bool userAuthenticated = false;
var domainName = DomainName;

if (useSSL)
{
  domainName = domainName + ":636";
}

try
{
  using (var ldap = new LdapConnection(domainName))
  {
    var networkCredential = new NetworkCredential(username,password,domainName);
    ldap.Sessionoptions.VerifyServerCertificate = new VerifyServerCertificateCallback((con,cer) => true);
    ldap.Sessionoptions.SecureSocketLayer = useSSL;
    ldap.Sessionoptions.ProtocolVersion = 3;
    ldap.AuthType = AuthType.Negotiate;
    ldap.Bind(networkCredential);
  }

  // If the bind succeeds,we have a valid user/pass.
  userAuthenticated = true;
}
catch (LdapException ldapEx)
{
  // Error Code 0x31 signifies invalid credentials,anything else will be caught outside.
  if (!ldapEx.ErrorCode.Equals(0x31))
  {
    throw;
  }
}

return userAuthenticated;

bool userAuthenticated = false;
var domainName = DomainName;

if (useSSL)
{
  domainName = domainName + ":636";
  ContextOptions options = ContextOptions.SimpleBind | ContextOptions.SecureSocketLayer;

  using (PrincipalContext pc = new PrincipalContext(ContextType.Domain,domainName,null,options))
  {
    userAuthenticated = pc.ValidateCredentials(username,options);
  }
}
else
{
  using (PrincipalContext pc = new PrincipalContext(ContextType.Domain,domainName))
  {
    userAuthenticated = pc.ValidateCredentials(username,password);
  }
}

return userAuthenticated;

解决方法

LDAP服务器是可ping的,身份验证与ldap：//完美配合,但与ldaps：//无关.它也适用于debian OS上的ldaps：//,但不适用于CentOS.

我的$ldapsearch也得到了无法联系的错误…但我修复了它在/etc/openldap/ldap.conf中设置TLS_REQCERT允许.但是为/etc/pam_ldap.conf设置它并没有帮助.

我做的步骤：

> $yum install pam_ldap nss-pam-ldapd openldap-clients
> $authconfig-tui并激活LDAP以进行身份​​验证
>修改/ etc / pam_ldap
>修改/etc/nslcd.conf
>修改/etc/openldap/ldap.conf
>创建/etc/ldap/ldap.conf(在某处读取它是一个后备配置文件路径)
>创建/etc/ldap.conf(与/etc/ldap/ldap.conf具有相同的内容)
>重启服务nscd和nslcd

更多信息：

> LDAP-Server的CA-Cert对每个人都是可读的.
> iptables已禁用

同样令人困惑的是/ var / log / secure中的IP.它表示10.1.1.1中testuser的密码失败,但LDAP服务器的配置IP为10.1.1.42,主机IP为10.1.1.27.无论如何,如果我使用uri ldap：//10.1.1.42并在认证上注释行ssl就像魅力一样.

有任何想法吗？

.

尝试通过pam,/ var / log / secure进行身份验证

Sep 15 09:50:37 client-server unix_chkpwd[16146]: password check Failed for user (testuser)
Sep 15 09:50:37 client-server sshd[16144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.1.1.1  user=testuser
Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: reconnecting to LDAP server...
Sep 15 09:50:37 client-server sshd[16144]: pam_ldap: ldap_simple_bind Can't contact LDAP server
Sep 15 09:50:40 client-server sshd[16144]: Failed password for testuser from 10.1.1.1 port 11339 ssh2
Sep 15 09:50:40 client-server sshd[16145]: Received disconnect from 10.1.1.1: 13: Unable to authenticate

运行$ldapsearch -v -H ldaps：//10.1.1.42/ -D cn = admin,dc = sub,dc = example,dc = org -W -x -b dc = sub,dc = org – d1检查ldaps //是否正常工作. (是的,它有效)

ldap_url_parse_ext(ldaps://10.1.1.42/)
ldap_initialize( ldaps://10.1.1.42:636/??base )
ldap_create
ldap_url_parse_ext(ldaps://10.1.1.42:636/??base)
Enter LDAP Password:
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 10.1.1.42:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 10.1.1.42:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
TLS: certificate [CN=sub.example.org,OU=test-ou,O=test-o,ST=test-st,C=DE] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..
TLS certificate verification: subject: CN=sub.example.org,C=DE,issuer: CN=sub.example.org,cipher: AES-128,security level: high,secret key bits: 128,total key bits: 128,cache hits: 0,cache misses: 0,cache not reusable: 0
ldap_open_defconn: successful
ldap_send_server_request
...

/etc/pam_ldap.conf的内容

ldap_version 3
pam_password crypt
uri ldaps://10.1.1.42:636
base dc=sub,dc=example,dc=org
ssl on
tls_reqcert allow
tls_cacertfile /srv/ldap-cacert.pem
tls_checkpeer no

/etc/openldap/ldap.conf的内容

TLS_REQCERT allow
TLS_CACERTFILE /srv/ldap-cacert.pem
URI ldaps://10.1.1.42:636/
BASE dc=sub,dc=org

/etc/nslcd.conf的内容

uid nslcd
gid ldap
ssl on
tls_reqcert allow
tls_cacertfile /srv/ldap-cacert.pem
uri ldaps://10.1.1.42:636/
base dc=sub,dc=org

/etc/ldap.conf和/etc/ldap/ldap.conf的内容：

tls_checkpeer no
tls_reqcert allow
tls_cacertfile /srv/ldap-cacert.pem
uri ldaps://10.1.1.42:636/
base dc=sub,dc=org

TLS: certificate [CN=sub.example.org,cache not reusable: 0

它说：证书……无效…… Peer的证书颁发者已被标记为不被用户信任.这意味着用于颁发服务器证书的CA不受信任.在我看来,CACERTFILE TLS_CACERTFILE /srv/ldap-cacert.pem不包含正确的CA证书.在得到错误清除ldapsearch输出之前它将无法工作.

一旦解决,您可能会因证书的CN而出错.如果您这样做,请尝试使用ldaps：//sub.example.org/作为URI而不是ldaps：//10.1.1.42/.如果您的DNS没有解析该名称,只需将其放在/ etc / hosts文件中(仅用于测试,您应该更新您的DNS记录).

我们使用Java LDAP API通过LDAP将用户登录到Active
Directory。我们希望增强登录功能，以进一步检查用户是否在给定的AD组中。有谁知道如何做到这一点？

当前代码：

import javax.naming.*;
import javax.naming.ldap.*;

LdapContext ctx = null;
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.SECURITY_AUTHENTICATION,"simple");
env.put(Context.PROVIDER_URL,Config.get("ldap-url"));

try {
    Control[] connCtls = new Control[] {new FastBindConnectionControl()};
    ctx = new InitialLdapContext(env,connCtls);
    ctx.addToEnvironment(Context.SECURITY_PRINCIPAL,"DOMAIN\\" + username);
    ctx.addToEnvironment(Context.SECURITY_CREDENTIALS,password);
    ctx.reconnect(connCtls);
    /* TODO: Only return true if user is in group "ABC" */
    return true; //User authenticated
} catch (Exception e) {
    return false; //User could NOT be authenticated
} finally {
    ...
}

更新 ：请参阅下面的解决方案。