|
Bumpy road to add user into Active Directory -- the End. |
|
Subject: Bumpy road to add user into Active Directory -- the End.
Author: JNDI
In response to: Bumpy road to add user into Active Directory -- unicodePwd
Posted on: 10/03/2012 08:53:03 PM
Finally, if you want to create a normal active user account with password Abcd1234, here is the complete code:
/**
* Sample JNDI example code to add a user account in Active Directory
*/
import javax.naming.*;
import javax.naming.directory.*;
import java.util.Hashtable;
public class JNDI_Add_User {
public static void main(String[] args)
{
String ldapURL = "ldaps://myAD.myCompany.com:636"; // SSL
String bindDn = "CN=Administrator,CN=Users,DC=myCompany,DC=com";
String bindPwd = "password";
// Set up the environment for creating the initial context
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, ldapURL);
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, bindDn);
env.put(Context.SECURITY_CREDENTIALS, bindPwd);
try {
// Create the initial context
DirContext ctx = new InitialDirContext(env);
// Attributes to represent the user
Attributes attrs = new BasicAttributes(true); // case-ignore
// objectClass
Attribute attr = new BasicAttribute("objectClass");
attr.add("top");
attr.add("person");
attr.add("organizationalPerson");
attr.add("user");
attrs.put(attr);
// MUST attribute
attrs.put("unicodePwd", "\"Abcd1234\"".getBytes("UTF-16LE") );
attrs.put("userAccountControl", "512");
// MAY attribute
attrs.put("cn", "John Smith");
attrs.put("givenName", "John");
attrs.put("sn", "Smith");
// Create the user account
ctx.createSubcontext(
"cn=John Smith,CN=Users,DC=myCompany,DC=com",
attrs);
// close
ctx.close();
} catch (Exception e) {
e.printStackTrace();
}
}
}
Note: unicodePwd with the mysterious conversion is required; userAccountControl=512 is required, otherwise it will be defaulted to 546; SSL or StartTLS secure connection is required; There may be some password policy you have to follow, like minimum length of password.
>
> On 10/03/2012 08:48:45 PM JNDI wrote:
As shown above, Microsoft does not allow client application to directly manipulate attribute userPassword. Instead, Microsoft introduced a mysterious attribute unicodePwd which requires the password value be enclosed in double quotes and then each character (including the quotes) must be converted to its UTF16 unicode equivalent (because Windows conforms to UTF16). If you want to batch load users with LDIF, it must be further converted to Base64 encoding.
For example, for the password is Abcd1234, the LDIF representation should NOT be
Instead, it MUST be:
unicodePwd:: IgBBAGIAYwBkADEAMgAzADQAIgA=
Here is the whole chain of conversion:
Abcd1234
|
|
v
"Abcd1234"
|
|
v
0x22 00 41 00 62 00 63 00 64 00 31 00 32 00 33 00 34 00 22 00
|
|
v
IgBBAGIAYwBkADEAMgAzADQAIgA=
Whoa, that's really a myth!
References:
|
|
|
|