LDAP 研究

用LDAP牵涉到的几个概念,Context,entry/object,filter.Attribute
Context:上下文,我的理解是相当与文件系统的中的目录(JNDI的Naming Service是可以用操作系统的文件系统的).
entry/object:一个节点,相当与文件系统中的目录或文件.
filter:查询/过滤条件是一个字符串表达式如:(&(objectClass=top)(cn=*))查询出objectClass属性为top,cn属性为所有情况的entry.
Attribute:entry/object的属性可以理解成JAVA对象的属性,不同的是这个属性可以多次赋值.

import java.util.HashMap;
import java.util.Properties;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import javax.naming.Context;
import javax.naming.NameNotFoundException;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.AttributeInUseException;
import javax.naming.directory.Attributes;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.BasicAttributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.ModificationItem;
import javax.naming.directory.NoSuchAttributeException;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;

public class LDAPManager {

    /** The OU (organizational unit) to add users to */
    private static final String USERS_OU =
        "ou=People,dc=ibm,dc=com";

    /** The OU (organizational unit) to add groups to */
    private static final String GROUPS_OU =
        "ou=Group,dc=ibm,dc=com";

    /** The OU (organizational unit) to add permissions to */
    private static final String PERMISSIONS_OU =
        "ou=Permission,dc=ibm,dc=com";

    /** The default LDAP port */
    private static final int DEFAULT_PORT = 389;

    /** The LDAPManager instance object */
    private static Map instances = new HashMap();

    /** The connection, through a <code>DirContext</code>, to LDAP */
    private DirContext context;

    /** The hostname connected to */
    private String hostname;

    /** The port connected to */
    private int port;

    protected LDAPManager(String hostname, int port,
                          String username, String password)
        throws NamingException {

        context = getInitialContext(hostname, port, username, password);

        // Only save data if we got connected
        this.hostname = hostname;
        this.port = port;
    }

    public static LDAPManager getInstance(String hostname,
                                          int port,
                                          String username,
                                          String password)
        throws NamingException {

        // Construct the key for the supplied information
        String key = new StringBuffer()
            .append(hostname)
            .append(":")
            .append(port)
            .append("|")
            .append((username == null ? "" : username))
            .append("|")
            .append((password == null ? "" : password))
            .toString();

        if (!instances.containsKey(key)) {
            synchronized (LDAPManager.class) {
                if (!instances.containsKey(key)) {
                    LDAPManager instance =
                        new LDAPManager(hostname, port,
                                        username, password);
                    instances.put(key, instance);
                    return instance;
                }
            }
        }

        return (LDAPManager)instances.get(key);
    }

    public static LDAPManager getInstance(String hostname, int port)
        throws NamingException {

        return getInstance(hostname, port, null, null);
    }

    public static LDAPManager getInstance(String hostname)
        throws NamingException {

        return getInstance(hostname, DEFAULT_PORT, null, null);
    }

    public void addUser(String username, String firstName,
                        String lastName, String password)
        throws NamingException {

        // Create a container set of attributes
        Attributes container = new BasicAttributes();

        // Create the objectclass to add
        Attribute objClasses = new BasicAttribute("objectClass");
        objClasses.add("top");
        objClasses.add("person");
        objClasses.add("organizationalPerson");
        objClasses.add("inetOrgPerson");

        // Assign the username, first name, and last name
        String cnValue = new StringBuffer(firstName)
            .append(" ")
            .append(lastName)
            .toString();
        Attribute cn = new BasicAttribute("cn", cnValue);
        Attribute givenName = new BasicAttribute("givenName", firstName);
        Attribute sn = new BasicAttribute("sn", lastName);
        Attribute uid = new BasicAttribute("uid", username);
//        
//        Attribute att = new BasicAttribute("memberof");
//        if(username.startsWith("dev")){
//        	String memberOf = new StringBuilder("cn=dev,").append(GROUPS_OU).toString();
//        	att.add(memberOf);
//        }else if(username.startsWith("qa")){
//        	String memberOf = new StringBuilder("cn=qa,").append(GROUPS_OU).toString();
//        	att.add(memberOf);
//        }else{
//        	String memberOf = new StringBuilder("cn=dev,").append(GROUPS_OU).toString();
//        	att.add(memberOf);
//        	
//        	memberOf = new StringBuilder("cn=qa,").append(GROUPS_OU).toString();
//        	att.add(memberOf);
//        }
//        container.put(att);

        // Add password
        Attribute userPassword =
            new BasicAttribute("userpassword", password);

        // Add these to the container
        container.put(objClasses);
        container.put(cn);
        container.put(sn);
        container.put(givenName);
        container.put(uid);
        container.put(userPassword);

        // Create the entry
        context.createSubcontext(getUserDN(username), container);
    }

    public void deleteUser(String username) throws NamingException {
        try {
            context.destroySubcontext(getUserDN(username));
        } catch (NameNotFoundException e) {
            // If the user is not found, ignore the error
        }
    }

    public boolean isValidUser(String username, String password)
        throws UserNotFoundException {
        try {
            DirContext context =
                getInitialContext(hostname, port, getUserDN(username),
                                  password);
            return true;
        } catch (javax.naming.NameNotFoundException e) {
            throw new UserNotFoundException(username);
        } catch (NamingException e) {
            // Any other error indicates couldn't log user in
            return false;
        }
    }

    public void addGroup(String name, String description, String[] memberOfGroup)
        throws NamingException, Throwable {

    	 if(memberOfGroup != null && memberOfGroup.length > 0){
    		// Create a container set of attributes
		        Attributes container = new BasicAttributes();

		        // Create the objectclass to add
		        Attribute objClasses = new BasicAttribute("objectClass");
		        objClasses.add("top");
		        objClasses.add("groupOfUniqueNames");
//		        objClasses.add("groupOfNames");

		        // Assign the name and description to the group
		        Attribute cn = new BasicAttribute("cn", name);
		        Attribute desc = new BasicAttribute("description", description);
//		        StringBuilder sb = new StringBuilder();
//		        int count = 0;
//		        for(String member : memberOfGroup){
//		        	if(count > 0){
//		        		sb.append(",");
//		        	}
//		        	sb.append("uid=").append(member);
//		        	count ++;
//		        }
//		        String memberAttribute = sb.append(",").append(USERS_OU).toString();
//	        	Attribute groupmember = new BasicAttribute("member", memberAttribute);
//	        	container.put(groupmember);

		        Attribute memberAttributes = new BasicAttribute("uniquemember");
		        for(String member : memberOfGroup){
		        	String memberAttribute = new StringBuilder("uid=").append(member).append(",").append(USERS_OU).toString();
//		        	Attribute groupmember = new BasicAttribute("member", memberAttribute);
		        	memberAttributes.add(memberAttribute);
		        }

		        container.put(memberAttributes);
		        // Add these to the container
		        container.put(objClasses);
		        container.put(cn);
		        container.put(desc);

		        // Create the entry
		        context.createSubcontext(getGroupDN(name), container);
    	 }else{
    		 throw new Throwable("Error occurs, not assign members into this group.");
    	 }
    }

    public void deleteGroup(String name) throws NamingException {
        try {
            context.destroySubcontext(getGroupDN(name));
        } catch (NameNotFoundException e) {
            // If the group is not found, ignore the error
        }
    }

    public void addPermission(String name, String description)
        throws NamingException {

        // Create a container set of attributes
        Attributes container = new BasicAttributes();

        // Create the objectclass to add
        Attribute objClasses = new BasicAttribute("objectClass");
        objClasses.add("top");
        objClasses.add("ibmPermission");

        // Assign the name and description to the group
        Attribute cn = new BasicAttribute("cn", name);
        Attribute desc = new BasicAttribute("description", description);

        // Add these to the container
        container.put(objClasses);
        container.put(cn);
        container.put(desc);

        // Create the entry
        context.createSubcontext(getPermissionDN(name), container);
    }

    public void deletePermission(String name) throws NamingException {
        try {
            context.destroySubcontext(getPermissionDN(name));
        } catch (NameNotFoundException e) {
            // If the permission is not found, ignore the error
        }
    }

    public void assignUser(String username, String groupName)
        throws NamingException {

        try {
            ModificationItem[] mods = new ModificationItem[1];

            Attribute mod =
                new BasicAttribute("uniqueMember",
                                   getUserDN(username));
            mods[0] =
                new ModificationItem(DirContext.ADD_ATTRIBUTE, mod);
            context.modifyAttributes(getGroupDN(groupName), mods);
        } catch (AttributeInUseException e) {
            // If user is already added, ignore exception
        }
    }

    public void removeUser(String username, String groupName)
        throws NamingException {

        try {
            ModificationItem[] mods = new ModificationItem[1];

            Attribute mod =
                new BasicAttribute("uniqueMember",
                                   getUserDN(username));
            mods[0] =
                new ModificationItem(DirContext.REMOVE_ATTRIBUTE, mod);
            context.modifyAttributes(getGroupDN(groupName), mods);
        } catch (NoSuchAttributeException e) {
            // If user is not assigned, ignore the error
        }
    }

    public boolean userInGroup(String username, String groupName)
        throws NamingException {

        // Set up attributes to search for
        String[] searchAttributes = new String[1];
        searchAttributes[0] = "uniqueMember";

        Attributes attributes =
            context.getAttributes(getGroupDN(groupName),
                                  searchAttributes);
        if (attributes != null) {
            Attribute memberAtts = attributes.get("uniqueMember");
            if (memberAtts != null) {
                for (NamingEnumeration vals = memberAtts.getAll();
                     vals.hasMoreElements();
                     ) {
                    if (username.equalsIgnoreCase(
                        getUserUID((String)vals.nextElement()))) {
                        return true;
                    }
                }
            }
        }

        return false;
    }

    public List getMembers(String groupName) throws NamingException {
        List members = new LinkedList();

        // Set up attributes to search for
        String[] searchAttributes = new String[1];
        searchAttributes[0] = "uniqueMember";

        Attributes attributes =
            context.getAttributes(getGroupDN(groupName),
                                  searchAttributes);
        if (attributes != null) {
            Attribute memberAtts = attributes.get("uniqueMember");
            if (memberAtts != null) {
                for (NamingEnumeration vals = memberAtts.getAll();
                     vals.hasMoreElements();
                     members.add(
                         getUserUID((String)vals.nextElement()))) ;
            }
        }

        return members;
    }

    public List getGroups(String username) throws NamingException {
        List groups = new LinkedList();

        // Set up criteria to search on
        String filter = new StringBuffer()
            .append("(&")
            .append("(objectClass=groupOfIBMNames)")
            .append("(uniqueMember=")
            .append(getUserDN(username))
            .append(")")
            .append(")")
            .toString();

        // Set up search constraints
        SearchControls cons = new SearchControls();
        cons.setSearchScope(SearchControls.ONELEVEL_SCOPE);

//        cons.setSearchScope(SearchControls.SUBTREE_SCOPE);
//        cons.setCountLimit(10000);

        NamingEnumeration results =
            context.search(GROUPS_OU, filter, cons);

        while (results.hasMore()) {
            SearchResult result = (SearchResult)results.next();
            groups.add(getGroupCN(result.getName()));
        }

        return groups;
    }

    public void assignPermission(String groupName, String permissionName)
        throws NamingException {

        try {
            ModificationItem[] mods = new ModificationItem[1];

            Attribute mod =
                new BasicAttribute("uniquePermission",
                                   getPermissionDN(permissionName));
            mods[0] =
                new ModificationItem(DirContext.ADD_ATTRIBUTE, mod);
            context.modifyAttributes(getGroupDN(groupName), mods);
        } catch (AttributeInUseException e) {
            // Ignore the attribute if it is already assigned
        }
    }

    public void revokePermission(String groupName, String permissionName)
        throws NamingException {

        try {
            ModificationItem[] mods = new ModificationItem[1];

            Attribute mod =
                new BasicAttribute("uniquePermission",
                                   getPermissionDN(permissionName));
            mods[0] =
                new ModificationItem(DirContext.REMOVE_ATTRIBUTE, mod);
            context.modifyAttributes(getGroupDN(groupName), mods);
        } catch (NoSuchAttributeException e) {
            // Ignore errors if the attribute doesn't exist
        }
    }

    public boolean hasPermission(String groupName, String permissionName)
        throws NamingException {

        // Set up attributes to search for
        String[] searchAttributes = new String[1];
        searchAttributes[0] = "uniquePermission";

        Attributes attributes =
            context.getAttributes(getGroupDN(groupName),
                                  searchAttributes);
        if (attributes != null) {
            Attribute permAtts = attributes.get("uniquePermission");
            if (permAtts != null) {
                for (NamingEnumeration vals = permAtts.getAll();
                     vals.hasMoreElements();
                     ) {
                    if (permissionName.equalsIgnoreCase(
                        getPermissionCN((String)vals.nextElement()))) {
                        return true;
                    }
                }
            }
        }

        return false;
    }

    public List getPermissions(String groupName) throws NamingException {
        List permissions = new LinkedList();

        // Set up attributes to search for
        String[] searchAttributes = new String[1];
        searchAttributes[0] = "uniquePermission";

        Attributes attributes =
            context.getAttributes(getGroupDN(groupName),
                                  searchAttributes);
        if (attributes != null) {
            Attribute permAtts = attributes.get("uniquePermission");
            if (permAtts != null) {
                for (NamingEnumeration vals = permAtts.getAll();
                     vals.hasMoreElements();
                     permissions.add(
                         getPermissionCN((String)vals.nextElement()))) ;
            }
        }

        return permissions;
    }

    private String getUserDN(String username) {
        return new StringBuffer()
                .append("uid=")
                .append(username)
                .append(",")
                .append(USERS_OU)
                .toString();
    }

    private String getUserUID(String userDN) {
        int start = userDN.indexOf("=");
        int end = userDN.indexOf(",");

        if (end == -1) {
            end = userDN.length();
        }

        return userDN.substring(start+1, end);
    }

    private String getGroupDN(String name) {
        return new StringBuffer()
                .append("cn=")
                .append(name)
                .append(",")
                .append(GROUPS_OU)
                .toString();
    }

    private String getGroupCN(String groupDN) {
        int start = groupDN.indexOf("=");
        int end = groupDN.indexOf(",");

        if (end == -1) {
            end = groupDN.length();
        }

        return groupDN.substring(start+1, end);
    }

    private String getPermissionDN(String name) {
        return new StringBuffer()
                .append("cn=")
                .append(name)
                .append(",")
                .append(PERMISSIONS_OU)
                .toString();
    }

    private String getPermissionCN(String permissionDN) {
        int start = permissionDN.indexOf("=");
        int end = permissionDN.indexOf(",");

        if (end == -1) {
            end = permissionDN.length();
        }

        return permissionDN.substring(start+1, end);
    }

    private DirContext getInitialContext(String hostname, int port,
                                         String username, String password)
        throws NamingException {

        String providerURL =
            new StringBuffer("ldap://")
                .append(hostname)
                .append(":")
                .append(port)
                .toString();

        Properties props = new Properties();
        props.put(Context.INITIAL_CONTEXT_FACTORY,
                  "com.sun.jndi.ldap.LdapCtxFactory");
        props.put(Context.PROVIDER_URL, providerURL);

        if ((username != null) && (!username.equals(""))) {
            props.put(Context.SECURITY_AUTHENTICATION, "simple");
            props.put(Context.SECURITY_PRINCIPAL, username);
            props.put(Context.SECURITY_CREDENTIALS,
                ((password == null) ? "" : password));
        }

        return new InitialDirContext(props);
    }
}

public class UserNotFoundException extends RuntimeException{
	private static final long serialVersionUID = 1L;

	public UserNotFoundException(String message) {
		super(message);
	}

	public UserNotFoundException(Throwable cause) {
		super(cause);
	}

	public UserNotFoundException(String message, Throwable cause) {
		super(message, cause);
	}
}

测试方法:

import org.junit.BeforeClass;
import org.junit.Test;


public class LDAPManagerTest {
	private static LDAPManager ldapManager;

	@BeforeClass
	public static void initEnv() throws Exception{
		ldapManager = LDAPManager.getInstance("10.2.9.110", 389, "cn=manager,dc=ibm,dc=com", "secret");
	}

	@Test
	public void addGroup() throws Throwable{
		try{
			String[] str1 = {"test1", "test2", "test3", "test4", "test5"};
			String[] str2 = {"test1", "test7", "test9"};
			ldapManager.addGroup("dev", "All people in dev team", str1);
			ldapManager.addGroup("qa", "All people in dev team", str2);
			ldapManager.assignUser("test5", "qa");
		}catch(Exception e){
			e.printStackTrace();
		}
	}

	@Test
	public void addUser() throws Exception{
		for(int i=1; i<234000; i++){
			ldapManager.addUser("test"+i, "first"+i, "last"+i, "123");
		}
	}

}

search()方法的第一个参数是一个上下文执行时在这个上下文下进行查找，第二个参数是一个Filter字串意思是符合objectClass=top并且cn属性为任意值的entry，第三个属性是一个SearchControls对象在这个对象中设置一些参数用于控制查找，如controls.setSearchScope(SearchControls.SUBTREE_SCOPE); 这个方法中有三个值，SUBTREE_SCOPE为查找给定上下文(第一个参数)下以及所有下级上下文下的所有entry,而 ONELEVEL_SCOPE只查找给定上下文下的entry，OBJECT_SCOPE只查找一个entry。 controls.setCountLimit(100); 是设置查找返回的最大结果，如果查询的结果超过了这个值那么就会抛出一个异常。还有一个设置超时时间的方法setTimeout()。

[img]http://dl.iteye.com/upload/attachment/524853/dae31924-4ace-3371-a0a1-c80407c2494a.jpg[/img]

import java.util.Hashtable;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.SizeLimitExceededException;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;

/**
 * Demonstrates how to perform a search and limit the number of results
 * returned.
 * 
 * usage: java SearchCountLimit
 */
class SearchCountLimit {
  static int expected = 1;

  public static void printSearchEnumeration(NamingEnumeration srhEnum) {
    int count = 0;
    try {
      while (srhEnum.hasMore()) {
        SearchResult sr = (SearchResult) srhEnum.next();
        System.out.println(">>>" + sr.getName());
        ++count;
      }

      System.out.println("number of answers: " + count);
    } catch (SizeLimitExceededException e) {
      if (count == expected)
        System.out.println("number of answers: " + count);
      else
        e.printStackTrace();
    } catch (NamingException e) {
      e.printStackTrace();
    }
  }

  public static void main(String[] args) {
    // Set up the environment for creating the initial context
    Hashtable<String, Object> env = new Hashtable<String, Object>(11);
    env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    env.put(Context.PROVIDER_URL, "ldap://localhost:389/o=JNDITutorial");

    try {
      // Create initial context
      DirContext ctx = new InitialDirContext(env);

      // Set search controls to limit count to 'expected'
      SearchControls ctls = new SearchControls();
      ctls.setCountLimit(expected);

      // Search for objects with those matching attributes
      NamingEnumeration answer = ctx.search("ou=People", "(sn=M*)", ctls);

      // Print the answer
      printSearchEnumeration(answer);

      // Close the context when we're done
      ctx.close();
    } catch (Exception e) {
      System.err.println(e);
    }
  }
}