I have a Java app that can authenticate to LDAP by logging users into the AD LDAP server with the NTLM name (which they are used to – this is a requirement).
I now also need to do authorization, and hence need to find a forest-unique identifier for the user (DN or UPN should work), from which I can further query the directory.
The method needs to be absolutely portable, even if the AD is structured in an unusual fashion, otherwise I could just do a string replacement and search for a UPN of “${ntlm-user}@${ntlm-domain}.${configured-trailing-domain}”
How can I do this, using pure LDAP?
Currently, I’m using the java.naming.directory package, which I’d like to keep using, since it doesn’t throw up problems when not binding with a DN but logging in with an NTLM name?
First, UPN isn’t a required field by AD, unless you’re running in a Windows 2003 Server environment or higher. Win2000 domains (actual or functional) may not have UPN’s.
sAMAccount name is the only required field that is completely portable throughout the different versions of LDAP. However it’s typically used inconjunction with the netbios domain name
(FOOBAR\JSKEET)
Using pure LDAP, you can do a Bind (make sure you can set the sealing and secure flags so you do a secure authentication!) with either the UPN or sAMAccount name (and even the full DN if thats all you have).