LDAPConnection (org.apache.directory.ldap.client.api.LdapConnection)在ssl上失败

Question

我在尝试通过636连接到我的服务器并启用了ssl时出现错误。

我使用apache directory studio浏览Active directory，并通过端口636和ssl (ldaps://....)进行连接。

现在我得到了以下代码：

LdapConnection connection = new LdapNetworkConnection("172.16.1.8", 636, true);

但这并不起作用：

org.apache.directory.api.ldap.model.exception.LdapProtocolErrorException: PROTOCOL_ERROR: The server will disconnect!
at org.apache.directory.api.ldap.model.message.ResultCodeEnum.processResponse(ResultCodeEnum.java:2163)
at org.apache.directory.ldap.client.api.AbstractLdapConnection.bind(AbstractLdapConnection.java:129)
at org.apache.directory.ldap.client.api.AbstractLdapConnection.bind(AbstractLdapConnection.java:112)
at ch.berufsbildungscenter.notiztool.control.Account.login(Account.java:123)
at ch.berufsbildungscenter.notiztool.control.Account.login(Account.java:100)
at ch.berufsbildungscenter.notiztool.gui.control.LoginController$2.run(LoginController.java:53)

有人知道为什么不这样做吗？

以下是登录函数：

/**
 * Checks the pw with the pw on the Active Directory.
 * 
 * @param username 
 * @param pw
 * @param b
 * 
 * @return true if login was successful, false if not.
 */
private static boolean login(String username, String pw, Berufsbildner b) {
    if(b == null)
        return false;
    String cn = b.getNachname() + " " + b.getVorname();
    //Create connection to the LDAP server
    @SuppressWarnings("resource")
    LdapConnection connection = new LdapNetworkConnection("172.16.1.8", 636, true);
    //try to bind with the login data
    try {
        //------------------ Here's the exception
        connection.bind("CN="+ cn +",OU=Ausbilder,OU=Informatiker,OU=Ascom Bern,OU=Berufsbildungscenter,DC=bbcnet,DC=ch", pw);
        loggedin = true;
        currentAccount = b;
    } catch (LdapException e) {
        e.printStackTrace();
        loggedin = false;
        return false;
    }
    return true;

谢谢

Answer 1

使用此行设置SSL协议：

connection.setSslProtocol("SSLv3");

并将信任管理器设置为以下行：

connection.setTrustManagers(new CustomTtrustManager());

CutomTrustManager是通过实现X509TrustManager或任何类型的信任管理器来定义的信任管理器。例如：

public class CustomTtrustManager implements X509TrustManager
{
    public boolean isClientTrusted(X509Certificate[] cert)
    {
        return true;
    }

    public boolean isServerTrusted(X509Certificate[] cert)
    {
        try
        {
            cert[0].checkValidity();
            return true;
        }
        catch (CertificateExpiredException e)
        {
            return false;
        }
        catch (CertificateNotYetValidException e)
        {
            return false;
        }
    }

    public void checkClientTrusted(X509Certificate[] x509Certificates, String s)
        throws CertificateException
    {
        // Do nothing for now.
    }

    public void checkServerTrusted(X509Certificate[] x509Certificates, String s)
        throws CertificateException
    {
        // Do nothing for now.
    }

    public X509Certificate[] getAcceptedIssuers()
    {
        return new X509Certificate[0];
    }
}