Spring Security LDAP身份驗證：未指定OU時發生異常

Question

我試圖使用LDAP和spring安全性進行身份驗證。雖然它試圖通過以下方式：

<security:ldap-server 
    url="ldap://mydomain.de:389/dc=mydomain,dc=de" manager-dn="***" 
    manager-password="***" /> 

<security:authentication-manager> 
    <security:ldap-authentication-provider 
     user-search-filter="(&amp;(&amp;(objectCategory=person)(objectClass=user))(sAMAccountName={0}))"> 
    </security:ldap-authentication-provider> 
</security:authentication-manager> 

我得到這個異常：

org.springframework.ldap.PartialResultException: Unprocessed Continuation Reference(s); nested exception is javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name '' 
    at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:216) 
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:385) 
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:328) 
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:629) 
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:570) 
    at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForMultipleAttributeValues(SpringSecurityLdapTemplate.java:241) 
    at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleAttributeValues(SpringSecurityLdapTemplate.java:166) 
    at org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGroupMembershipRoles(DefaultLdapAuthoritiesPopulator.java:239) 
    at org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.getGrantedAuthorities(DefaultLdapAuthoritiesPopulator.java:208) 
    at org.springframework.security.ldap.authentication.LdapAuthenticationProvider.loadUserAuthorities(LdapAuthenticationProvider.java:213) 
    at org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:89) 
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174) 
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:199) 
    at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:94) 
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:218) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
    at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:124) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:106) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) 
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) 
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) 
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
    at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:108) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207) 
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212) 
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) 
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502) 
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141) 
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) 
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616) 
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) 
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:528) 
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1099) 
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:670) 
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1520) 
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1476) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
    at java.lang.Thread.run(Unknown Source) 
Caused by: javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name '' 
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source) 
    at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) 
    at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source) 
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) 
    at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) 
    at javax.naming.directory.InitialDirContext.search(Unknown Source) 
    at org.springframework.ldap.core.LdapTemplate$4.executeSearch(LdapTemplate.java:322) 
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:363) 
    ... 52 more 

但是，當我更改LDAP服務器網址：

"ldap://mydomain.de:389/OU=Users,OU=DE,dc=mydomain,dc=de" manager-dn="***" 

它的工作原理。這對我來說不是最好的解決方案，因爲OU之外也有用戶。 爲什麼我必須添加OU才能使其工作？有沒有更好的方式來包含所有用戶（在根路徑中）？ 感謝您的幫助

Answer 1

好了，所以今天我終於找到了解決這個：

如上所述here，你必須定義一個好的ContextSource豆。我的xml現在看起來像這樣：

<bean id="contextSource" 
      class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"> 
     <constructor-arg value="ldap://mydomain.de:389/dc=mydomain,dc=de" /> 
     <property name="userDn" value="***" /> 
     <property name="password" value="***" /> 

     <property name="baseEnvironmentProperties"> 
      <map> 
       <entry key="java.naming.referral"> 
        <value>follow</value> 
       </entry> 
      </map> 
     </property> 
    </bean> 

    <security:authentication-manager> 
      <security:ldap-authentication-provider 
       user-search-filter="sAMAccountName={0}" server-ref="contextSource" /> 
    </security:authentication-manager> 

contextSource bean替換了ldap-server標記。 主要區別是java.naming.referral的「follow」值，這會導致spring遵循由AD @Ludovic Poitou返回的服務器引用talking about。

希望這可以幫助任何人有同樣的問題。

Answer 2

這是因爲您的Active Directory服務在不同服務器中有多個林。當您指向OU時，結果集位於單個服務器中。 當您指向域時，服務器會返回一些條目，但也會引用您應該繼續搜索的其他服務器。