Connect to the LDAP Active Directory in Java without username and password

Question

I have a simple application written in C#. That application works on windows machine and user account logged to the Active Directory.

In that application I retrive some information from LDAP Active Directory.

In C# I do connection with LDAP in that way:

DirectoryEntry de = new DirectoryEntry("LDAP://OU=places,DC=system,DC=org");

and next I retrieve needed data (for example):

DirectorySearcher searcher = new DirectorySearcher(de);
searcher.Filter = "(telephone=111222333)";
SearchResultCollection resultCollection = searcher.FindAll();

As you see in that application I do not need log to the LDAP with username and password but only I need to put the correct path:

The constructor of DirectoryEntry looks like that:

public DirectoryEntry(
    string path
)

Of course there is a constructor with username and password, but as I said I do not need to use it:

public DirectoryEntry(
    string path,
    string username,
    string password
)

I tried to retrieve the same information in Java and I used the similar code:

Hashtable<String, String> env = new Hashtable<String, String>();

env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://ad.host:389");
env.put(Context.SECURITY_PRINCIPAL, "username");
env.put(Context.SECURITY_CREDENTIALS, "password");

DirContext ldap = new InitialDirContext(env);

and next I retrieve needed data (for example):

SearchControls searchControls = new SearchControls();
searchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);
NamingEnumeration tel = ldap.search("OU=places,DC=system,DC=org", "(telephone=111222333)", searchControls);

But there is a one difference. As you see I need to put username and password in Java if I want to connect to that LDAP Active Directory.

If I do not put the username and password I will see the following error:

Exception in thread "main" javax.naming.NamingException:[LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1;] remaining name 'OU=places,DC=system,DC=org'

My question is if can I log to the same LDAP Active Directory from the same machine in Java without need to put username and password?

Is there an equivalent to do this in Java like in C# (without put the username and password)?

What about env.put(Context.SECURITY_AUTHENTICATION, "none"); — maszter
When you tried env.put(Context.SECURITY_AUTHENTICATION, "none"); did you remove your SECURITY_PRINCIPAL and SECURITY_CREDENTIALS lines? — Gabriel Luci

Gabriel Luci Gabriel Luci · Accepted Answer · 2016-11-01T18:25:46

If using env.put(Context.SECURITY_AUTHENTICATION, "none"); did not work, then your AD environment may not support anonymous authentication, understandably. Anonymous authentication is disabled by default.

When you use new DirectoryEntry(...); in C#, it may seem like you are not using any credentials, but it really uses the credentials of the currently logged on user. So it's borrowing your own credentials to make the call to AD.

Java does not do that. In fact, from the brief Googling I've done just now, it seems like it's quite difficult to make it do that, if that's what you want to do.

There is a question about how to do that here: Query Active Directory in Java using a logged on user on windows

The comment there gives a couple products to look into.

But if you don't want to use any third-party products that may complicate things, you can just provide a username and password.

If you want to test anonymous authentication in C#, you can use something like this:

new DirectoryEntry(ldapPath, null, null, AuthenticationTypes.Anonymous)

Connect to the LDAP Active Directory in Java without username and password

3 Answers