For a current project I need to authenticate users against Active Directory in Java. Until now I’ve been doing it the simple way: Try to connect to the AD with the username/password-combination provided by the user. While this works well on my development system, my network administrator is unwilling to grant the live system access to the AD if the software tries do validate the user credentials by simply logging into AD.
He suggested creating another AD user whose access permissions are restricted to one specific OU. My software should connect to AD as this restricted user and then somehow validate the real user’s password. (I don’t think this is a security gain, though, I’m not a network administrator.)
Now I’m wondering: How can I validate a user’s password while I’m logged into AD as another user? Is this possible at all?
Kind regards,
Markus
The question is meaningless. There is no ‘login’ step in LDAP. There is a ‘bind’ step, and that’s what you have to use to validate a username & password.