使用Java的LDAP over SSL

以下代码工作正常：

public static void main(String[] args) {
    String userName = "admin";
    String password = "s3cret";
    Hashtable env = new Hashtable();
    env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
    env.put(Context.PROVIDER_URL,"ldap://192.168.10.45:389/dc=softwaredev,dc=local");
    //env.put(Context.Security_PROTOCOL,"ssl");
    env.put(Context.Security_AUTHENTICATION,"simple");
    env.put(Context.Security_PRINCIPAL,new String("softwaredev" + "\\" + userName));
    env.put(Context.Security_CREDENTIALS,password);

    DirContext ctx = null;
    NamingEnumeration results = null;
    try {
        ctx = new InitialDirContext(env);
        SearchControls controls = new SearchControls();
        controls.setSearchScope(SearchControls.SUBTREE_ScopE);
        results = ctx.search("","(objectclass=person)",controls);
        while (results.hasMore()) {
            SearchResult searchResult = (SearchResult) results.next();
            Attributes attributes = searchResult.getAttributes();
            System.out.println(" Person Common Name = " + attributes.get("cn"));
            System.out.println(" Person display Name = " + attributes.get("displayName"));
            System.out.println(" Person logonhours = " + attributes.get("logonhours"));
            System.out.println(" Person MemberOf = " + attributes.get("memberOf"));
        }
    } catch (Throwable e) {
        e.printstacktrace();
    } finally {
        if (results != null) {
            try {
                results.close();
            } catch (Exception e) {
            }
        }
        if (ctx != null) {
            try {
                ctx.close();
            } catch (Exception e) {
            }
        }
    }
}

如果我取消注释以下行：
env.put(Context.Security_PROTOCOL,“ssl”);启用S​​SL连接并使用此URL：

ldaps://192.168.10.45:636

然后程序失败,错误与证书有关.

*javax.naming.CommunicationException: simple bind Failed: 192.168.10.45:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building Failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
    at com.sun.jndi.ldap.LdapClient.authenticate(UnkNown Source)
    at com.sun.jndi.ldap.LdapCtx.connect(UnkNown Source)
    at com.sun.jndi.ldap.LdapCtx.<init>(UnkNown Source)
    at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(UnkNown Source)
    at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(UnkNown Source)
    at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(UnkNown Source)
    at com.sun.jndi.ldap.LdapCtxFactory.getinitialContext(UnkNown Source)
    at javax.naming.spi.NamingManager.getinitialContext(UnkNown Source)
    at javax.naming.InitialContext.getDefaultinitCtx(UnkNown Source)
    at javax.naming.InitialContext.init(UnkNown Source)
    at javax.naming.InitialContext.<init>(UnkNown Source)
    at javax.naming.directory.InitialDirContext.<init>(UnkNown Source)
    at asd.LdapBasicExample.main(LdapBasicExample.java:25)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building Failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(UnkNown Source)
    at sun.security.ssl.SSLSocketImpl.fatal(UnkNown Source)
    at sun.security.ssl.Handshaker.fatalSE(UnkNown Source)
    at sun.security.ssl.Handshaker.fatalSE(UnkNown Source)
    at sun.security.ssl.ClientHandshaker.serverCertificate(UnkNown Source)
    at sun.security.ssl.ClientHandshaker.processMessage(UnkNown Source)
    at sun.security.ssl.Handshaker.processLoop(UnkNown Source)
    at sun.security.ssl.Handshaker.process_record(UnkNown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(UnkNown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(UnkNown Source)
    at sun.security.ssl.SSLSocketImpl.readDataRecord(UnkNown Source)
    at sun.security.ssl.AppInputStream.read(UnkNown Source)
    at java.io.BufferedInputStream.fill(UnkNown Source)
    at java.io.BufferedInputStream.read1(UnkNown Source)
    at java.io.BufferedInputStream.read(UnkNown Source)
    at com.sun.jndi.ldap.Connection.run(UnkNown Source)
    at java.lang.Thread.run(UnkNown Source)
Caused by: sun.security.validator.ValidatorException: PKIX path building Failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.dobuild(UnkNown Source)
    at sun.security.validator.PKIXValidator.engineValidate(UnkNown Source)
    at sun.security.validator.Validator.validate(UnkNown Source)
    at sun.security.ssl.x509trustmanagerImpl.validate(UnkNown Source)
    at sun.security.ssl.x509trustmanagerImpl.checkTrusted(UnkNown Source)
    at sun.security.ssl.x509trustmanagerImpl.checkServerTrusted(UnkNown Source)
    ... 13 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(UnkNown Source)
    at java.security.cert.CertPathBuilder.build(UnkNown Source)*

那么,我该怎么做才能解决这个问题呢？

解决方法

Caused by: sun.security.validator.ValidatorException: PKIX path building Failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

您的客户端信任库不信任LDAP服务器的证书.您需要让它由CA签名,或者将其从服务器导出到所有客户端信任库.获得签名最终会更容易,也更便宜.

原文地址：https://www.jb51.cc/java/121412.html