     System.out.println("Connection Successful."); 
    } catch(NamingException nex){ 
     System.out.println("LDAP Connection: FAILED"); 
     nex.printStackTrace(); 
    } 
    return ctx; 
} 

private List<String> getActiveEmpRecordsList(String accountExpires, LdapContext ctx) { 
List<String> activeEmpAttributes = new ArrayList<String>(); 
Attributes attrs = null; 
try { 
    SearchControls constraints = new SearchControls(); 
    constraints.setSearchScope(SearchControls.SUBTREE_SCOPE); 
    String[] attrIDs = {"displayname", "mail"}; 
    constraints.setReturningAttributes(attrIDs); 
    NamingEnumeration answer = ctx.search("DC=txh,DC=org", "accountExpires=" + accountExpires, constraints); 
    if (answer.hasMore()) { 
     attrs = ((SearchResult) answer.next()).getAttributes(); 
     int empNameLen = attrs.get("displayname").toString().length(); 
     int empEmailAddrLen = attrs.get("mail").toString().length(); 
     activeEmpAttributes.add(attrs.get("displayname").toString().substring(13, empNameLen)); 
     activeEmpAttributes.add(attrs.get("mail").toString().substring(6, empEmailAddrLen)); 
     ctx.close(); 
    }else{ 
     throw new Exception("Invalid User"); 
    } 
    System.out.println("activeEmpAttributes: " + activeEmpAttributes); 
    System.out.println("count: " + activeEmpAttributes.size()); 
} catch (Exception ex) { 
    ex.printStackTrace(); 
} 
return activeEmpAttributes; 
} 

Answer 1

您可以使用PrincipalSearcher和「查詢通過例如」主要做你的搜索：

// create your domain context 
PrincipalContext ctx = new PrincipalContext(ContextType.Domain); 

// define a "query-by-example" principal - here, we search for active UserPrincipals 
UserPrincipal qbeUser = new UserPrincipal(ctx); 
qbeUser.Enabled = true; 

// create your principal searcher passing in the QBE principal  
PrincipalSearcher srch = new PrincipalSearcher(qbeUser); 

// find all matches 
foreach(var found in srch.FindAll()) 
{ 
    // do whatever here - "found" is of type "Principal" - it could be user, group, computer.....   
} 

如果您還沒有 - 請仔細閱讀MSDN文章Managing Directory Security Principals in the .NET Framework 3.5，該文章很好地展示瞭如何充分利用System.DirectoryServices.AccountManagement

中的新功能您可以指定任何UserPrincipal上的屬性，並將它們用作您的PrincipalSearcher的「查詢範例」。