Spring LDAP querybuilder PartialResultException

Question

我正在尝试从LDAP服务器中获取所有用户，并从基础上进行搜索，这是我的代码:

public LdapTemplate ldapTemplate() {
        LdapContextSource ctxSrc = new LdapContextSource();
        ctxSrc.setUrl("ldap://127.0.0.1:389/");
        ctxSrc.setBase("dc=test,dc=com");
        ctxSrc.setUserDn("admin");
        ctxSrc.setPassword("password");
        ctxSrc.afterPropertiesSet();
        LdapTemplate lt = new LdapTemplate(ctxSrc);
        return lt;
}
private LdapTemplate ldapTemplate = ldapTemplate();
public List<User> getAllUsers() {

        LdapQuery query= query().base("").where("objectclass").is("user");
        return ldapTemplate.search(query, new UserAttributesMapper());
}

这是错误:

10:07:09.406 [main] DEBUG o.s.l.c.s.AbstractContextSource - AuthenticationSource not set - using default implementation
10:07:09.413 [main] DEBUG o.s.l.c.s.AbstractContextSource - Not using LDAP pooling
10:07:09.416 [main] DEBUG o.s.l.c.s.AbstractContextSource - Trying provider Urls: ldap://127.0.0.1:389/dc=test,dc=com
10:07:09.548 [main] DEBUG o.s.l.c.s.AbstractContextSource - Got Ldap context on server 'ldap://127.0.0.1:389/dc=test,dc=com'
Exception in thread "main" org.springframework.ldap.PartialResultException: Unprocessed Continuation Reference(s); nested exception is javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name '/'
    at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:216)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:385)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:309)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:616)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:586)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:1651)
    at ldap.example.UserRepositoryImpl.getAllUsers(UserRepositoryImpl.java:81)
    at ldap.example.test.LdapApp.main(LdapApp.java:23)
Caused by: javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name '/'
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2914)
    at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2888)
    at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.getNextBatch(AbstractLdapNamingEnumeration.java:148)
    at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(AbstractLdapNamingEnumeration.java:217)
    at com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMore(AbstractLdapNamingEnumeration.java:189)
    at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:365)
    ... 6 more

BUILD FAILED (total time: 1 second)

当我按ou过滤时，它可以工作，但是我需要从根目录过滤。

Answer 1

您在有问题的评论中写道，更改端口会有所帮助。
但是更改端口并不能解决此问题。3268端口指向Active Directory特殊位置-全局目录。所有对象都有一组-但每个对象只有一小部分属性(例如distinguishedName，cn，sAMAccountName ...)。
所以-它起作用，直到您不需要更多特定的属性为止。

问题分析

发生异常是因为查询的结果是AD返回referral objects:

[Active Directory] (...) generate referrals in response to queries that request data about objects that exist in the forest, but not contained on the directory server handling the request. These are called internal cross references, because they refer to domains, schema, and configuration containers within the forest.

如果禁用了引用跟踪:

If referral chasing is not enabled and a subtree search is performed, the search will return all objects within the specified domain that meet the search criteria. The search will also return referrals to any subordinate domains that are direct descendants of the directory server domain. The client must resolve the referrals by binding to the path specified by the referral and submitting another query.

您可以启用引荐跟踪，但这样做会增加成本-减慢应用程序的运行时间-您可以阅读有关here的信息。而且我认为在大多数情况下没有必要。

解决方案1:

有时，足够的解决方案是在您的问题中分配更具体的baseDN-ctxSrc.setBase()方法。也许您的所有用户都在内部路径内，例如"ou=user,dc=department,dc=test,dc=com"。

在this answer中阅读更多内容。

解决方案2:

在Spring LdapTemplate中，您还可以使用setIgnorePartialResultException()方法忽略此异常:

ldapTemplate.setIgnorePartialResultException(true);

在this answer中阅读更多内容。