JNDI Authenticate User

[Jamie Allison]

Hi All,

I have the below code which is supposed to return a true if the user is
authenticated against active directory and false if the user is not.

This works fine if you send it a correct username and correct password. It
also works if you send it a correct username with an incorrect password. It
also works if you send it an in-correct username with a password.

My problem is that a few accounts in the directory don't have passwords set.
I.e. password is blank. If I send any username without a password then it
always returns true, even if that user has a password set or the user
doesn't exist. Does anyone have any ideas why this is?

<code>
public boolean authenticateUser(String userName, String password){
//Try to log in with the supplied username and password
//If it fails then either the user doesn't exist or the wrong
crudentials where supplied

try{
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, ldapConnectionString);

env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, userName + "@" +
ADName);
env.put(Context.SECURITY_CREDENTIALS, password);

DirContext ctx = new InitialDirContext(env);

return true;
}catch(Exception ex){
//Authentication failed
return false;
}
}
</code>