我们使用 Active Directory (AD),当添加用户时,他们会设置密码和一个标志来强制执行“用户必须在下次登录时更改密码”,这会导致 AD 属性pwdLastSet=0
我有一个使用 Apache LDAP API 进行身份验证的 Java 应用程序,但是当我这样做时,我收到错误代码 49 INVALID_CREDENTIALS
,并且没有指示更改密码。
如何使用 Apache LDAP API 检测到用户必须先更改密码?
我的简单身份验证器:
public void authenticate(String uid, String password) {
String status = "";
try {
LdapConnectionConfig config = new LdapConnectionConfig();
config.setUseSsl(true);
config.setLdapHost("activedirectory.domain.net");
config.setLdapPort(636);
config.setTrustManagers(new NoVerificationTrustManager());
config.setName(_ldapMgmtUser);
config.setCredentials(_ldapMgmtPassword);
final DefaultPoolableLdapConnectionFactory factory = new DefaultPoolableLdapConnectionFactory(config);
final LdapConnectionPool pool = new LdapConnectionPool(factory);
pool.setTestOnBorrow(true);
final LdapConnectionTemplate ldapConnectionTemplate = new LdapConnectionTemplate(pool);
final PasswordWarning warning = ldapConnectionTemplate.authenticate(_rootDn, "(sAMAccountName=" + uid + ")",
SearchScope.SUBTREE, password.toCharArray());
status = "User credentials authenticated";
if (warning != null) {
status = status + " \n Warning!!" + warning.toString();
}
System.out.println(status);
} catch (final PasswordException e) {
System.err.println("############# PasswordException #############");
status = e.toString();
e.printStackTrace();
} catch (Exception e) {
System.err.println("############# Exception #############");
e.printStackTrace();
} finally {
}
return;
}