LDAP issue

[mbasil77]

I'm trying to port a piece of Java LDAP conneciton code to DOTNET.
I've done LDAP in DOTNET before, but I keep getting a very strange
message. The Java code looks like:

public static boolean authenticate(St ring username, String password)
throws javax.naming.Na mingException {
SearchControls sc;
NamingEnumerati on ne;
Hashtable<Strin g,Stringh = new Hashtable<Strin g,String>();

h.put(Context.I NITIAL_CONTEXT_ FACTORY,
"com.sun.jndi.l dap.LdapCtxFact ory");
h.put(Context.P ROVIDER_URL, "ldap://" + hostname + ":" + port);

if (usessl)
h.put(Context.S ECURITY_PROTOCO L, "ssl");
if (servicedn != null) {
h.put(Context.S ECURITY_AUTHENT ICATION, "simple");
h.put(Context.S ECURITY_PRINCIP AL, servicedn);
h.put(Context.S ECURITY_CREDENT IALS, servicepassword );
}
DirContext ctx = new InitialDirConte xt(h);

String dn = "uid=" + username + ",ou=people ," + base;
ctx.addToEnviro nment(Context.S ECURITY_AUTHENT ICATION, "simple");
ctx.addToEnviro nment(Context.S ECURITY_PRINCIP AL, dn);
ctx.addToEnviro nment(Context.S ECURITY_CREDENT IALS, password);

try {
sc = new SearchControls( );
sc.setSearchSco pe(SearchContro ls.OBJECT_SCOPE );
ne = ctx.search(dn, "(objectClass=* )", sc);
} catch (javax.naming.A uthenticationEx ception e) {
return false;
}
return true;
}

The DOTNET code looks like:

static void Main(string [] args) {

String ldapAuthPath =
"LDAP://ldap.xxx.com/uid=xxx,ou=peop le,dc=xxx,dc=co m";
String userName = "xxx";
String password = "pass";

DirectoryEntry rootEntry = null;
DirectorySearch er searcher = null;
SearchResult searchResult = null;

try {

rootEntry = new DirectoryEntry( );

rootEntry.Path = ldapAuthPath;
rootEntry.Usern ame = userName;
rootEntry.Passw ord = password;
rootEntry.Authe nticationType = AuthenticationT ypes.None;

searcher = new DirectorySearch er(rootEntry);
searcher.Search Scope = SearchScope.One Level;
searchResult = searcher.FindOn e();

// if no exception the user was verified
Console.WriteLi ne("authenticat ed");
} catch (Exception e) {
// if exception user was not authenticated
Console.WriteLi ne(e.ToString() );
}
}

I keep getting a message that the dn syntax is invalid. I've tried
various combinations of things. The Java code does not supply a
userName, but when I try to do this in DOTNET I get a invalid username
error.

Any ideas would be appreciated. It seems that the DOTNET API doesn't
offer the same degree of control.

mb

[Willy Denoyette [MVP]]

1. DirectoryEntry. UserName and Password are properties used to authenticate
the bind, you pecified an AuthenticationT ype.None that means you don't need
to specify the user credentials to bind.
2. You have (there are other options though) to specify the CN of the object
to bind to, like this:
using(Directory Entry user = new
DirectoryEntry( "LDAP://ldap.xxx.com/CN=xxx,ou=peopl e,DC=....")
{
try
{
PropertyCollect ion pcoll = user.Properties ; // this will effectively
trigger the bind
Console.WriteLi ne(user.Propert ies["cn"].Value); // get a property
}
catch (DirectoryServi cesCOMException ex)
{
Console.WriteLi ne(ex.Message);
}
}
Here you'll bind anonymously against the cn=xxxx, ou=people object in the
directory on ldap.xxx.com

Willy.
<mb******@gmail .comwrote in message
news:11******** **************@ h48g2000cwc.goo glegroups.com.. .
| I'm trying to port a piece of Java LDAP conneciton code to DOTNET.
| I've done LDAP in DOTNET before, but I keep getting a very strange
| message. The Java code looks like:
|
| public static boolean authenticate(St ring username, String password)
| throws javax.naming.Na mingException {
| SearchControls sc;
| NamingEnumerati on ne;
| Hashtable<Strin g,Stringh = new Hashtable<Strin g,String>();
|
| h.put(Context.I NITIAL_CONTEXT_ FACTORY,
| "com.sun.jndi.l dap.LdapCtxFact ory");
| h.put(Context.P ROVIDER_URL, "ldap://" + hostname + ":" + port);
|
| if (usessl)
| h.put(Context.S ECURITY_PROTOCO L, "ssl");
| if (servicedn != null) {
| h.put(Context.S ECURITY_AUTHENT ICATION, "simple");
| h.put(Context.S ECURITY_PRINCIP AL, servicedn);
| h.put(Context.S ECURITY_CREDENT IALS, servicepassword );
| }
| DirContext ctx = new InitialDirConte xt(h);
|
| String dn = "uid=" + username + ",ou=people ," + base;
| ctx.addToEnviro nment(Context.S ECURITY_AUTHENT ICATION, "simple");
| ctx.addToEnviro nment(Context.S ECURITY_PRINCIP AL, dn);
| ctx.addToEnviro nment(Context.S ECURITY_CREDENT IALS, password);
|
| try {
| sc = new SearchControls( );
| sc.setSearchSco pe(SearchContro ls.OBJECT_SCOPE );
| ne = ctx.search(dn, "(objectClass=* )", sc);
| } catch (javax.naming.A uthenticationEx ception e) {
| return false;
| }
| return true;
| }
|
| The DOTNET code looks like:
|
| static void Main(string [] args) {
|
| String ldapAuthPath =
| "LDAP://ldap.xxx.com/uid=xxx,ou=peop le,dc=xxx,dc=co m";
| String userName = "xxx";
| String password = "pass";
|
| DirectoryEntry rootEntry = null;
| DirectorySearch er searcher = null;
| SearchResult searchResult = null;
|
| try {
|
| rootEntry = new DirectoryEntry( );
|
| rootEntry.Path = ldapAuthPath;
| rootEntry.Usern ame = userName;
| rootEntry.Passw ord = password;
| rootEntry.Authe nticationType = AuthenticationT ypes.None;
|
| searcher = new DirectorySearch er(rootEntry);
| searcher.Search Scope = SearchScope.One Level;
| searchResult = searcher.FindOn e();
|
| // if no exception the user was verified
| Console.WriteLi ne("authenticat ed");
| } catch (Exception e) {
| // if exception user was not authenticated
| Console.WriteLi ne(e.ToString() );
| }
| }
|
| I keep getting a message that the dn syntax is invalid. I've tried
| various combinations of things. The Java code does not supply a
| userName, but when I try to do this in DOTNET I get a invalid username
| error.
|
| Any ideas would be appreciated. It seems that the DOTNET API doesn't
| offer the same degree of control.
|
| mb
|

[mbasil77]

I did a network trace and I think I see the issue. The Java code
switches over to SSLv3, whereas the DOTNET code does not. Anyone know
how to set that?

mb

Willy Denoyette [MVP] wrote:

1. DirectoryEntry. UserName and Password are properties used to authenticate
the bind, you pecified an AuthenticationT ype.None that means you don't need
to specify the user credentials to bind.
2. You have (there are other options though) to specify the CN of the object
to bind to, like this:
using(Directory Entry user = new
DirectoryEntry( "LDAP://ldap.xxx.com/CN=xxx,ou=peopl e,DC=....")
{
try
{
PropertyCollect ion pcoll = user.Properties ; // this will effectively
trigger the bind
Console.WriteLi ne(user.Propert ies["cn"].Value); // get a property
}
catch (DirectoryServi cesCOMException ex)
{
Console.WriteLi ne(ex.Message);
}
}
Here you'll bind anonymously against the cn=xxxx, ou=people object in the
directory on ldap.xxx.com

Willy.
<mb******@gmail .comwrote in message
news:11******** **************@ h48g2000cwc.goo glegroups.com.. .
| I'm trying to port a piece of Java LDAP conneciton code to DOTNET.
| I've done LDAP in DOTNET before, but I keep getting a very strange
| message. The Java code looks like:
|
| public static boolean authenticate(St ring username, String password)
| throws javax.naming.Na mingException {
| SearchControls sc;
| NamingEnumerati on ne;
| Hashtable<Strin g,Stringh = new Hashtable<Strin g,String>();
|
| h.put(Context.I NITIAL_CONTEXT_ FACTORY,
| "com.sun.jndi.l dap.LdapCtxFact ory");
| h.put(Context.P ROVIDER_URL, "ldap://" + hostname + ":" + port);
|
| if (usessl)
| h.put(Context.S ECURITY_PROTOCO L, "ssl");
| if (servicedn != null) {
| h.put(Context.S ECURITY_AUTHENT ICATION, "simple");
| h.put(Context.S ECURITY_PRINCIP AL, servicedn);
| h.put(Context.S ECURITY_CREDENT IALS, servicepassword );
| }
| DirContext ctx = new InitialDirConte xt(h);
|
| String dn = "uid=" + username + ",ou=people ," + base;
| ctx.addToEnviro nment(Context.S ECURITY_AUTHENT ICATION, "simple");
| ctx.addToEnviro nment(Context.S ECURITY_PRINCIP AL, dn);
| ctx.addToEnviro nment(Context.S ECURITY_CREDENT IALS, password);
|
| try {
| sc = new SearchControls( );
| sc.setSearchSco pe(SearchContro ls.OBJECT_SCOPE );
| ne = ctx.search(dn, "(objectClass=* )", sc);
| } catch (javax.naming.A uthenticationEx ception e) {
| return false;
| }
| return true;
| }
|
| The DOTNET code looks like:
|
| static void Main(string [] args) {
|
| String ldapAuthPath =
| "LDAP://ldap.xxx.com/uid=xxx,ou=peop le,dc=xxx,dc=co m";
| String userName = "xxx";
| String password = "pass";
|
| DirectoryEntry rootEntry = null;
| DirectorySearch er searcher = null;
| SearchResult searchResult = null;
|
| try {
|
| rootEntry = new DirectoryEntry( );
|
| rootEntry.Path = ldapAuthPath;
| rootEntry.Usern ame = userName;
| rootEntry.Passw ord = password;
| rootEntry.Authe nticationType = AuthenticationT ypes.None;
|
| searcher = new DirectorySearch er(rootEntry);
| searcher.Search Scope = SearchScope.One Level;
| searchResult = searcher.FindOn e();
|
| // if no exception the user was verified
| Console.WriteLi ne("authenticat ed");
| } catch (Exception e) {
| // if exception user was not authenticated
| Console.WriteLi ne(e.ToString() );
| }
| }
|
| I keep getting a message that the dn syntax is invalid. I've tried
| various combinations of things. The Java code does not supply a
| userName, but when I try to do this in DOTNET I get a invalid username
| error.
|
| Any ideas would be appreciated. It seems that the DOTNET API doesn't
| offer the same degree of control.
|
| mb
|

[Willy Denoyette [MVP]]

<mb******@gmail .comwrote in message
news:11******** **************@ m79g2000cwm.goo glegroups.com.. .
|I did a network trace and I think I see the issue. The Java code
| switches over to SSLv3, whereas the DOTNET code does not. Anyone know
| how to set that?
|
It will save you a lot of time if you would start reading the doc's on MSDN,
that said, ff you need to bind using SSL you'll have to set the
AuthenticationT ype.SecureSocke tsLayer when creating an instance of
DirectoryEntry. Note that this requires a Certificate Server running on the
AD server, but I guess you aren't even connecting to a Windows LDAP server
(Active Directory server), so I can't guarantee this will even work in your
environment. Note that simple bind should work also, what happens when you
run the sample I posted?
Willy.