Search code examples
javaactive-directoryldapjndiacl

How can i set access-control with LDAP use java api

There are standard Java API's for LDAP from Sun.
now i use these to operate Active Directory.
now i can create user account、create computer with java api.
But how can I grant authorization user&group to join a computer to an AD domain when i new a computer account?

i know openLDAP can do it :Access Control
but how can i do with java api?

Solution

  • Granting authorization is not discrib in any LDAP RFC. This part is proprietary.

    In OpenLDAP Access Control List (ACL) is established by a kind of filter.

    In SUN Directory (Nowdays Oracle one) ACLs are established by attributes.

    In Active Directory granting authorization is done using internal in the same proprietary maner as in the NFTS file system.

    The thing you can do is to execute an external program like DSACLS.EXE see Dsacls Examples

    Another solution should be to map COM ADSI objects into Java this may help you (or not).