![]() ![]() ![]() ![]() |
Security |
The authentication mechanisms described in this lesson (simple and CRAM-MD5) authenticate the LDAP client to the LDAP server. They do not provide any other security features, such as ensuring that requests sent to the server on that authenticated connection are from the same client, or protecting the privacy of the data exchanged between the client and the server.To provide higher levels of security for communicating with its clients, most LDAP servers allow their services to be accessed through secure sockets, or SSL. Such servers support SSL ports in addition to normal (unprotected) ports. To use this service, the client needs to specify the port number of the SSL port in the Context.PROVIDER_URL
(java.naming.provider.url) property, and use SSL sockets when communicating with the server.
By default, Sun's LDAP service provider uses plain sockets when communicating with the LDAP server. To request that SSL sockets, you set the Context.SECURITY_PROTOCOL
(java.naming.security.protocol) property to "ssl".
In the following example, the LDAP server is offering SSL at port 636. To run this program, you must enable SSL on port 636 on your LDAP server. This procedure is typically carried out by the directory's administrator.
// Set up environment for creating initial context Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://localhost:636/o=JNDITutorial"); // Specify SSL env.put(Context.SECURITY_PROTOCOL, "ssl"); // Authenticate as S. User and password "mysecret" env.put(Context.SECURITY_AUTHENTICATION, "simple"); env.put(Context.SECURITY_PRINCIPAL, "cn=S. User, ou=NewHires, o=JNDITutorial"); env.put(Context.SECURITY_CREDENTIALS, "mysecret"); // Create initial context DirContext ctx = new InitialDirContext(env); // ... do something useful with ctxTo run this program, you need to have an SSL package that implements the javax.net.SocketFactory interface (see http://java.sun.com/security/ssl/API_users_guide.html for details). The SSL package must be available in your execution environment (such as the HotJavaTM Browser or the JavaTM Web Server) or be added to your classpath. Currently, Sun does not provide a standalone SSL package. See the bottom of this page for information about Java SSL packages.
Note: If you use SSL to connect to a server on a port that is not using SSL, then your program will hang. Similarly, if you use a plain socket to connect to a server's SSL socket, your application will hang. This is a characteristic of the SSL protocol.
Using Custom Sockets
When you set the Context.SECURITY_PROTOCOL property to "ssl", the LDAP provider will attempt to create an SSL socket to communicate with the server using the socket factory javax.net.ssl.SSLSocketFactory. If you want to use a different SSL package, then you need to set the java.naming.ldap.factory.socket property to the class name of the socket factory that will produce SSL sockets. This class must implement the javax.net.SocketFactory interface (see http://java.sun.com/security/ssl/API_users_guide.html for details).SSL sockets are but one type of sockets. You can think of other types of sockets that might be useful, such as those for bypassing firewalls. You can use the java.naming.ldap.factory.socket property to specify other types of sockets to use. This is useful for setting the socket factory on a per connection basis. If you want to set the socket factory for all sockets used in a program, you should use java.net.Socket.setSocketFactory(). Note that if Context.SECURITY_PROTOCOL is set to "ssl", then the java.naming.ldap.factory.socket property should specify a socket factory that produces SSL sockets.
Here is an example that creates an initial context using a custom socket factory.
// Set up environment for creating initial context Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://localhost:555/o=JNDITutorial"); // Specify socket factory env.put("java.naming.ldap.factory.socket", "com.widget.socket.MySocketFactory"); // Create initial context DirContext ctx = new InitialDirContext(env); // ... do something useful with ctxJava SSL Packages
There are other Java APIs, such as Remote Method Invocation (RMI), which use SSL. The RMI documentation includes a list of RMI-SSL related issues, including the Java SSL packages available within and outside of the US. See http://java.sun.com/products/jdk/1.2/docs/guide/rmi/SSLInfo.html for details.Security: End of Lesson
![]()
![]()
What's next? Now you can:
- Continue on in this trail for tips on performing miscellaneous operations, such as reading binary attributes.
- Go to the Searches
lesson for examples of how to perform various types of searches.
- Go to the Referral
lesson for tips on handling referrals.
- Go to the Schema
lesson for tips on accessing the schema.
- Go to the Frequently Asked Questions
lesson to read about questions that LDAP users have when using the JNDI.
![]() ![]() ![]() ![]() |
Security |