Geek Answers Handbook

How to get all LDAP groups for a specific user?

I have a weblogic server using external LDAP as an authentication provider. I need to restore the groups that a specific user has contacted in the LDAP repository.

Logging in uses the standard java notation:

<form method="POST" action="j_security_check"> <p>Username: <input type="text" name="j_username"/></p> <p>Password: <input type="password" name="j_password"/></p> <input type="submit" value="Login"/> </form>

And after login, I can restore Princial using: <% = request.getUserPrincipal ()%>

But now I need to restore all related groups for this principal from LDAP? Is it possible?

[] S

+4
source share
3 answers

You may not be able to get a list of all groups without using LDAP. The JAAS API usually gives you the opportunity to ask if a user belongs to a specific group, but not immediately get all the groups.

The best you can do without accessing LDAP directly is something like

 for (String group : allGroups) { if (request.isUserInRole(group)) { userGroups.add(group); } }

A performance hit should not be too bad if you do it once when creating a session and then create user groups with the session. (A container can receive all groups at login.)

+2
source

There may be many answers. One possible answer is to build the base DN using the principal and query the directory server using the base scope, the filter '(&)' and request the isMemberOf attribute. For example, on my test system using the modern ldapsearch command line tool and the user.0 :

 ldapsearch --hostname localhost --port 1389 \ --bindDN 'cn=directory manager' --baseDn \ 'uid=user.0,ou=people,dc=example,dc=com' \ --searchScope base '(&)' isMemberOf Password for user 'cn=directory manager': dn: uid=user.0,ou=people,dc=example,dc=com isMemberOf: cn=shadow entries,ou=groups,dc=example,dc=com isMemberOf: cn=persons,ou=groups,dc=example,dc=com

This method requires knowledge of namingContext , in this case dc=example,dc=com and where users are in the tree. Another, similar method, when the user's location is unknown, will be the first search of the user, and then use the distinguished name from the search results to perform the above query. If namingContext not known, it may be possible to detect namingContext from the root DSE. To restore namingContext from the root DSE, see.

There are several widely used directory servers that incorrectly support the LDAP standard and will reject the '(&)' filter, if your directory server is one of them, just replace the presence filter '(objectClass=*)' . There are many LDK SDKs for Java, I prefer one of the UnboundID .

+1
source

I had the same problem. Looking at google, I found this: http://buttso.blogspot.com/2011/06/weblogic-server-listing-groups-of.html

I hope this helps you!

+1
source

More articles:


All Articles