ldapsearch返回命名上下文但JNDI不

Question

如果使用ldapsearch在特定的LDAP服务器上搜索基本级别的命名上下文，则搜索效果良好。

$ ldapsearch -h myhealthisp.com -p 10389 -x -s base -b "" namingContexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingContexts
#

#
dn:
namingContexts: dc=myhealthisp,dc=com

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1`

然而，使用JNDI，我们得到以下响应：

没有结果：myhealthisp.com.问题：[LDAP：错误代码32-没有这样的对象]null

这是我们的代码：

private Attribute getCertFromLdap(SRVRecord srvRec, CertificateInfo certInfo) throws CertLookUpException{
    env.put(DirContext.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    sc1 = new SearchControls();
    sc1.setSearchScope(SearchControls.ONELEVEL_SCOPE);

try {
        env.put(DirContext.PROVIDER_URL, "ldap://" + targetDomain + ":" + srvRec.getPort());        
        System.out.println("ldap://" + targetDomain + ":" + srvRec.getPort());

        DirContext dc = new InitialDirContext(env);
        NamingEnumeration directoryNE = null;

        System.out.println("Got HERE!");
        directoryNE= dc.search("", "objectClass=*", sc1);

        System.out.println("SC1 :" + sc1);
        while (directoryNE.hasMore()){
                        SearchResult result1 = (SearchResult) directoryNE.next();

            // print DN of entry
            System.out.println("Result.getNameInNamespace: " + result1.getName());
            Attribute foundMail = findMailAttribute(result1.getNameInNamespace()); 

            if(foundMail != null){
                return foundMail;
            }
        }       
        dc.close(); 
} catch (NamingException e) {
    System.out.println("No Results for: " + targetDomain + "\nProblem: " +     e.getLocalizedMessage() + "  " + e.getCause());
} return null;

}

我们能够返回myhealthisp的基本目录的唯一方法。com是通过将目录名（dc=myhealthisp，dc=com）硬编码到基本目录搜索过滤器中（请参阅以下内容了解我们的代码依据：http://directory.apache.org/apacheds/manuals/basic-user-guide-1.5.8-SNAPSHOT/html/ch03s03.html#LDAP操作搜索）

当我们的代码搜索OnTest时。org LDAP服务器，我们得到了每个NamingContext。

以下是onctest.org服务器和myhealthisp.com服务器的Eclipse控制台的输出：

ldap://onctest.org.:10389
Got HERE!
SC1 :javax.naming.directory.SearchControls@4c408bfc
Result.getNameInNamespace: ou=config
Result.getNameInNamespace: dc=example,dc=com
Result.getNameInNamespace: ou=system
Search Result: cn=dts556: null:null:{mail=mail: [e-mail],     usercertificate=userCertificate: [B@35e06ba6, objectclass=objectClass: organizationalPerson,     person, inetOrgPerson, top, o=o: onctest, sn=sn: Test Case, cn=cn: dts556}

Service Record: _ldap._tcp.onctEst.org. 86400   IN  SRV 0 0 10389 onctest.org.
ldap://myhealthisp.com.:10389
Got HERE!
No Results for: myhealthisp.com.
Problem: [LDAP: error code 32 - No Such Object]  null
Unable to find certificate at LDAP for: [e-mail]
_ldap._tcp.myhealthisp.com. 3600    IN  SRV 0 0 10389 myhealthisp.com.

我们认为是以下原因造成了问题：

• JDNI无法对OpenLDAProotDSE对象类目录进行基本搜索。

Answer 1

当搜索级别不是base时，不能出现Root DSE。此外，LDAP客户端不得依赖于根DSE中包含的信息，因为这些属性可能受到访问控制的保护。来自RFC4512：

These attributes are retrievable, subject to access control and other
restrictions, if a client performs a Search operation [RFC4511] with
an empty baseObject, scope of baseObject, the filter
"(objectClass=*)" [RFC4515], and the attributes field listing the
names of the desired attributes.  It is noted that root DSE
attributes are operational and, like other operational attributes,
are not returned in search requests unless requested by name.

将搜索范围更改为base。更好的是，不要编写依赖于从根DSE检索的对象的代码。

• LDAP：根DSE

Answer 2

通常匿名绑定没有权限在根上执行ldap搜索。每个目录都具有匿名绑定和搜索根的OOTB权限。对于apache DS，可以通过ldap查询来搜索命名上下文

ldapsearch-h localhost-p 10389-s base-b”“（objectclass=*）”命名上下文

然而，子树搜索的一级搜索，例如

ldapsearch-hlocalhost-p 10389-s one-b""-D"uid=admin， ou=system"-w秘密"（对象类=*）"

给出以下结果：这是您在jndi程序中执行的操作：ldap\u搜索：无此类对象ldap\u搜索：其他信息：无此类对象：基于SearchRequest的失败DN:“过滤器：'（2.5.4.0=*）”范围：单级类型仅限：错误大小限制：无限制时间限制：无限制删除别名：从不删除别名属性：：null

第一个ldapsearch命令的JNDI代码：

import java.util.Hashtable;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;

public class SampleLDAPSearch {

  private Attribute getCertFromLdap() {
      String targetDomain = "localhost";
      String port = "10389";

      Hashtable env = new Hashtable();
      env.put(DirContext.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
      SearchControls sc1 = new SearchControls();
      sc1.setSearchScope(SearchControls.OBJECT_SCOPE);
      sc1.setReturningAttributes(new String[] { "namingContexts" });

      try {
          env.put(DirContext.PROVIDER_URL, "ldap://" + targetDomain + ":" + port);

          System.out.println("ldap://" + targetDomain + ":" + port);

          DirContext dc = new InitialDirContext(env);
          NamingEnumeration directoryNE = null;

          System.out.println("Got HERE!");
          directoryNE = dc.search("", "objectclass=*", sc1);

          System.out.println("SC1 :" + sc1);
          while (directoryNE.hasMore()) {
              SearchResult result1 = (SearchResult) directoryNE.next();

              // print DN of entry
              System.out.println("Result.getNameInNamespace: " + result1.getName());
              Attributes attrs = result1.getAttributes();
              Attribute attr = attrs.get("namingContexts");
              System.out.println(attr);

          }
          dc.close();
      } catch (NamingException e) {
          System.out.println("No Results for: " + targetDomain + "\nProblem: " + e.getLocalizedMessage() + "  "
                  + e.getCause());
      }
      return null;

  }

  public static void main(String[] args) {
      SampleLDAPSearch sls = new SampleLDAPSearch();
      sls.getCertFromLdap();
  }
}