ldap hell

[Vinnie Jenks]

I'm in LDAP hell...I simply cannot get this chunk of code to authenticate on our active directory server.

First off, I don't know all that much about AD, LDAP or related stuff. Everything I know about JNDI I've learned in the last 2 hours.

I've been tasked w/ simply retrieving a list of users in AD and listing them out on a page. I wrote a simple class cobbled together from code I found while googling around.

Here's my class:

package com.ab.AAFTesting.ldap;
 
import java.util.Hashtable;
 
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;
 
public class Member
{
public static void main(String[] args)
{
getSupportedSASLAttributes();
testQuery();
}

public static void testQuery()
{
Hashtable<String, String> env = new Hashtable<String, String>();

String adminName = "CN=Administrator,DC=rebco,DC=local";
String adminPassword = "************";
String ldapURL = "ldap://carbon:3268";

env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");

// set security credentials, note using simple cleartext authentication
env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
env.put("javax.security.sasl.server.authentication", "true");
env.put(Context.SECURITY_PRINCIPAL, adminName);
env.put(Context.SECURITY_CREDENTIALS, adminPassword);

// connect to my domain controller
env.put(Context.PROVIDER_URL, ldapURL);

try
{
// Create the initial directory context
LdapContext ctx = new InitialLdapContext(env, null);

// Create the search controls
SearchControls searchCtls = new SearchControls();

// Specify the search scope
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);

// specify the LDAP search filter
String searchFilter = "(&(objectClass=group)(CN=Users))";

// Specify the Base for the search
String searchBase = "DC=REBCO,DC=local";

// initialize counter to total the group members
int totalResults = 0;

// Specify the attributes to return
String[] returnedAtts = {"member"};
searchCtls.setReturningAttributes(returnedAtts);

// Search for objects using the filter
NamingEnumeration answer = ctx.search(searchBase, searchFilter, searchCtls);

// Loop through the search results
while (answer.hasMoreElements())
{
SearchResult sr = (SearchResult) answer.next();

System.out.println(">>>" + sr.getName());

// Print out the members
Attributes attrs = sr.getAttributes();

if (attrs != null)
{
try
{
for (NamingEnumeration ae = attrs.getAll(); ae.hasMore() :wink: 
{
Attribute attr = (Attribute) ae.next();

System.out.println("Attribute: " + attr.getID());

for (NamingEnumeration e = attr.getAll(); e.hasMore(); totalResults++)
{
System.out.println(" " + totalResults + ". " + e.next());
}
}
}
catch (NamingException e)
{
System.err.println("Problem listing members: " + e);
}
}
}

System.out.println("Total members: " + totalResults);
ctx.close();
}
catch (NamingException e)
{
System.err.println("Problem searching directory: " + e);
}
}
}

First I was getting an exception telling me that i was missing the file C:\winnt\krb5.ini. I found an example online, filled out to the best of my knowledge, and placed it in my winnt folder.

The contents of that file are:

[libdefaults]
# set your own default realm here
default_realm = REBCO
default_tgs_enctypes = des-cbc-crc
default_tkt_enctypes = des-cbc-crc
kdc_req_checksum_type = 2
ccache_type = 2
[realms]
MYREALM = {
# You'll need to enter your KDC's host name
kdc = carbom
admin_server = rebco
}
[domain_realm]
# Alter these values based on your company's DNS mappings and
# your default realm.
#.sybase.com = MYREALM
#sybase.com = MYREALM
[logging]
default = { 
FILE:C:\WINNT\kdc.log 
kdc = FILE:C:\WINNT\kdc.log
kdc_rotate = {
# How often to rotate kdc.log. Logs will get rotated no more
# often than the period, and less often if the KDC is not used
# frequently.
period = 1d
# how many versions of kdc.log to keep around (kdc.log.0,
# kdc.log.1, ...)
versions = 10
}
[appdefaults]
kinit = {
renewable = true
forwardable= true
}

Here's the exception I'm getting now:

GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Ticket)
at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Unknown Source)
at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Unknown Source)
at sun.security.jgss.GSSManagerImpl.getCredentialElement(Unknown Source)
at sun.security.jgss.GSSCredentialImpl.add(Unknown Source)
at sun.security.jgss.GSSCredentialImpl.<init>(Unknown Source)
at sun.security.jgss.GSSCredentialImpl.<init>(Unknown Source)
at sun.security.jgss.GSSManagerImpl.createCredential(Unknown Source)
at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(Unknown Source)
at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(Unknown Source)
at com.sun.jndi.ldap.LdapClient.authenticate(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
at javax.naming.InitialContext.init(Unknown Source)
at javax.naming.ldap.InitialLdapContext.<init>(Unknown Source)
at com.ab.AAFTesting.ldap.Member.testQuery(Member.java:56)
at com.ab.AAFTesting.ldap.Member.main(Member.java:30)
Problem searching directory: javax.naming.AuthenticationException: GSSAPI [Root exception is javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided]]

I've been googling & tweaking for hours...no luck.

I'm completely at wits end...and not for lack of trying. I have no idea what further secret hoops I have to jump through to get this to work...can anyone help me out?

Thanks!

-v

[Vinnie Jenks]

*bump*

Not trying to be irritating here...just wondering if there's any hope for this situation? I've been googling for two weeks now w/ no progress...not one forum has posted a solution for me either...it's looking bad!