原作者是使用ldap，下面修改為ldaps驗證
為了安全考量，有一份堅持，
原作者是用nsLookup去取得AD的主機列表，
下面是先hardcode加上一台AD主機位址，並且加上憑證
當然憑證要匯到JDK的ca路徑
範例網域：contoso.com,當然要換成你要用的Domain
package com.uitox.shared.util;
import java.util.ArrayList;
import java.util.Hashtable;
import java.util.List;
import javax.naming.CommunicationException;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.security.auth.login.AccountException;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.LoginException;
public class ActiveDirectoryAuthentication {
private static final String CONTEXT_FACTORY_CLASS = "com.sun.jndi.ldap.LdapCtxFactory";
private String ldapServerUrls[]={"ldap://fdc.contoso.com:636"};
private int lastLdapUrlIndex;
private final String domainName;
public ActiveDirectoryAuthentication(String domainName) {
this.domainName = domainName.toUpperCase();
try {
// ldapServerUrls = nsLookup(domainName);
} catch (Exception e) {
e.printStackTrace();
}
lastLdapUrlIndex = 0;
}
public boolean authenticate(String username, String password)
throws LoginException {
if (ldapServerUrls == null || ldapServerUrls.length == 0) {
throw new AccountException("Unable to find ldap servers");
}
if (username == null || password == null
|| username.trim().length() == 0
|| password.trim().length() == 0) {
throw new FailedLoginException("Username or password is empty");
}
int retryCount = 0;
int currentLdapUrlIndex = lastLdapUrlIndex;
do {
retryCount++;
try {
Hashtable- ldapServerUrls直接加入主機
22行處改成，加上DC主機，ex:ldap://fdc.contoso.com:636
註解掉原nsLookup查表，因為我hardcode了 XDprivate String ldapServerUrls[]={"ldap://fdc.contoso.com:636"}; - 指定憑證CA檔
先將企業內部root CA匯入，至
/jre/lib/security/cacerts
然後指定CA檔，讓java知道就行了
System.setProperty("javax.net.ssl.trustStore","<JDK ROOT>/jre/lib/security/cacerts"); System.setProperty("javax.net.ssl.trustStorePassword","changeit");
public class UserCredentialManager {
...
public synchronized void login(String name, String password){
boolean IsAuth = false;
ActiveDirectoryAuthentication ADAuth = new ActiveDirectoryAuthentication("CONTOSO.COM");
try {
IsAuth = ADAuth.authenticate(name, password);
} catch (LoginException e) {
e.printStackTrace();
}
if(IsAuth == true){
user = name;
}
}
...
}
