What are the accepted SECURITY_PRINCIPAL formats for LDAP Authentication against Active Directory?

Question

I am trying to authenticate a user through LDAP against Active Directory. Following is the code snippet I use:

private DirContext bindAsUser(String bindPrincipal, String password) {
    Hashtable<String,String> env = new Hashtable<String,String>();
    env.put(Context.SECURITY_AUTHENTICATION, "simple");
    env.put(Context.SECURITY_PRINCIPAL, bindPrincipal);
    env.put(Context.PROVIDER_URL, bindUrl);
    env.put(Context.SECURITY_CREDENTIALS, password);
    env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    env.put(Context.REFERRAL, "follow");

    try {
        return new InitialLdapContext(env, null);
    } catch (NamingException e) {
        e.printStackTrace()
    }
}

The code for binding works if I provide:

Down-Level Logon Name, i.e. NetBIOSDomainName\sAMAccountName (e.g. domain\username), or
userPrincipalName (e.g. [email protected]), or
distinguishedName (e.g. CN=username,OU=xxx,DC=abc,DC=com), or
objectSid (e.g. S-1-5-21-3623811015-3361044348-30300820-1013)

as the SECURITY_PRINCIPAL, while it failed if sAMAccountName (e.g. username) was used (I guess only the names which are unique within the forest are valid).

So what are the accepted patterns for SECURITY_PRINCIPAL? I searched a few similar questions, but none provide reference to official AD/LDAP documents. Or is it a configuration which I could lookup somewhere? Thanks!

Hey @Fung, did you get any solution regarding using sAMAccountName as i am also facing the same issue? — sunder

baldpate baldpate · Accepted Answer · 2014-11-15T19:23:13

From [MS-ADTS: Active Directory Technical Specification], the official doc for AD I guess.

http://msdn.microsoft.com/en-us/library/cc223499.aspx

Section "5.1.1.1.1 Simple Authentication" lists all the name forms supported by simple authentication.

What are the accepted SECURITY_PRINCIPAL formats for LDAP Authentication against Active Directory?

2 Answers