0

I am trying to retrieve a user (or actually, a third party framework is) from OpenLDAP, using Springs LDAPTemplate, and am noticing some strange behaviour.

When I use the LDAPTemplate to search with:

base:ou=something,ou=somethingElse,dc=oh,dc=my,dc=god
filter:(cn=someUsername)

it works fine, and I get a user back.

But, when I search with this:

base:
filter=(cn=someUsername,ou=something,ou=somethingElse,dc=oh,dc=my,dc=god)

I get nothing, instead I get an error message:

javax.naming.NameNotFoundException: [LDAP: error code 32 - No Such Object]; remaining name ''

Shouldn't these two searches be equivalent, as they refer to the exact same path in the LDAP three?

As mentioned, this is done by a third party, LdapUserDetailsService in Spring security 3.1.3.RELEASE.

The method in question looks like this:

public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    DirContextOperations userData = userSearch.searchForUser(username);

    return userDetailsMapper.mapUserFromContext(userData, username,
            authoritiesPopulator.getGrantedAuthorities(userData, username));
}

The strange thing here is that userSearch.serachForUser uses separate base and filter, and correctly retrives the user, but then when getting the authorities from authoritiesPopulator, it repeats the search, only with an empty base and everything in filter, which fails due to the abovementioned error.

Update:

I've tried bypassing the Spring-stuff by running ldapsearch directly against OpenLDAP, and I'm getting the same behaviour. Seems to be something with OpenLDAP..

Tobb
  • 11,850
  • 6
  • 52
  • 77

1 Answers1

0

You have to use at least the base DN of the database you are querying. In this case, probably dc=oh,dc=my,dc=god. Or ese include that in the connect URL.

user207421
  • 305,947
  • 44
  • 307
  • 483
  • OK, is this true for all ldap providers? Because I have the exact same code running somewhere else, only with Novell eDirectory instead of OpenLDAP. But then again, wouldn't be the first time eDirectory accepted something that is not part of the ldap standard.. What is strange is that spring security does this though, but at least I have somewhere to dig.. – Tobb Jul 07 '15 at 14:45
  • AN empty baseDN implies starting at the root, and should be supported according to RFC 4511. – jwilleke Jul 09 '15 at 08:14