1. 域伺服器（dc=dctest,dc=com）,安裝證書服務，建立企業根證書，名稱為dctest.com

   則：cn=dctest.com,dc=dctest,dc=com

2. 申請證書型別域控制器的證書

3. 將企業根證書和域控制器證書匯入到應用伺服器cacerts

4. 在應用程式中，編寫程式碼引用cacerts認證。

keytool

package bof.usermanager.auth.impl; import java.io.IOException; import java.util.ArrayList; import java.util.List; import java.util.Properties; import javax.naming.AuthenticationException; import javax.naming.Context; import javax.naming.NamingEnumeration; import javax.naming.NamingException; import javax.naming.directory.Attribute; import javax.naming.directory.Attributes; import javax.naming.directory.BasicAttribute; import javax.naming.directory.BasicAttributes; import javax.naming.directory.DirContext; import javax.naming.directory.ModificationItem; import javax.naming.directory.SearchControls; import javax.naming.directory.SearchResult; import javax.naming.ldap.Control; import javax.naming.ldap.InitialLdapContext; import javax.naming.ldap.LdapContext; import com.report.service.PropertyItem; import com.report.vo.OrganizationalUnitDomain; import com.report.vo.UserDomain; /** * 功能：本操作類提供AD域使用者的增、刪、查、改功能 * 作者：陳藝武 * 日期：2010-4-13 */ public class LdapADManager { protected DataSourceConnectLDAPVO transientInstance = null; /** 使用者的objectClass*/ private String default_objectclass = "user"; /**使用者的預設根DN*/ private String default_base = "CN=Users,DC=all,DC=com"; /** 使用者預設主鍵*/ private String key_index = "CN"; /** 使用者預設密碼屬性.*/ private String pwd_index = "unicodePwd"; private Control[] connCtls = null; private static LdapADManager LdapADManager = null; private LdapADManager(){} public static LdapADManager getInstance(){ if(LdapADManager==null) LdapADManager = new LdapADManager(); return LdapADManager; } /** * 從連線池中獲取一個連線. * * @return LdapContext * @throws NamingException */ public LdapContext getConnectionFromFool() throws NamingException { PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); String keystore = "c:/Java/jdk1.6.0_10/jre/lib/security/cacerts"; System.setProperty("javax.net.ssl.trustStore", keystore); Properties env = new Properties(); env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory"); env.put("com.sun.jndi.ldap.connect.pool", "true"); env.put(Context.SECURITY_AUTHENTICATION, "simple"); env.put(Context.SECURITY_PROTOCOL, "ssl"); //env.put("java.naming.referral", "follow"); env.put(Context.PROVIDER_URL, ldapProperty.getLdapURL()); connCtls = new Control[] { new LdapADManagerControl() }; return new InitialLdapContext(env, connCtls); } /** * 功能：校驗使用者登入. * @param userName * @param password * @return * * 作者：陳藝武 * 日期：Apr 13, 2010 */ public boolean authenticate(String userName, String password) { PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); String userDn = userName + "@" + ldapProperty.getDomain(); LdapContext ctx = null; try { ctx = getConnectionFromFool(); ctx.getRequestControls(); ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDn); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password); ctx.reconnect(connCtls); return true; } catch (AuthenticationException e) { e.printStackTrace(); return false; } catch (NamingException e) { e.printStackTrace(); return false; } finally { try { ctx.close(); } catch (Exception e){ e.printStackTrace(); } } } /** * 功能：獲取AD使用者列表 * @return * * 作者：陳藝武 * 日期：Apr 12, 2010 */ public List listUser(){ PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); List list = new ArrayList(); LdapContext ctx = null; UserDomain user=null; String base = "OU=" + ldapProperty.getBase() + "," + ldapProperty.getDomainDC(); try{ ctx = this.getConnectionFromFool(); ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, ldapProperty.getUserName() + "@" + ldapProperty.getDomain()); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, ldapProperty.getPassWord()); //base = "OU=北京華融綜合投資公司,DC=bjhr,DC=com,DC=cn"; String filter = "(&(objectCategory=person)(objectClass=USER)(name=*))"; SearchControls controls = new SearchControls(); controls.setSearchScope(SearchControls.SUBTREE_SCOPE); //controls.setReturningAttributes(new String[] {"sAMAccountName", "displayName", "department"}); controls.setReturningAttributes(new String[] {"sAMAccountName", "cn"}); NamingEnumeration<SearchResult> answer = ctx.search(base, filter, controls); while (answer.hasMore()) { user=new UserDomain(); SearchResult result = answer.next(); NamingEnumeration<? extends Attribute> attrs = result.getAttributes().getAll(); int count=0; while (attrs.hasMore()) { Attribute attr = attrs.next(); if(count==0){ user.setUserName(attr.get().toString()); }else{ user.setUserAliasName(attr.get().toString()); } count++; } user.setNameSpace(ldapProperty.getDomain()); list.add(user); } }catch(Exception e){ e.printStackTrace(); } finally { try { ctx.close(); } catch (Exception e){ e.printStackTrace(); } } return list; } /** * 功能：查詢組織單位列表 * @param ouName * @return * * 作者：陳藝武 * 日期：Apr 13, 2010 * 說明：base格式如："OU=北京華融綜合投資公司,DC=bjhr,DC=com,DC=cn"; */ public List listOrganizztionalUnit(String ouName){ PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); List list = new ArrayList(); LdapContext ctx = null; OrganizationalUnitDomain ouDomain = null; String base = "OU=" + ldapProperty.getBase() + "," + ldapProperty.getDomainDC(); try{ ctx = this.getConnectionFromFool(); ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, ldapProperty.getUserName() + "@" + ldapProperty.getDomain()); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, ldapProperty.getPassWord()); String filter = "(&(objectClass=organizationalUnit)"; if(ouName!=null&&!ouName.equals("")) filter = filter + "(name=*" + ouName + "*)"; filter = filter + ")"; SearchControls controls = new SearchControls(); controls.setSearchScope(SearchControls.SUBTREE_SCOPE); controls.setReturningAttributes(new String[] {"name"}); NamingEnumeration<SearchResult> answer = ctx.search(base, filter, controls); while (answer.hasMore()) { ouDomain = new OrganizationalUnitDomain(); SearchResult result = answer.next(); NamingEnumeration<? extends Attribute> attrs = result.getAttributes().getAll(); int count=0; while (attrs.hasMore()) { Attribute attr = attrs.next(); if(count==0){ ouDomain.setOuName(attr.get().toString()); } count++; } list.add(ouDomain); } }catch(Exception e){ e.printStackTrace(); } finally { try { ctx.close(); } catch (Exception e){ e.printStackTrace(); } } return list; } /** * 功能：新增使用者 * @param ou 組織單位：中投證券,銷售部門 * @param department * @param realName 真實姓名，如：李偉 * @param userName 使用者名稱，如：administrator * @param userPwd * @param adminUser * @param adminPwd * @return * * 作者：陳藝武 * 日期：Apr 12, 2010 */ public boolean addUser(String ou,String department,String realName, String userName, String adminUser,String adminPwd) { PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); LdapContext ctx = null; try { ctx = getConnectionFromFool(); Attributes attrs = new BasicAttributes(true); Attribute objclass = new BasicAttribute("objectclass"); setObjectclassToAttribute(objclass); attrs.put(objclass); attrs.put("sAMAccountName", userName); attrs.put("cn", realName); int UF_ACCOUNTDISABLE = 0x0002; int UF_PASSWD_NOTREQD = 0x0020; int UF_NORMAL_ACCOUNT = 0x0200; int UF_PASSWORD_EXPIRED = 0x800000; attrs.put("userAccountControl", Integer.toString(UF_NORMAL_ACCOUNT + UF_PASSWD_NOTREQD + UF_PASSWORD_EXPIRED + UF_ACCOUNTDISABLE)); ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, adminUser + "@" + ldapProperty.getDomain()); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, adminPwd); //String newUser = "CN="+realName+"," + cvtOuString(ou) + "," + ldapProperty.getDomainDC(); String newUser = "CN="+realName+"," + this.getFullOu(ctx, ou) + "," + ldapProperty.getDomainDC(); ctx.createSubcontext(newUser, attrs); ModificationItem[] mods = new ModificationItem[2]; String newQuotedPassword = "/"" + userName + "/""; byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE"); mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,new BasicAttribute("unicodePwd", newUnicodePassword)); mods[1] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,new BasicAttribute("userAccountControl", Integer.toString(UF_NORMAL_ACCOUNT + UF_PASSWORD_EXPIRED))); ctx.modifyAttributes(newUser, mods); mods = null; return true; } catch (NamingException e) { e.printStackTrace(); } catch (IOException e) { e.printStackTrace(); }finally{ if(ctx != null){ try{ ctx.close(); }catch(NamingException e){ e.printStackTrace(); } ctx = null; } } return false; } /** * 功能：管理員使用者初始化使用者密碼 * @param sUserName * @param sNewPassword * @return * * 作者：陳藝武 * 日期：Apr 13, 2010 */ public boolean adminChangePassword(String adminUser,String adminPwd,String sUserName){ PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); LdapContext ctx = null; //不能從應用中修改超級管理員密碼 if(sUserName!=null&&sUserName.equalsIgnoreCase("administrator")) return false; try { ctx = getConnectionFromFool(); ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, adminUser + "@" + ldapProperty.getDomain()); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, adminPwd); ModificationItem[] mods = new ModificationItem[1]; String newQuotedPassword = "/"" + sUserName + "/""; byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE"); mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE,new BasicAttribute("unicodePwd", newUnicodePassword)); String cnUser = getUser(ctx,sUserName) + "," + ldapProperty.getDomainDC(); ctx.modifyAttributes(cnUser, mods); return true; }catch(Exception e){ e.printStackTrace(); } finally { try { ctx.close(); } catch (Exception e){ e.printStackTrace(); } } return false; } /** * 功能：使用者修改密碼 * @param sUserName * @param sOldPassword * @param sNewPassword * @return * * 作者：陳藝武 * 日期：Apr 9, 2010 */ public boolean userChangePassword(String sUserName, String sOldPassword, String sNewPassword){ PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); LdapContext ctx = null; String userNameAndDomain = sUserName + "@" + ldapProperty.getDomain(); //不能從應用中修改超級管理員密碼 if(sUserName!=null&&sUserName.equalsIgnoreCase("administrator")) return false; try { ctx = getConnectionFromFool(); ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userNameAndDomain); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, sOldPassword); ModificationItem[] mods = new ModificationItem[2]; String oldQuotedPassword = "/"" + sOldPassword + "/""; byte[] oldUnicodePassword = oldQuotedPassword.getBytes("UTF-16LE"); String newQuotedPassword = "/"" + sNewPassword + "/""; byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE"); mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE,new BasicAttribute("unicodePwd", oldUnicodePassword)); mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE,new BasicAttribute("unicodePwd", newUnicodePassword)); String cnUser = getUser(ctx,sUserName) + "," + ldapProperty.getDomainDC(); ctx.modifyAttributes(cnUser, mods); return true; }catch( Exception e){ e.printStackTrace(); }finally{ try{ ctx.close(); }catch(Exception e){ e.printStackTrace(); } } return false; } /** * 功能：修改使用者資訊 * @param attrs * @param userDN * @return * * 作者：陳藝武 * 日期：Apr 12, 2010 */ public boolean modify(Attributes attrs, String userDN) { LdapContext ctx = null; try { ctx = getConnectionFromFool(); attrs.remove(key_index); ctx.modifyAttributes(userDN, DirContext.REPLACE_ATTRIBUTE, attrs); return true; } catch (NamingException e) { System.err.println("Problem changing password: " + e); } catch (Exception e) { System.err.println("Problem: " + e); } finally { try { ctx.close(); } catch (Exception e) { e.printStackTrace(); } } return false; } /** * 功能：刪除使用者 * @param adminUser * @param adminPwd * @param userDN 使用者登陸名 * @return * * 作者：陳藝武 * 日期：Apr 12, 2010 */ public boolean del(String adminUser,String adminPwd,String userName) { PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); LdapContext ctx = null; try { ctx = getConnectionFromFool(); ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, adminUser + "@" + ldapProperty.getDomain()); ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, adminPwd); String adUser = getUser(ctx,userName) + "," + ldapProperty.getDomainDC(); ctx.destroySubcontext(adUser); return true; } catch (NamingException e) { System.err.println("Problem changing password: " + e); } catch (Exception e) { System.err.println("Problem: " + e); } finally { try { ctx.close(); } catch (Exception e) { e.printStackTrace(); } } return false; } private void setObjectclassToAttribute(Attribute objclass){ objclass.add("top"); objclass.add("person"); objclass.add("organizationalPerson"); objclass.add("inetorgperson"); } private String getUser(LdapContext ctx,String usr){ String userName = ""; String filter = "sAMAccountName="+usr; SearchResult si = getSearchResult(ctx,filter); if(si!=null) userName = si.getName(); return userName; } private String getFullOu(LdapContext ctx,String ou){ String userName = ""; String filter = "(&(objectClass=organizationalUnit)(name=" + ou + "))"; SearchResult si = getSearchResult(ctx,filter); if(si!=null) userName = si.getName(); return userName; } private SearchResult getSearchResult(LdapContext ctx,String filter){ SearchResult si = null; PropertyItem ldapProperty = (PropertyItem)AdProperties.getInstance().getPropertyItem().get(0); try { SearchControls constraints = new SearchControls(); co<mce:script type="text/javascript" src="http://hi.images.csdn.net/js/blog/tiny_mce/themes/advanced/langs/zh.js" mce_src="http://hi.images.csdn.net/js/blog/tiny_mce/themes/advanced/langs/zh.js"></mce:script><mce:script type="text/javascript" src="http://hi.images.csdn.net/js/blog/tiny_mce/plugins/syntaxhl/langs/zh.js" mce_src="http://hi.images.csdn.net/js/blog/tiny_mce/plugins/syntaxhl/langs/zh.js"></mce:script>nstraints.setSearchScope(SearchControls.SUBTREE_SCOPE); NamingEnumeration en = ctx.search(ldapProperty.getDomainDC(), filter , constraints); // 查詢所有使用者 while(en!= null&&en.hasMoreElements()){ Object obj = en.nextElement(); if (obj instanceof SearchResult) { si = (SearchResult)obj; break; } } }catch (NamingException ex) { ex.printStackTrace(); } return si; } } class LdapADManagerControl implements Control { public byte[] getEncodedValue() { return null; } public String getID() { return "1.2.840.113556.1.4.1781"; } public boolean isCritical() { return true; } }