java - LDAPConnection (org.apache.directory.ldap.client.api.LdapConnection) 在 ssl 上失败

Question

我在尝试通过 636 并启用 ssl 连接到我的服务器时遇到错误。

我使用 apache Directory Studio 来探索 Active Directory 并通过端口 636 和 ssl (ldaps://....) 连接

现在我得到了以下代码:

LdapConnection connection = new LdapNetworkConnection("172.16.1.8", 636, true);

这不起作用:

org.apache.directory.api.ldap.model.exception.LdapProtocolErrorException: PROTOCOL_ERROR: The server will disconnect!
at org.apache.directory.api.ldap.model.message.ResultCodeEnum.processResponse(ResultCodeEnum.java:2163)
at org.apache.directory.ldap.client.api.AbstractLdapConnection.bind(AbstractLdapConnection.java:129)
at org.apache.directory.ldap.client.api.AbstractLdapConnection.bind(AbstractLdapConnection.java:112)
at ch.berufsbildungscenter.notiztool.control.Account.login(Account.java:123)
at ch.berufsbildungscenter.notiztool.control.Account.login(Account.java:100)
at ch.berufsbildungscenter.notiztool.gui.control.LoginController$2.run(LoginController.java:53)

有人知道为什么不呢？

这是登录功能:

/**
 * Checks the pw with the pw on the Active Directory.
 * 
 * @param username 
 * @param pw
 * @param b
 * 
 * @return true if login was successful, false if not.
 */
private static boolean login(String username, String pw, Berufsbildner b) {
    if(b == null)
        return false;
    String cn = b.getNachname() + " " + b.getVorname();
    //Create connection to the LDAP server
    @SuppressWarnings("resource")
    LdapConnection connection = new LdapNetworkConnection("172.16.1.8", 636, true);
    //try to bind with the login data
    try {
        //------------------ Here's the exception
        connection.bind("CN="+ cn +",OU=Ausbilder,OU=Informatiker,OU=Ascom Bern,OU=Berufsbildungscenter,DC=bbcnet,DC=ch", pw);
        loggedin = true;
        currentAccount = b;
    } catch (LdapException e) {
        e.printStackTrace();
        loggedin = false;
        return false;
    }
    return true;

谢谢

Answer 1

使用此行设置 SSL 协议(protocol):

connection.setSslProtocol("SSLv3");

并将信任管理器设置为以下行:

connection.setTrustManagers(new CustomTtrustManager());

CutomTrustManager 是您通过实现 X509TrustManager 或任何类型的信任管理器定义的信任管理器。例如:

public class CustomTtrustManager implements X509TrustManager
{
    public boolean isClientTrusted(X509Certificate[] cert)
    {
        return true;
    }

    public boolean isServerTrusted(X509Certificate[] cert)
    {
        try
        {
            cert[0].checkValidity();
            return true;
        }
        catch (CertificateExpiredException e)
        {
            return false;
        }
        catch (CertificateNotYetValidException e)
        {
            return false;
        }
    }

    public void checkClientTrusted(X509Certificate[] x509Certificates, String s)
        throws CertificateException
    {
        // Do nothing for now.
    }

    public void checkServerTrusted(X509Certificate[] x509Certificates, String s)
        throws CertificateException
    {
        // Do nothing for now.
    }

    public X509Certificate[] getAcceptedIssuers()
    {
        return new X509Certificate[0];
    }
}