9

I'm able to authenticate to Active Directory if there is need to configure only one AD server. The solution is given as Active Directory authentication through ssl as anonymous user by me.

Now I'm stuck when there is multiple ADs running behind a Load Balancer.

Since Load Balancer is in between, I will get the Host name only and the IP of AD will be replaced with the Host name behind the Load Balancer based on the availability. Therefore, I won't be able to know which Active Directory server will be used to process my request of authentication. So , I won't be able to generate the certificate in advance. Also, I can't get the IPs of ADs my client is using for balancing the load(for security reasons). so there is no point of generating jssecacert. All I need to do is to disable the certificate validation. I'm using LdapTemplate class(using spring-ldap 1.3.1) to authenticate the user. My spring Config looks like this...

<bean id="ldapTemplate" class="org.springframework.ldap.core.LdapTemplate">
    <property name="contextSource" ref="contextSource" />
     <property name="ignorePartialResultException" value="yes" />
</bean>
<bean id="contextSource" class="org.springframework.ldap.core.support.LdapContextSource">
    <property name="url" value="ldaps://xxx.xxx.xxx.xxx:636" />
</bean>

The authenticate method:

public boolean login(String username, String password) {

    System.setProperty("javax.net.ssl.trustStore",
            .../jssecacerts");

    boolean authenticate=false;

    AndFilter filter = new AndFilter();
    filter.and(new EqualsFilter("xyz","xyz"));
    filter.and(new EqualsFilter("xyz", xyz));

    authenticate = this.ldapTemplate.authenticate(base, filter.encode(), password); 
    return authenticate;

    }

Since we don't need to have certificate System.setProperty("javax.net.ssl.trustStore", .../jssecacerts"); will not be needed.

What changes I need to make to disable the certificate validation.

I'm pretty new in LDAP stuff. , Kindly help with appropriate answer.

4

1 回答 1

14

好吧，感谢 Darren Hauge 提供了一个不关心 ssl 证书的棘手解决方案。在这里重写解决方案：

public static void trustSelfSignedSSL() {
    try {
        SSLContext ctx = SSLContext.getInstance("TLS");
        X509TrustManager tm = new X509TrustManager() {

            public void checkClientTrusted(X509Certificate[] xcs, String string) throws CertificateException {
            }

            public void checkServerTrusted(X509Certificate[] xcs, String string) throws CertificateException {
            }

            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };
        ctx.init(null, new TrustManager[]{tm}, null);
        SSLContext.setDefault(ctx);
    } catch (Exception ex) {
        ex.printStackTrace();
    }
}

我们只需要创建一个实用程序类并将此方法放入其中。在需要的地方调用此方法。

欢迎对此解决方案发表任何评论。

谢谢。

于 2013-06-20T04:57:31.097 回答