使用Apache Shiro进行身份认证-LDAP两次绑定认证

水深无声 2022-06-13 14:36 288阅读 0赞

通常在根据LDAP进行身份验证时会采取以下三种方法：  
  
1、利用一个LDAP用户的用户名和密码绑定到LDAP服务器。  
  
2、在LDAP中检索一个用户的条目，然后将提供的密码和检索到的LDAP记录中的密码属性相比较。  
  
3、“两次绑定”验证方法。  
  
基于LDAP进行身份验证，最好也是最通用的方法就是 “两次绑定”。这种方法的步骤以及优点可参看我的另一篇博客： [基于LDAP进行验证-方法和问题][LDAP_-]  
  
当前Shiro只支持了第一种方法，即使用用户名和密码到LDAP服务器中进行绑定来判断合法性。  
  
我自己写了一个认证类，实现了“两次绑定”验证。同时解决了目前做LDAP认证时没有区分错误情况，返回的错误提示信息不够准确的问题。

配置信息：

[main]
    ldapRealm = main.java.name.peter.shiro.realm.ldap.LdapAuthenticator
    ldapRealm.rootDN = dc=example,dc=com
    ldapRealm.contextFactory.url = ldap://localhost:389
    ldapRealm.contextFactory.systemUsername = cn=Manager,dc=example,dc=com
    ldapRealm.contextFactory.systemPassword = secret

认证类：

/***
     * 基于Ldap进行身份认证,二次绑定方式.
     * 
     * @author wanghao
     * 
     */
    public class LdapAuthenticator extends JndiLdapRealm {
    
    	private static final Logger log = LoggerFactory
    			.getLogger(LdapAuthenticator.class);
    	private String rootDN;
    
    	public LdapAuthenticator() {
    		super();
    	}
    
    	public String getRootDN() {
    		return rootDN;
    	}
    
    	public void setRootDN(String rootDN) {
    		this.rootDN = rootDN;
    	}
    
    	@Override
    	/***
    	 * 认证
    	 */
    	protected AuthenticationInfo doGetAuthenticationInfo(
    			AuthenticationToken token) throws AuthenticationException {
    		AuthenticationInfo info;
    		try {
    			info = queryForAuthenticationInfo(token, getContextFactory());
    		} catch (AuthenticationNotSupportedException e) {
    			String msg = "Unsupported configured authentication mechanism";
    			throw new UnsupportedAuthenticationMechanismException(msg, e);
    		} catch (javax.naming.AuthenticationException e) {
    			String msg = "LDAP authentication failed.";
    			throw new AuthenticationException(msg, e);
    		} catch (NamingException e) {
    			String msg = "LDAP naming error while attempting to authenticate user.";
    			throw new AuthenticationException(msg, e);
    		} catch (UnknownAccountException e) {
    			String msg = "UnknownAccountException";
    			throw new UnknownAccountException(msg, e);
    		} catch (IncorrectCredentialsException e) {
    			String msg = "IncorrectCredentialsException";
    			throw new IncorrectCredentialsException(msg, e);
    		}
    
    		return info;
    	}
    	
    	@Override
    	protected AuthenticationInfo queryForAuthenticationInfo(
    			AuthenticationToken token, LdapContextFactory ldapContextFactory)
    			throws NamingException {
    
    		Object principal = token.getPrincipal();
    		Object credentials = token.getCredentials();
    
    		LdapContext systemCtx = null;
    		LdapContext ctx = null;
    		try {
    			systemCtx = ldapContextFactory.getSystemLdapContext();
    
    			SearchControls constraints = new SearchControls();
    			constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);
    			NamingEnumeration results = systemCtx.search(rootDN, "cn="
    					+ principal, constraints);
    			if (results != null && !results.hasMore()) {
    				throw new UnknownAccountException();
    			} else {
    				while (results.hasMore()) {
    					SearchResult si = (SearchResult) results.next();
    					principal = si.getName() + "," + rootDN;
    				}
    				log.info("DN="+principal);
    				try {
    					ctx = ldapContextFactory.getLdapContext(principal,
    							credentials);
    				} catch (NamingException e) {
    					throw new IncorrectCredentialsException();
    				}
    				return createAuthenticationInfo(token, principal, credentials,
    						ctx);
    			}
    		} finally {
    			LdapUtils.closeContext(systemCtx);
    			LdapUtils.closeContext(ctx);
    		}
    	}
    }

[LDAP_-]: http://blog.csdn.net/peterwanghao/article/details/7481444